Changes

On September 1, 2025, new back-to-origin IP address ranges will be added to Web Application Firewall (WAF), with a total of 24 new CIDR blocks.

New additions in the Chinese mainland (12):

47.118.121.0/24, 120.26.191.0/24, 121.41.233.0/24, 121.41.234.0/24, 8.160.134.0/24, 8.147.167.0/24, 8.147.166.0/24, 8.145.215.0/24, 47.121.12.0/24, 47.121.11.0/24, 47.121.10.0/24, 47.121.16.0/24

New additions in regions outside the Chinese mainland (12):

47.83.110.0/24, 47.83.109.0/24, 43.98.26.0/24, 43.98.25.0/24, 147.139.227.0/24, 8.215.145.0/24, 47.251.133.0/24, 47.251.132.0/24, 47.250.75.0/24, 47.250.74.0/24, 47.245.211.0/24, 47.245.210.0/24

For regions outside the Chinese mainland, traffic will be gradually migrated from the 47.254.217.32/27 range to 47.250.34.0/25, and from 47.91.69.64/27 to 47.245.154.0/25.

The decommissioning dates for the two original ranges will be announced separately. During the traffic migration, services using CNAME to connect to WAF may experience brief interruptions or connection resets. The duration of each interruption or reset will be less than one minute. To avoid impact to your service, please ensure you have reconnection and retry mechanisms implemented in your client applications.

Action required

The WAF console and OpenAPI have been updated with the latest back-to-origin IP address ranges.

Here’s how to view the complete list of back-to-origin IP address ranges:

WAF 2.0:WAF Console > Systems > Service Information > Back-to-origin CIDR Block

WAF 3.0:WAF Console > Website Configuration > Back-to-origin CIDR Blocks

Then, update the whitelist policy on your origin server accordingly.

If you use the OpenAPI to automatically fetch the latest back-to-origin IP addresses, you can trigger either a manual or automated call to update your whitelist policy.

If you have any questions, feel free to contact us through our DingTalk security service group or by submitting a ticket.

Thank you for your support and cooperation.