vladr

Already turned it off and will compare the numbers with the two weeks or so that it was on. Didn't have much of a choice as I did not want to continue racking up a larger bill from the abuse traffic being blocked.

Also with the minor but fun benefit of paying $5 each time you toggle the on/off switch.

The firewall logs for the blocked traffic show it is all being stopped from a single PoP in France. I think this is just a billing limitation but one that might have been put in place on purpose. I honestly hope they change this soon as others are bound to experience similar scenarios.

It's been hard to measure since turning on Argo coincided with a larger rewrite of the backend. Overall performance is up but the real culprit might have been more of the optimizations on the origin.

The attack looks like a layer 7 flood of HTTP requests with random but normal looking user agents. It is being mitigated using the firewall IP block in my specific case as the person is using a single specific dedicated machine.

I was also pretty surprised to hear that these requests also count towards bandwidth billing.