DDoS Protection - False positive and can't bypass it - Help

(edited)

Hey Team! I'm facing an issue with my project. It's a NextJS 14 app, retrieving content from a Strapi CMS instance (in Railway). To perform an on-demand retrieval when needed, I set up a webhook on my nextjs app, so when in Strapi there is an update, will consume that webhook to notify about that change to expire the cache and retrieve again the info.

Yesterday was working like a charm, but today, I noticed that it doesn't work anymore. Checking the firewall activity, I saw that it was identified as a DDoS attack because I modified 9 contents and triggered that amount of events. Even if that number is not significant it was detected as a DDoS attack, and now, that IP is like banned:

DDoS

I'm trying to whitelist it with custom rules, but even if I put that exact IP, the JA4 digest, or directly the resource patch, it's being blocked:

Is there a way to address this issue? Is there a flush on the Vercel side on those "blocked ips"?

Vercel Staff

Thanks for reaching out, !

Blocking after 9 calls does seem odd. Does the project have any other custom rules that could have blocked the CMS?

Hey Amy! Thanks for the quick reply. It's also odd to me! 9 calls, even at once, doesn't seem to be a significant number.

And no, honestly I didn't even know that I had that kind of protection. Discovered that by chance because I didn't receive any alerts/emails or errors in the logs. I suspected it could be something on the WAF side and detected that in the Firewall dashboard.

Vercel Staff

I reached out to the team for help investigating why this happened. I don't want you to stay blocked while you wait for the answer, so I reached out in a private message to the get the IP from you. We should be able to manually unblock it.

Thanks so much Amy! Really appreciate that you also offer me a workaround! Love this

Vercel Staff

Please give it a try now and let me know whether or not it's working for you

Can't be more grateful! Receiving traffic on my webhook again . Really appreaciate your diligence here on the workaround. Thanks soooo much!

Hi !

I'm facing a simillair problem, I'm working on payload + nextjs + trpc + expo project, which works great for the first ~200 or so requests (spread out over 5-10 minutes). But after that it seems to think I'm a bot, so responds with DDoS mitigations. Is there any way I can prevent this?

(edited)

DDoS

I'm trying to whitelist it with custom rules, but even if I put that exact IP, the JA4 digest, or directly the resource patch, it's being blocked:

Is there a way to address this issue? Is there a flush on the Vercel side on those "blocked ips"?

Vercel Staff

Thanks for reaching out, !

Blocking after 9 calls does seem odd. Does the project have any other custom rules that could have blocked the CMS?

Hey Amy! Thanks for the quick reply. It's also odd to me! 9 calls, even at once, doesn't seem to be a significant number.

Vercel Staff

Thanks so much Amy! Really appreciate that you also offer me a workaround! Love this

Vercel Staff

Please give it a try now and let me know whether or not it's working for you

Can't be more grateful! Receiving traffic on my webhook again . Really appreaciate your diligence here on the workaround. Thanks soooo much!

Hi !