Hi Vercel team,

I believe legitimate traffic to my project inventario-amarena is being incorrectly blocked by Vercel's system-level DDoS Mitigation.

The application works normally from some internet connections, but from the network used at our business, users intermittently receive 403 Forbidden.

In Firewall > Traffic, I can see hundreds of denied requests attributed to DDoS Mitigation. There are no Custom Rules configured and Bot Protection is inactive.

Legitimate routes being denied include:

/login /dashboard /caja /favicon.ico

The denied traffic is mainly shown from:

181.78.28.4 181.78.28.5

ASN: UFINET PANAMA S.A.

Interestingly, from an affected computer:

curl https://inventario-amarena.vercel.app/login

returns HTTP/1.1 200 OK, while accessing the same URL using Chrome or Microsoft Edge returns 403 Forbidden.

curl https://api.ipify.org currently reports 181.78.73.5 from that network.

The application works normally when accessed from another Wi-Fi/network.

The project is currently on the Hobby plan, so System Bypass Rules are not available.

Could you please investigate whether the system DDoS mitigation is falsely classifying legitimate traffic from this ISP/network, and advise whether this false positive can be corrected without requiring a System Bypass rule?

I am attaching screenshots from Firewall > Traffic and Firewall > Rules showing the denied requests and DDoS mitigation.

Thank you.