# I am the OP of that $104K bill post and I have some follow-up questions **URL:** \ **Category:** Support\ **Tags:** billing-pricing\ **Created:** [February 28, 2024, 10:45pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472 "2024-02-28T22:45:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![laubonghaudoi](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/laubonghaudoi/32/59159_2.png) [@laubonghaudoi](https://answers.netlify.com/u/laubonghaudoi)\ **Post date:** [February 28, 2024, 10:45pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/1 "2024-02-28T22:45:59Z")
Hi Netlify, I am the OP of this post [Netlify just sent me a $104K bill for a simple static site](https://www.reddit.com/r/webdev/comments/1b14bty/netlify_just_sent_me_a_104k_bill_for_a_simple/) and we have been communicating via email in the last few days. We appreciate Netlify’s quick actions. However, most of my questions there were still unanswered so I am posting here hoping to get more attention. So as I said in our email, at this point we are more concerned about the attacker behind this. And it would be very helpful if you can provide the following information so that we can investigate the attack further: - Full list of source IPs hitting that mp3 file - A few dozen samples of the request headers - Any indication that would make it appear that it’s a crawl (repeated request to a single URL is very different) - Connection duration - Number of simultaneous requests - Egress chart over time - Which PoP served the requests (if they have localized DNS) Since the dashboard in Netlify doesn’t offer these information I have to ask for them here. Please also let me know if I can do anything to assist your investigation. Thank you! ---
**Author:** ![laura](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/laura/32/6274_2.png) [@laura](https://answers.netlify.com/u/laura)\ **Post date:** [February 29, 2024, 2:30pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/3 "2024-02-29T14:30:34Z")
Hey there @laubonghaudoi Absolutely, we are actively working on your request in the helpdesk, we’ll continue to work on it over there. We’ll be responding to you there. Thank you. ---
**Author:** ![kristopherray](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/kristopherray/32/59188_2.png) [@kristopherray](https://answers.netlify.com/u/kristopherray)\ **Post date:** [February 29, 2024, 9:00pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/4 "2024-02-29T21:00:14Z")
Following. I’d like to know what happens with this, as this is very concerning for myself and all my clients - what other safeguards or solutions does Netlify have available to prevent something like this from happening to begin with? ---
**Author:** ![nathanmartin](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/nathanmartin/32/30845_2.png) [@nathanmartin](https://answers.netlify.com/u/nathanmartin)\ **Post date:** [February 29, 2024, 9:13pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/5 "2024-02-29T21:13:16Z")
@kristopherray There’s a post by Netlify’s CEO on X that addresses some of that (albeit perhaps not to the level of detail you may want): > For keeping an eye on anything new that’s put in place you could track this “feature request” thread: > [@Add automated kill switch or rate limiting to prevent excess billing from DDOS attacks](https://answers.netlify.com/t/add-automated-kill-switch-or-rate-limiting-to-prevent-excess-billing-from-ddos-attacks/113359): > > Hi, I’d like to avoid a [$104,500 bill](https://news.ycombinator.com/item?id=39520776) for my simple static sites on a Starter plan. My sites don’t need to be so highly available that it makes them vulnerable to DDOS attacks and me vulnerable to bills I won’t be able to pay. I’m perfectly happy with my sites going down after 100 GB of bandwidth usage. If Netlify won’t protect my sites, I’ll be forced to look at alternatives that will. ---
**Author:** ![laubonghaudoi](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/laubonghaudoi/32/59159_2.png) [@laubonghaudoi](https://answers.netlify.com/u/laubonghaudoi)\ **Post date:** [February 29, 2024, 9:23pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/6 "2024-02-29T21:23:42Z")
Thank you! Yes let’s keep our communication in our email thread and let this public thread be an open place for discussion. ---
**Author:** ![erbanku](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/erbanku/32/59245_2.png) [@erbanku](https://answers.netlify.com/u/erbanku)\ **Post date:** [March 3, 2024, 12:47pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/7 "2024-03-03T12:47:23Z")
Following. I’d like to know what happens with this. ---
**Author:** ![hrishikesh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hrishikesh/32/74607_2.png) [@hrishikesh](https://answers.netlify.com/u/hrishikesh)\ **Post date:** [March 3, 2024, 12:48pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/8 "2024-03-03T12:48:49Z")
It’s unlikely this post would be updated further as it’s being worked-on in the helpdesk. Are you looking for something specific? ---
**Author:** ![laubonghaudoi](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/laubonghaudoi/32/59159_2.png) [@laubonghaudoi](https://answers.netlify.com/u/laubonghaudoi)\ **Post date:** [March 3, 2024, 5:55pm UTC](https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472/9 "2024-03-03T17:55:12Z")
Confirming that I have received the IP address info from Netlify support. We are actively analyzing the data and reaching out to GCP for more information. Meanwhile I want to know, has Netlify also done any analysis or investigation on your end?