I was looking at my firewall over the last day for routes hit. There’s a /ingest/s/, /ingest/i/v0/e/ and /ingest/e/ route which take up 3 of the top 4 routes hit. However, I don’t have any routes in my application that match that. What is this?
Then there are preview links showing up as Top hosts. Why would preview links be getting 3-103 visitors?!
Hi James,
Those /ingest/... paths look like Vercel’s own analytics / observability collection endpoints rather than routes from your app code.
The main thing I’d check is whether you have Web Analytics, Speed Insights, or any observability/drain-related feature enabled for the project. Those can generate request-looking entries even though you did not create an /ingest route yourself.
For the preview hosts, I’d separate “real visitors” from automated/background requests. Preview deployments can get traffic from things like link unfurlers, browser prefetches, bots, uptime checks, crawlers, or someone opening shared preview links. The host showing up does not always mean a human intentionally visited it 100+ times.
A few quick checks:
1. Filter by user agent if the dashboard/logs expose it
2. Compare those requests against Web Analytics / Speed Insights being enabled
3. Check whether the requests hit only /ingest paths or actual app pages too
4. Look at the source IP / region pattern if available
If the traffic is only to /ingest/..., I would not treat it as an unknown app route being attacked. If you’re seeing the same random hosts hit real app paths too, then I’d look more closely at bots or preview URLs being discovered/shared.
Yea this was PostHog’s reverse proxy and I just got rid of it.