Hey,
I’m hosting a project on Vercel using this repo:
GitHub - Touka19/ChatGPT-Next-Web at XD
Live site: https://chat.iemon.cfd (behind Cloudflare)
Last week, my project suddenly consumed 600+ GB of Fast Data Transfer, and my Vercel site got paused because the free plan only includes 100GB. At first, I thought it was just a traffic spike, but after checking Cloudflare analytics, something’s clearly off — this looks like a possible DDoS.
Here’s what’s happening:
On July 22, 23, and 24, my domain got 1.78k+ requests per day, mostly to the root /
Almost all of them were POST requests
Devices/OS/Browsers show up as “Unknown” in Cloudflare
A lot of traffic came from IP 85.204.93.200 (Iran) and others from India, Germany, Singapore, etc.
Cloudflare shows the majority of requests as “dynamic” (not cached), which means the bandwidth was passed through to Vercel. While domain was DNS ONLY MODE.
On July 25, I noticed ~400 GB Fast Data Transfer already used
Today (July 27), it hit 600 GB, even though the site was already paused
Meanwhile, my Edge and Function usage is super low (under all limits)
Any idea how this is happening ? I can help from my side with cloudflare analytics available.
