Founded in 1993 and headquartered in Malaysia, AirAsia is the largest airline in Malaysia and prides its self for its low-cost, high availability and superior customer service. Internationally, AirAsia is ranked as one of the world’s best low-cost airline. AirAsia operates scheduled domestic and international flights to more than 165 destinations spanning 25 countries.

AirAsia is heavily reliant on its online ticketing platform, both its website and App, but its ticketing platforms could be exploited by crawlers and Bot attacks, affecting both website and app performance but also potentially exposing customer data. For AirAsia, it was difficult to distinguish legitimate customers from crawlers and bots which directly compromised airline bookings and revenue. Also, the AirAsia’s website and app experienced massive traffic flows as a result of bots which also led to additional operational costs.

Alibaba Cloud's CDN network in China enabled improvements in the latency and Round Trip Time (RTT) of the AirAsia's website. Moving to Alibaba Cloud's CDN also ensures traffic optimization for access based on user profiles.

AirAsia's and Alibaba Cloud's security teams worked together to block illicit traffic during the initial days, thanks to the extensive database of known hackers and their patterns. After thwarting high-level hackers and uncovering complicated hacking patterns, AirAsia and Alibaba Cloud security teams customized rules and applied them to Alibaba Cloud's Web Application Firewall (WAF).

The security teams also worked together to implement stricter security checks including custom built captcha solutions.

By implementing Alibaba Cloud’s CDN and WAF services and working with Alibaba Cloud’s security professionals, AirAsia identified 90 percent of the traffic as Bots. Now, Alibaba Cloud provides Air Asia with weekly security reports and regular updates.

Combining the experience of Alibaba Security Team, the product capabilities and its world-class Managed Services, it is a perfect answer to the market's inability to adequately protect customer resources from BOT attacks.