Who pays
Indie hackers and small SaaS founders on usage-based platforms (GCP, Vercel, AWS) — $29–99/mo, justified by a single avoided $10K bill.
$29–99/mo
What people said
Founder got hit with a $10K GCP bill in one month from ClaudeBot scraping, likely from cloners copying the software.
Read the comment ↗Acquaintances' Vercel bills exploded from bot scraping right after marketing on HN/Twitter, even with Cloudflare bot protection on.
Read the comment ↗Operator has to block entire cloud provider ASNs across properties due to relentless abusive scraping, hurting real VPN users.
Read the comment ↗
Paraphrased from the discussion. Follow the links for the original comments.
Why now
AI crawlers and agentic scrapers exploded in the last 12 months (ClaudeBot, GPTBot, stealth agents), and usage-based pricing (Vercel, serverless) turns traffic directly into money loss.
Already out there
The gap
Existing bot tools are WAFs at the edge; existing cloud spend alerts just notify. Nothing ties per-request bot classification to auto-escalating mitigation (rate-limit, challenge, ASN block, cache) specifically to cap metered spend for small usage-based deployments.
Moat
Growing blocklist/behavioral dataset of scraper fingerprints across customers; workflow lock-in as mitigation rules accumulate per site.
The case against
What would kill it
Cloudflare ships a free 'spend-aware bot blocking' tier and commoditizes the core value overnight.
The red team's strongest objection
Real, current, money-bleeding pain ($10K surprise bills from AI crawlers) and no product ties bot classification to automatic spend-capping mitigation on usage-based platforms for the sub-enterprise tier.
Build it in 3 steps
- Ship an agent/middleware for Vercel + Cloudflare Workers + NGINX that logs request fingerprints and per-route egress cost.
- Add detection heuristics (no CSS/JS/favicon requests, ASN patterns, known AI crawler UAs) with auto rate-limit/block escalation.
- Wire into cloud billing APIs to trigger hard caps/alerts when projected scraper spend crosses a threshold.
Source discussion
I posted to HN, and then my website was flooded with AI bot traffic ↗
345 points · 185 comments · From the comments · Linked article