Abstract: In one embodiment, a method includes receiving a first request message associated with the online application, where the online application is provided by one or more application servers within the network domain, where the online application manages data, determining that a first suspicion score associated with the first request message exceeds a pre-determined threshold, inserting an indication into the first request message in response to the determination, where the indication specifies that the first request message is to be routed to a sandbox environment that is configured to mimic the one or more application servers, and where the sandbox environment is configured to not update the data managed by the online application, determining first routing policies based at least on the first suspicion score, and forwarding the indication-inserted first request message to a first computing device in the network domain based on the first routing policies.