Customer case studies
Three Prosopo deployments in detail: a ticket resale platform, a subscription search product whose free tier was being scraped, and a financial provider defending a login against solver services.
Three deployments, each defending a different thing against a different attacker. The customers are not named at their request, because naming a bot-protection customer tells attackers who to test against. The technical detail is unchanged.
Ticket vendor
A UK ticket resale platform with a price cap, and therefore a target for exactly the automation it exists to prevent. Deployed at the edge across the ticket page, the queue gate, the listings feed and the checkout API, because a CAPTCHA on the checkout form would have been routed around by calling the API directly.
The hardest populations were virtualised mobile clients, where the operating system and browser build are genuine and only the processor timings give it away, and real-device farms, where the hardware is real and only the interaction patterns do.
Scraped SaaS
A subscription search product whose free tier was being consumed at scale by a competitor and resold as a copycat service. The scrape ran against the API rather than the form, the usual pattern.
The detection came from an environment that contradicted itself rather than from request volume. Enforcement was a standing Access Rule on the ASN and IP ranges, generated by the anomaly detectors and re-generated as the attacker moved infrastructure.
Financial provider
A login endpoint guarding customer assets, attacked through commercial CAPTCHA-solver services. When one success is worth a customer balance, a solver charging a dollar or two per thousand solves is not a deterrent, and a harder puzzle costs the real customer more than the attacker.
Detection identifies the solver in the request path rather than testing the answer, and the block names the service that was in the loop.
Related
Recognise one of these?
If your situation looks like one of the three above, tell us what you are seeing. We will look at your site before we reply.
Frequently Asked Questions
Why are these customers not named?
At their request. Naming a bot-protection customer tells attackers who to test against, and several of these deployments defend live commercial inventory. The technical detail in each case study is unchanged; only the identity is withheld.
Can I speak to a reference customer?
Yes, at the right stage of an evaluation and with the customer's agreement. Get in touch and tell us which of the three is closest to your own situation.