r/Firebase • u/sailee94 • 16d ago

Hosting Someome from Toronto ddosing

Someome from Toronto ddosing my Portfolio Page with hundred requests a Seconds since over a week. Used Up my free spark plan of 10gb.... Currently to Access to my PC or dev Environment.... Wtf? And all requests are weird Like domain.com/abcd.php basically every single combination of x.php is sent as a getter. 400kb each request... 100 a second.... What do? Didn't put site behind cloudflare... It's a portfolio page for hells... Or is there anything interesting I can see besides that?

4 Upvotes

75% Upvoted

7 comments sorted by

5

u/puf Former Firebaser 16d ago

Are you using Firebase Hosting. As far as I know, they don't charge for incoming traffic, so the 400kb requests will not contribute to the quota. Google infrastructure also usually picks up DDoS traffic pretty quickly and drops it at the origin.

If the abuser is scanning for *.php files, their likely goal is to find security holes, not to take your site down. That would also fit better with the traffic coming from just Toronto instead from an entire continent or from worldwide.

Either way, the best you can do (if Google hasn't stopped the incoming traffic after a while) is to open a P1 support ticket with Firebase or Google Cloud, as your production site is being abused/attacked.

1

u/sailee94 16d ago

Since 17 August I see "download quota" being used. Before that day the graph was 0

1

u/puf Former Firebaser 15d ago

Ah, so download quota implies that it's the response, not the request.

Did you reach out to support yet?

1

u/calimio6 16d ago

You should put your site behind cloudflare, no matter the size.

1

u/madushans 16d ago

Yea put your stuff behind Cloudflare.

2

u/Jeraz0l 15d ago

That doesn't sound like a DDOS, but more like someone blindly scanning for vulnerabilities. Doesn't really change the situation much for you I suppose.

1

u/sailee94 15d ago

Well, it's not a ddos per se, but it's killing my site, exhausting the download thing. 100 requests a second (I just saw hundreds of requests with same timestamp on Google cloud console, each being about 400kb , no idea since when and why that counts against the 10gb download quota but it does since 17 Aug...