Detection and threat research portfolio. Client-side attestation, behavioral-signal integrity, and defensive analysis of anti-automation systems.https://anthonytdambrosio.com/en-ushttps://anthonytdambrosio.com/writeups/detection-in-the-age-of-ai-agents/https://anthonytdambrosio.com/writeups/detection-in-the-age-of-ai-agents/For years, a quiet advantage propped up bot detection: bots were brittle. Change the flow and their hardcoded logic shattered until a human rebuilt them. AI agents remove that brittleness — they adapt in real time, and anyone can deploy one. That's the real shift.Wed, 09 Sep 2026 00:00:00 GMTai-agentsbot-detectionanti-botdetection-engineeringadaptabilityhttps://anthonytdambrosio.com/writeups/how-address-tricks-beat-quantity-limits/https://anthonytdambrosio.com/writeups/how-address-tricks-beat-quantity-limits/"Limit one per customer" is easy to say and hard to enforce, because online, one customer can look like fifty. A look at how fake accounts and spoofed addresses defeat purchase limits, and how address validation and payment checks quietly shut it down.Sun, 06 Sep 2026 00:00:00 GMTfraud-preventione-commerceaddress-validationaccount-abusedetection-engineeringhttps://anthonytdambrosio.com/writeups/ghidra-and-the-double-edge-sword/https://anthonytdambrosio.com/writeups/ghidra-and-the-double-edge-sword/What Ghidra is, why the NSA built it and gave it away, why it's indispensable to defenders — and why the same capability demands judgment about how it's used.Sun, 06 Sep 2026 00:00:00 GMTreverse-engineeringghidratoolingsecurity-researchethicshttps://anthonytdambrosio.com/writeups/what-is-tls-protocol/https://anthonytdambrosio.com/writeups/what-is-tls-protocol/Before a browser sends a single byte of HTTP, its TLS handshake has already announced what software is really making the connection. Here's how ClientHello fingerprinting works, why it's tied to specific Chrome versions, and why a mismatched User-Agent is one of the cleanest tells in bot detection.Sun, 06 Sep 2026 00:00:00 GMTtlsfingerprintingja3ja4bot-detectionhttps://anthonytdambrosio.com/writeups/what-are-proxies/https://anthonytdambrosio.com/writeups/what-are-proxies/Proxies are how one actor becomes a thousand. A tour of datacenter, residential, and mobile proxies, why the residential kind defeats IP-based defense by design, and the uncomfortable supply chain that produces them — often from the phones of people who have no idea.Sun, 06 Sep 2026 00:00:00 GMTproxiesresidential-proxiesbot-detectionsupply-chain-securityfraud-preventionhttps://anthonytdambrosio.com/writeups/what-is-a-javascript-vm/https://anthonytdambrosio.com/writeups/what-is-a-javascript-vm/The strongest form of JavaScript obfuscation doesn't scramble your code — it invents a whole fake computer to run it on. Here's what a JS VM is, why anti-bot and DRM vendors rely on it, and what it can and can't actually protect.Sun, 06 Sep 2026 00:00:00 GMTjavascriptobfuscationreverse-engineeringanti-botsoftware-protectionhttps://anthonytdambrosio.com/writeups/why-captchas-do-not-stop-bots/https://anthonytdambrosio.com/writeups/why-captchas-do-not-stop-bots/CAPTCHAs increasingly fail against the automation they're meant to block, while taxing the humans they're meant to protect. A look at why, and what actually raises the cost of abuse.Sun, 06 Sep 2026 00:00:00 GMTcaptchabot-detectionfraud-preventionaccessibilitydetection-engineeringhttps://anthonytdambrosio.com/writeups/what-is-sensor-data-and-how-does-it-work/https://anthonytdambrosio.com/writeups/what-is-sensor-data-and-how-does-it-work/The client-side script on a protected site quietly takes a reading of your device and behavior, bundles it, and ships it off to be scored. Here's what's actually in that reading — and why the most powerful signals are also the most invasive.Sun, 06 Sep 2026 00:00:00 GMTsensor-datafingerprintingbot-detectionprivacygpu-fingerprintinghttps://anthonytdambrosio.com/writeups/what-is-frida-and-why-you-should-assume-your-app-is-being-watched/https://anthonytdambrosio.com/writeups/what-is-frida-and-why-you-should-assume-your-app-is-being-watched/Frida turns a running app inside-out at runtime — reading memory, hooking functions, bypassing client-side checks. Here's what it is, why obfuscation doesn't stop it, and why Frida, root, and jailbreak detection are a treadmill you can never step off.Sun, 06 Sep 2026 00:00:00 GMTfridamobile-securityraspreverse-engineeringapp-hardeninghttps://anthonytdambrosio.com/writeups/why-drop-queues-hurt-real-customers/https://anthonytdambrosio.com/writeups/why-drop-queues-hurt-real-customers/Virtual waiting rooms are supposed to give real customers a fair shot at limited stock. But when a queue orders people by who joined first, it just re-runs the exact speed race bots always win. The fix is in the ordering.Sun, 06 Sep 2026 00:00:00 GMTbot-mitigationqueue-designe-commercefairnessdetection-engineering