# Guides

> Guides to ORB networks, residential proxies, JA4+ fingerprints, threat hunting in Zeek logs and air-gapped analysis, for security and intelligence teams.

---

LLMS index: [llms.txt](/llms.txt)

---

Explainers for the people who defend networks: what covert infrastructure is, how anonymised traffic is detected, how to hunt with context in network records, and how to search sensitive selectors without leaving a footprint. Each guide ends with where Webscout fits.

---

Section pages:

- [What is an ORB network? Operational relay box networks explained](/guides/orb-networks/): How operational relay box (ORB) networks, or covert networks of compromised devices, hide state-sponsored traffic, why blocklists fail and how to respond.
- [Residential proxy detection: how residential proxies work and how to spot them](/guides/residential-proxy-detection/): What residential proxies are, why they defeat IP reputation, how detection works, what to do on a match, and how to evaluate detection data.
- [JA4+ fingerprints explained: reading JA4, and JA4 vs JA3](/guides/ja4-fingerprints-explained/): What JA4+ network fingerprints are, how to read a JA4 fingerprint, why JA4 replaced JA3, and how defenders use fingerprints with IP context.
- [Threat hunting in Zeek logs: from a raw IP address to the infrastructure behind it](/guides/zeek-threat-hunting/): How to hunt in Zeek logs when every record ends in a bare IP address: context at ingest, practical hunts, JA4+ for encrypted sessions, and detections.
- [Air-gapped network analysis: searching classified selectors with zero footprint](/guides/air-gapped-network-analysis/): How analysing open-system network data inside an air-gapped environment lets you search classified selectors without a single query leaving the building.