- Published on
You have rate limiting. 100 requests per minute per IP. The attacker uses 100 IPs. Your rate limit is bypassed. Effective rate limiting requires multiple dimensions — IP, user account, device fingerprint, and behavioral signals — not just one.