Hi Vercel Team and Community,
I’m experiencing a situation with my account and need assistance.
Attack Summary
- Attack Date: December 16-31, 2025
- Attack Origin: Washington DC, USA
- Edge Requests: 1.7M / 1M limit
- Normal Traffic: Less than 100 users, minimal daily requests
Current Status
The attack caused a massive spike in Edge Requests over 2 weeks. I think traffic pattern shows automated bot activity, not legitimate users.
Important: I have other projects on the same account that would be impacted if the account is auto-paused.
Protections Implemented
I have already enabled the following protections across all projects (after the attack):
- ✅ Bot Protection: Enabled
- ✅ AI Bots Block: Enabled
- ✅ Rate Limits: Enabled
- ✅ Monitoring Firewall logs
- ✅ It seems like normal traffic has resumed after bot attack stopped
Request
- Can auto-pause be prevented given this looks like a bot attack and not legitimate usage?
- Are there any additional recommendations to protect against future attacks?
- No warning email was received yet - is this expected behavior?
I’m on the Hobby plan and this traffic is suspected malicious bot activity, not legitimate usage. I’m actively monitoring and will maintain all protections.
Thank you for your assistance in advance!
