You can get really far with cheap techniques when your goal is to dissuade. The bigger concern I’d have is statistical analysis of top offender. Every OSI laye

You can get really far with cheap techniques when your goal is to dissuade. The bigger concern I’d have is statistical analysis of top offender. Every OSI layer offers more bypass techniques and is the halting problem where your goal is to get value without making everything break when a new browser comes out. You can’t cover all options as a 3rd party and get it perfect. The higher up application layer, the easier it is to bypass. The more you try to classify without impact (dpi,ids,waf,spam,av), the easier bypasses are. The domains that get effective like spam have quicker feedback loops. Network middle boxes have the slowest response cycle where they are explicitly called out in RFCs <script> In a url might get blocked but <script >… bc it’s string matching and not layer aware.