Blog — ONX

Engineering · 13 October 2026

The exploit was in the JSON. The URL looked fine.

Booking-engine APIs send the real work in a JSON body — often via fetch or XHR. A WAF that only reads the query string is inspecting the envelope. ONX reads the letter on the origin.

Engineering · 5 October 2026

When one IP address is a thousand visitors

A growing share of real people reach your origin through a privacy relay or a consumer VPN. Their address looks like a cloud datacenter. If your WAF treats that as a bot, the site feels broken to them.

Engineering · 11 September 2026

Telemetry That Learns: How ONX Strengthens the Class Prior

Most WAFs block what they recognize. ONX also measures what it does not — endpoint profiles, verified labels and network telemetry. Decisions stay on the origin; operations stay in the EU under a DPA you can sign.

Case study · 8 September 2026

2,480 Malicious Bot Incidents Stopped on the Origin

Within a single hour, ONX detected and blocked 2,480 malicious bot incidents targeting a major aquapark complex — 53 per minute on average, stopped before they became an application workload.

Security · 31 August 2026

The New Age of Bots: How ONX Stops Scrapers on the PHP Origin

Just three years ago, bots in server logs were predictable. Today, up to 40% of traffic on business applications is unwanted. Here is how ONX stops scrapers and malicious crawlers on the PHP origin — without adding latency for real guests.