Hi Vercel team,

My Hobby project vaccs-surfer was recently paused after a very large amount of automated traffic hit the site.

Project: vaccs-surfer Domain: https://vaccs-surfer.vercel.app

Vercel Firewall analytics showed approximately 3.2M+ challenged requests during the attack. There were also approximately 220K allowed requests.

My usage subsequently reached:

Edge Requests: 3.5M / 1M Function Invocations: 3.4M / 1M Fast Origin Transfer: 27.27 GB / 10 GB Fluid Active CPU: 10h 10m / 4h

I had Bot Protection enabled in Challenge mode, and I also enabled Attack Challenge Mode temporarily while the traffic was occurring.

The Firewall analytics showed highly concentrated JA4 fingerprints, many different IPs/ASNs, and browser-like User-Agents. Based on the traffic pattern and the number of challenged requests, this appears to have been automated/bot traffic rather than normal visitors.

My concern is that the project was ultimately paused because of the resulting resource usage, even though Vercel's Firewall was challenging millions of these requests.

I'd really appreciate some help understanding:

How much of the allowed traffic actually reached my application and consumed Function Invocations/CPU/Fast Origin Transfer? Whether Vercel can review the traffic and confirm whether the excess usage was primarily caused by automated traffic. Whether there are additional Firewall/WAF rules I should configure to prevent this from happening again. Whether my project can be manually reviewed and unpaused, given that the abnormal usage was caused by an apparent attack.

I'm not trying to bypass the Hobby usage limits. I want to make sure the application is properly protected so that legitimate usage doesn't get disrupted by another automated traffic spike.

Any guidance from the Vercel team or community would be greatly appreciated. Thank you.