Ant traps, fraud graphs, and the cost of blocking too soon

May 28, 2026

SMS verification abuse at scale: releasing our open source disposable phone number list

May 21, 2026

Inside the infrastructure behind fake signups: our open source disposable email domain list

May 11, 2026

You thought your growth was working. It wasn’t.

April 15, 2026

Introducing Castle’s Research Team

March 24, 2026

Inside a bot operator’s email verification infrastructure

March 10, 2026

Account enumeration in the wild: analyzing a real-world Spotify enumeration tool

March 5, 2026

You see an email ending in .eu.org. Must be legit, right?

January 27, 2026

Detecting forged browser fingerprints for bot detection, lessons from LinkedIn

January 16, 2026

Detecting browser extensions for bot detection, lessons from LinkedIn and Castle

January 14, 2026

Fingerprints beyond device IDs: engineered representations for fraud detection

January 7, 2026

Fraudulent email domain tracker: December 2025

December 30, 2025

Episode 3: Bought the wrong proxies again, did an unboxing anyway

December 23, 2025

Investigating tinyhost[.]shop: a disposable email API used for large-scale fake account creation

December 10, 2025

Once again, I bought the wrong proxies, better do science with my bandwidth

December 3, 2025

Because fraud detection deserves better than another AI-written SEO page

November 26, 2025

Fraudulent email domain tracker: November 2025

November 26, 2025

330 custom email domains, and what this tells us about how attackers build infrastructure for fake account creation

November 18, 2025

When canvas lies: handling randomized fingerprints in fraud detection

November 12, 2025

Is Puppeteer stealth dead? Not yet, but its best days are over

November 6, 2025

Fraudulent email domain tracker: October 2025

October 29, 2025

How to detect disposable email domains without relying on 3rd party APIs and lists

October 22, 2025

Roll your own bot detection: server-side detection (part 2)

October 15, 2025

Roll your own bot detection: fingerprinting/JavaScript (part 1)

October 8, 2025

Fraudulent email domain tracker: September 2025

September 30, 2025

Deep dive: how navigator.deviceMemory can be used for fingerprinting and bot detection

September 10, 2025

How we detected a CAPTCHA solver in the wild, and what it says about bot defenses

September 3, 2025

Why a classic CDP bot detection signal suddenly stopped working (and nobody noticed)

August 28, 2025

Fraudulent email domain tracker: August 2025

August 27, 2025

Finding links between fraudulent email domains using graph-based clustering

August 19, 2025

How to detect Open Bullet 2 bots running in Puppeteer mode

August 12, 2025

How to authenticate OpenAI Operator requests using HTTP message signatures

August 7, 2025

From detection to trust: the evolving challenge of AI bot authentication

August 5, 2025

From LLM scrapers to AI agents: mapping the AI bot landscape for detection teams

July 30, 2025

Fraudulent email domain tracker: July 2025

July 29, 2025

Bringing bot detection research to your AI-powered workflow

July 23, 2025

What browser fingerprinting tests like Amiunique and Browserleaks really show, and what they miss

July 16, 2025

How to detect Selenium bots?

July 16, 2025

How we hire at Castle

July 14, 2025

Detecting Gmail-based fake accounts: what Emailnator teaches us

July 9, 2025

How to detect Brave browser using HTTP headers and JavaScript

July 8, 2025

How to detect browser time zone using JavaScript

July 8, 2025

Bought sneaker proxies by mistake, did science with them anyway

July 2, 2025

CAPTCHAs 101: what they are, how they work, and where they fall short

July 1, 2025

Fake account creation attacks: anatomy, detection, and defense

June 27, 2025

Credential stuffing attacks: anatomy, detection, and defense

June 25, 2025

Fraudulent email domain tracker: June 2025

June 25, 2025

How bot detection misfires on non-mainstream browsers and privacy tools

June 17, 2025

From Puppeteer stealth to Nodriver: How anti-detect frameworks evolved to evade bot detection

June 11, 2025

What TikTok’s virtual machine tells us about modern bot defenses

June 4, 2025

Fraudulent email domain tracker: May 2025

May 27, 2025

What a Binance CAPTCHA solver tells us about today’s bot threats

May 20, 2025

Castle for Cloudflare: Unified bot and fraud defense, from edge to in-app

May 15, 2025

Detecting Hidemium: Fingerprinting inconsistencies in anti-detect browsers

May 13, 2025

Detect and crash Chromium bots with one weird trick (bots hate it!)

May 7, 2025

Fraudulent email domain tracker: April 2025

April 29, 2025

Understanding disposable emails

April 22, 2025

How dare you trust the user agent for bot detection?

April 16, 2025

Why traditional bot detection techniques are not enough, and what you can do about it

April 9, 2025

Analyzing anti-detect browsers: How to detect scripts injected via CDP in Chrome

April 2, 2025

Bot detection 101: How to detect bots In 2025?

March 25, 2025

How to detect Headless Chrome bots instrumented with Playwright?

March 19, 2025

How to detect Headless Chrome bots instrumented with Puppeteer?

March 13, 2025

Anti-detect browser analysis: How to detect the Undetectable browser?

March 5, 2025

Overview of anti-detect browsers

February 27, 2025

Antoine Vastel is joining Castle as Head of Research

February 21, 2025

Detecting noise in canvas fingerprinting

February 21, 2025

The role of WebGL renderer in browser fingerprinting

February 12, 2025

Anatomy of a 4-day mobile app credential stuffing attack

February 11, 2025

How bots and fraudsters exploit free tiers in AI SaaS

February 4, 2025

How bots and fraudsters exploit video games with credential stuffing

January 24, 2025

Open Bullet 2: The Preferred Credential Stuffing Tool for Bots

January 13, 2025

Canvas fingerprinting in the wild

December 27, 2024

Anatomy of a 6-day Credential Stuffing Attack From 2.2M Residential IPs

December 19, 2024

Fixing the blind spots in fraud prevention

October 15, 2024

Product Focus: Overview Page

April 9, 2024

8 Common Types of Account Abuse

August 14, 2023

Castle & Twilio Segment – Instant Account Defense

August 1, 2023

In Devices We Trust: Improving CAPTCHA Friction

July 21, 2023

How to Prevent Account Sharing Like Netflix

July 17, 2023

Using Zero Trust to reduce fraud and abuse

July 6, 2023

Which CAPTCHA(s) Should I Use?

June 29, 2023

Product focus: Policies

June 16, 2023

The Different Forms of Online Abuse

June 12, 2023

From Spam to Scams: How to Handle Fraud vs. Abuse

May 23, 2023

A Guide to Account Verification

May 17, 2023

Product focus: Time selector

May 11, 2023

7 Fraud Prevention Rules Using Device Fingerprinting

May 3, 2023

11 Ways to Pinpoint a User's True Location

May 1, 2023

9 Device Fingerprinting Solutions for Developers

April 21, 2023

7 Proxy Piercing Techniques: What Works in 2023?

April 7, 2023

Swiftly identify fraud rings with instant link analysis

February 16, 2023

Enhanced User Activity Monitoring

February 16, 2022

CyberNews Interview: Online businesses that handle money will be a target

February 1, 2022

A behavioral approach to device fingerprinting

November 17, 2021

Announcing the Event Explorer

July 28, 2021

Introducing the Detection of Multi-Accounting

June 7, 2021

Castle's API enhanced with Risk Signals

April 21, 2021

Introducing the React Native SDK

April 1, 2021

A Layered Approach to Bot Detection and ATO Prevention

March 25, 2021

Reducing Signup & Login Friction

February 25, 2021

Using Castle with OIDC Providers

February 16, 2021

Finding Signals in a Flood of Data

February 4, 2021

Bot or Not: Can you spot the automated mouse movements?

December 9, 2020

Joining Castle to help protect your online identity

October 12, 2020

Introducing the New Castle

October 9, 2020

How Effective Is Castle Against Credential Stuffing?

October 7, 2020

A UX Designer, Solutions Architect, and the Root of All Cool Things

August 28, 2020

How to Think About GDPR as a Security Vendor

July 24, 2020

Outsmarting ATO Threats

July 13, 2020

Protecting Consumer Identities Is a Team Effort

June 11, 2020

Managing ATOs When Online Engagement Is at a Peak [video blog]

May 28, 2020

Bad Bots vs SEO: Where Security and Marketing Collide

May 8, 2020

How We Built a Culture on Trust and Security

May 1, 2020

Defining AX: Attacker Experience

April 14, 2020

Introducing: Castle's Training Camp

April 8, 2020

Redefining Bot Detection: Why Identity Matters

March 11, 2020

Why Good Security Is a Profit Driver

February 13, 2020

Why More is Better for Attackers Perpetrating Account Takeover Attacks

January 21, 2020

Why Reputation is Everything When Perpetrating Account Takeover Attacks

January 8, 2020

How Acting Like Your Neighbor Helps Attackers Perpetrate Account Takeover Attacks

December 18, 2019

How Attackers Hide in Plain Sight When Perpetrating Account Takeover Attacks

December 11, 2019

How to Balance Security with Risk Tolerance and User Experience

November 20, 2019

[PODCAST] CISO Series Defense in Depth: User-Centric Security

October 17, 2019

Show all Blog Posts (120 more)