Outbid.lol DDoS attack and $1,335 Vercel bill: what happened?

What happened during the outbid.lol outage?

In an August 24, 2026 post, founder Jonathan Wilke apologized for overnight downtime and said outbid.lol had been hit by multiple DDoS attacks while he was asleep. He said he found a $1,335 amount from Vercel and brought the site back in Attack Challenge Mode.

This is the founder’s public incident account. The post does not publish attack-layer analysis, source IPs, request volume, raw logs, or evidence of data exfiltration. “The founder reported multiple DDoS attacks” is supported; a specific technical root cause or data-breach claim is not.

Was $1,335 the final Vercel bill?

No. The first post describes a $1,335 Vercel usage or billing surprise. In a reply on August 25, Wilke said Vercel provided support, refunded the charges, and personally helped configure the project to avoid further costs beyond regular usage.

Read together, the evidence supports “a reported $1,335 billing surprise followed by a founder-reported refund.” Describing $1,335 as the final hosting loss or amount ultimately paid would omit the later update.

• Initial amount seen: $1,335 as reported by the founder
• Later status: charges refunded according to the founder
• Regular legitimate usage may still cost money
• No independent invoice or credit memo is public

What does Vercel document about DDoS billing?

Vercel says automatic DDoS mitigation is available on all plans and traffic blocked by its Firewall is not charged. Requests successfully served before automatic mitigation and bot or crawler traffic that is not recognized as a DDoS event can still incur usage.

Vercel recommends the free Attack Challenge Mode during an attack. Pro teams can use Spend Management to notify, trigger a webhook, or pause production projects at a defined spend amount. Setting a budget alone does not stop usage; the pause action must be enabled separately.

Operational lessons for a viral launch

Legitimate viral traffic and malicious traffic can rise together. Before launch, monitor CDN and WAF events, expensive paths, cache hit rate, function usage, and billing thresholds. Attack Challenge Mode adds friction for legitimate visitors, so it is better treated as an incident-response control than an invisible permanent default.

A fast-growing leaderboard should isolate payment webhooks from public browsing traffic and apply separate rate limits to click counters, listings, and expensive dynamic endpoints. An availability incident is not evidence of a data breach; privacy or compromise claims require separate verified findings.

• Enable DDoS and usage alerts before launch.
• Configure an action, not only a Spend Management notification.
• Rate-limit and cache expensive dynamic endpoints.
• Separate payment fulfillment from public page traffic.
• Publish incident claims with a timeline and evidence level.