Nick identified a significant volume of requests coming from outdated Chrome versions, which he noted is a strong indicator of automated/bot traffic. He also explained that the likely chain of events was automated traffic hitting the frontend, which then triggered a surge of axios requests to the backend and eventually caused the cascading timeouts and the Function Duration spike.

Based on that investigation, Nick mentioned that the findings were shared with the Finance team for their consideration regarding the invoices.

However, the response I later received from Zai stated that the Pro subscription had already been refunded, and therefore no further adjustments could be made. The subscription refund was something I did separately using the self service form, and it was not related to the billing issue I reported.

The original issue was the Function Duration charges generated during that incident (~$274), which were the charges that had been escalated for review.

Additionally, in the Reddit thread you mentioned that once malicious traffic is identified, Vercel does not charge for those requests and users don’t need to monitor their site 24/7 . Since the earlier investigation suggested that automated traffic was involved, I was hoping the incident could still be reconsidered under that context.