# Diagnosing the daily 2AM UTC command spike with auto IP deny lists
## Symptom
Once a day, around 2AM UTC, one limit() call is slower than usual and
spends 9 commands instead of the normal 2-5.
## Cause
The auto IP deny list refreshes from its upstream sources daily at
2AM UTC. The first limit() call after that hour downloads the latest
list and writes it to your Redis, costing 9 commands. This is
documented and expected, not an attack and not a bug.
## Confirm
Correlate the spike timestamp with 2AM UTC. Check the Ratelimit
dashboard Denied section: the blocked-IP list should show a fresh
update around the same time.
## The real risk
The refresh runs asynchronously in the background. On serverless,
if you do not hand the pending promise to waitUntil, the runtime can
kill the function mid-refresh and the list update never completes.
Then you pay the 9 commands again on the next call, and protection
lags a day behind.
const { pending } = await ratelimit.limit(id, { ip });
context.waitUntil(pending);
## Fix and verify
Add the waitUntil if missing. The spike stays (it is by design) but
it happens exactly once per day and the dashboard shows the updated
list.