During Ramadan, attackers ran automated credential stuffing against SambalPay — draining wallets before the in-house rules engine responded. Watch Turnstile + Bot Management block every automated attempt instantly.
During Ramadan, bots strip-mined Sambal's promo budget within hours — costing millions. Cloudflare rate limiting stops the same IP from redeeming more than 3× per minute.
Competitor scrapers enumerated Sambal's merchant menus and pricing at scale. API Shield + Bot Management now attaches a bot score to every request — real-time decision, no latency added.
Every request carries this — powering bot decisions, data localization routing, and geo-based rate limiting.