Is it normal for your website to get this much traffic? My first thought would be that someone is trying to DDoS you (or Vercel) by exploiting the favicon (sending large headers or TLS attacks).

My next thought would be caching. Are the favicons in a /public folder? I think Vercel caches /public assets automatically, otherwise you will have to set custom cache control headers.

+1 on BestCodes' comment! 🙏

Also sharing our Firewall docs, in case it's helpful. https://vercel.com/docs/vercel-firewall

Hi, yea, we do get a few ddos attacks time to time based on the vercel firewall observability, but I assume those that are shown on vercel are actually getting blocked?

We also have a large user base with constant interactions on a site that consists of basically just images. This is just 3 days of bandwidth and traffic 😅 we sitting around 10tb bandwidth each month, that I am trying to get down to 8.

Yes the fav icons are in the /public.

I think I will just move them to an alternative storage/cdn like bunny.net.