Beyond the IP: The Shift from Velocity Metrics to Intent-Based Detection

The Breakdown of Legacy IP Filtering

When IP reputation models were first deployed at scale, monitoring frequency and comparing requests against global consortium data was highly reliable. If an IP address submitted 300 requests in ten seconds, belonged to an unmanaged data center hosting provider, or appeared on an open relay register, an automated block or challenge was the correct decision.

Adversary tactics have since undergone a systemic transformation. Coarse rate-limiting and static deny lists now face structural blind spots:

Treating every proxy as intrinsically malicious or maintaining rigid IP deny lists introduces two unacceptable business failure modes: blocking legitimate customers who route through privacy preserving relays and mobile carrier NAT, or relaxing rate thresholds and allowing distributed account takeover attacks to bypass web application firewalls.

The Intent-Based Detection Architecture

To halt distributed reconnaissance and credential stuffing without interfering with legitimate users, the ThreatPoint Engine fuses network consortium intelligence with active Intent Telemetry. The decision model moves beyond where traffic originates to evaluate how the client negotiates, authenticates, and moves through application logic.

1. Protocol & Transport-Layer Fingerprinting (TLS JA3/JA4 & HTTP/2)

When an adversary utilizes automated tooling (such as headless Chromium, Puppeteer, or compiled Python scripts) routed through clean domestic residential IPs, the physical IP is pristine. However, the cryptographic handshake exposes the machine's true identity:

• JA3/JA4 TLS Inspection: Analysis of cipher suite sequences, supported extensions, elliptic curves, and point formats in the initial Client Hello. A request header claiming to be Safari on macOS whose cipher ordering mirrors a Go HTTP client triggers an immediate high-confidence intent flag.
• HTTP/2 Frame Analysis: Monitoring frame prioritization, multiplexing stream settings, and window update behaviors to unmask synthetic protocol stacks.

2. Client-Side Telemetry & Hardware Biometrics

By embedding lightweight client telemetry into WordPress endpoints or custom application views, ThreatPoint extracts passive entropy signals during sensitive interactions (authentication, checkout, and high-privilege operations):

• Headless Runtime Detection: Evaluating WebGL vendor/renderer strings, AudioContext audio-buffer decay, and Canvas rendering nuances to expose virtualized browser instances.
• Hardware Consistency: Correlating declared User-Agent strings with physical screen dimensions, hardware concurrency counters, touch event dispatching, and OS-level platform properties.

3. Behavioral Cadence & In-Session Canary Traps

Intent manifests in navigation topology. Automated scrapers and brute-force bots execute mechanical paths: they skip secondary stylesheet/script requests, trigger form submissions within single-digit milliseconds of page render, or interact with hidden DOM honeypot fields inserted dynamically into protected forms.

{
  "client_ip": "82.165.94.112",
  "consortium_assessment": {
    "asn": 8560,
    "carrier_nat": false,
    "residential_proxy_confidence": 0.94
  },
  "session_intent": {
    "tls_handshake_profile": "MISMATCH_CHROMIUM_ON_PYTHON",
    "dom_canary_tripped": true,
    "interaction_cadence": "LINEAR_AUTOMATION",
    "client_entropy_score": 0.12
  },
  "threat_verdict": {
    "action": "DROP_OR_CHALLENGE",
    "confidence": 99.8%,
    "classification": "CREDENTIAL_STUFFING_PROBE"
  }
}

Consortium Data: The Baseline Weighting Factor

IP reputation remains a vital pillar of perimeter defense—not as a blunt, static deny list, but as a live weighting factor. By correlating an IP's activity history across the entire ThreatPoint consortium with immediate session telemetry, our edge decision engine distinguishes between:

• A genuine user operating through a reputable corporate or personal VPN (legitimate protocol stack, authentic human cadence, no honeypot violations) → Allow.
• An automated actor cycling through pristine residential broadband connections to scrape pricing or execute credential lists → Neutralize.

Deploying with ThreatPoint: API & WordPress Integration

Whether securing Postfix, LAMP stacks, distributed cloud APIs or hardening a high-traffic WordPress installation, ThreatPoint provides zero-friction deployment:

• ThreatPoint WordPress Plugin: Intercepts probes at wp-login.php, contact endpoints, and XML-RPC, embedding canary traps and validating visitor intent before server resources are consumed.
• Sub-2ms Edge API: Native edge middleware for Cloudflare Workers, AWS Lambda, Node.js, and Python services, providing instant intent verdicts directly on incoming HTTP requests.