Blog
Stories from hotels, municipalities and shops — and the EU rules that make ONX the easy yes.
Blocking on the second suspicious request instead of the first would have stopped 171 of 173 attackers and 97.8% of their requests over 30 days, without blocking anyone who showed signs of being a person.
Read moreOn a test set of hotel booking traffic, regex false positives fell from 9.5% to 2.9% of legitimate requests, and attacks caught rose from 69% to 100%. The change that did it is a fixed corpus every rule has to pass.
Read moreBooking-engine APIs send the real work in a JSON body — often via fetch or XHR. A WAF that only reads the query string is inspecting the envelope. ONX reads the letter on the origin.
Read moreA growing share of real people reach your origin through a privacy relay or a consumer VPN. Their address looks like a cloud datacenter. If your WAF treats that as a bot, the site feels broken to them.
Read moreMost WAFs block what they recognize. ONX also measures what it does not — endpoint profiles, verified labels and network telemetry. Decisions stay on the origin; operations stay in the EU under a DPA you can sign.
Read moreWithin a single hour, ONX detected and blocked 2,480 malicious bot incidents targeting a major aquapark complex — 53 per minute on average, stopped before they became an application workload.
Read moreJust three years ago, bots in server logs were predictable. Today, up to 40% of traffic on business applications is unwanted. Here is how ONX stops scrapers and malicious crawlers on the PHP origin — without adding latency for real guests.
Read more