I just got notified that our plan was already at 75% of our usage and when looking into it, it seems one of our websites is being targeted in a DDOS attack as the 160k requests that have happened in the last day have been from one IP address. My question is, how the hell does Vercel not look at this and think, hey this might not be right? Or am I thinking to highly of Vercel now?
Vercel does have automatic DDoS protection at multiple layers, but some sophisticated bots can bypass basic detection.
You should do this immediately:
Enable Attack Challenge Mode It is specifically designed for situations like this, it's your best immediate defense against ongoing attacks while preserving legitimate traffic.
https://vercel.com/docs/vercel-firewall/attack-challenge-mode
Additional steps:
https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules
Hi , welcome to the Vercel Community!
I'm sorry that you're facing this. Could you share the project ID and team ID where this is happening?
I'll have our Firewall team take a look at it as to why the DDoS protection wasn't activated.
Project ID is prj_UuVpRqtbvKvmaXuo9WU8CFVwC4f6
Team ID is team_AJwuTX39g6monkXBZ32LV9tS
I’ve for now been able to stop it by enabling Bot Protection and adding a custom rule for that specific IP address which seems to work (for now). But I’m currently still monitoring.
Cool - keep us updated!
Thanks for sharing these details. As I can see, the traffic rose once and then stayed there. I think maxing around ~9K requests per hour. While not much when we compare it to other DDoS attacks, I think it certainly was an off pattern for your projects. I'll share this feedback with our team.
I see that your Firewall rules are correctly dodging this traffic now.