You look for abnormal payout ratios, repeated winning sequences, and clustered sessions that deviate from expected randomness in controlled test baselines. Log analysis helps flag accounts or device IDs showing synchronized timing, unusually high return rates, or bot-like betting patterns during the spike window. Heatmap-style session flows and funnel drop-offs reveal where exploitation concentrates, especially when payout redemption steps are triggered faster than typical user journeys.