Follow-up: Second Bot Attack on Dec 8 - Both Limits Exceeded, Enhanced Protections Implemented

Help
,
1

Thank you for preventing auto-pause after the Nov 24 attack. I’ve kept all recommended protections active and monitoring daily.

Second Attack - Dec 8, 2024:

Project: multivest-engine

Plan: Hobby (Free Tier)

Attack Summary:

  • Edge Requests: Massive spike (~3.9M requests in one day vs normal <1,000/day)

  • Fast Data Transfer: Significant data transfer spike

  • Pattern: Sudden burst from single location, then immediately stopped

  • Behavior: Clearly automated/bot traffic, not legitimate users

Current Status:

  • Edge Requests: Exceeded 1M monthly limit

  • Fast Data Transfer: Exceeded 100 GB monthly limit

  • Post-Attack: Traffic returned to normal levels immediately

Protections Active:

  • WAF rate limiting and bot blocking rules implemented Nov 24 (enhanced since Nov 24)

  • Optimized caching headers

  • robots.txt and X-Robots-Tag headers

  • Source maps disabled

  • Attack Challenge Mode enabled

Requests:

  1. Can auto-pause be prevented again given this is a second attack?

  2. When do free tier limits reset? (Billing section shows blank in dashboard)

  3. Can these attack spikes be credited/waived as they’re clearly malicious?

  4. Any additional recommendations to prevent future attacks?

Both attacks followed the same pattern: sudden spike, single source, then stops. This suggests coordinated bot attacks rather than legitimate traffic.

I’m continuing to monitor and maintain all protections. Thank you for your support.

5

Hi @thomas-6684, thanks for sharing it here.

You did the right thing by enabling “Attack challenge mode”.

  1. We can wait and see if the project gets paused.
  2. As the Hobby plan is a free tier there are no billing cycles. In most cases, if you exceed your usage limits on the Hobby plan, you will have to wait until 30 days have passed before you can use the feature again.
  3. As per the Vercel Firewall pricing, you won’t get charged for requests that don’t go past the Attach challenge mode.
  4. Since, this project is being targeted again, I’d suggest keeping a note of the user agent/IP addresses in a Notion doc or something. Also, double check for any secret leaks or vulnerabilities in your code because the attackers might try to break-in.

Apart from that, I can only recommend you stay on top of the logs and observability metrics to take proactive actions.

If you haven’t already, please read about the latest React2Shell vulnerability and apply patch https://vercel.com/kb/bulletin/react2shell.

1 Like