Anti-DDoS:What is Anti-DDoS Origin

How it works

Anti-DDoS Origin runs in bypass mode at the egress of Alibaba Cloud data centers. It uses passive traffic scrubbing as the primary method, supplemented by active blocking, so normal service traffic is unaffected.

1. Attack detection. The system monitors traffic to your public IP addresses in real time.

2. Traffic scrubbing. When inbound traffic exceeds the default scrubbing threshold, traffic is automatically redirected to a scrubbing center.

3. Traffic reinjection. The scrubbing center drops attack traffic and reinjects clean traffic to your origin server, keeping your services accessible during an attack.

When to use Anti-DDoS Origin

Anti-DDoS Origin is a good fit when you need to:

• Strengthen protection quickly for existing cloud resources — ECS instances, Elastic IP addresses (EIPs), and SLB instances — without changing IPs or network topology.

• Cover multiple assets cost-effectively: multiple IP addresses share one instance.

• Handle Layer 3/4 volumetric attacks during traffic spikes such as sales promotions or product launches.

• Maintain business continuity without dedicated scrubbing infrastructure.

If you need Tbps-level protection, dedicated resources, a higher SLA, or Layer 7 mitigation, use Anti-DDoS Proxy instead.

Benefits

• Instant deployment. Protection takes effect immediately after purchase, in as little as one minute. No deployment steps or IP address changes are needed.

• Elastic protection. During large-scale attacks, the service automatically uses all available DDoS mitigation resources in the current region, providing unlimited protection.

• Excellent performance. Uses Alibaba Cloud BGP bandwidth, so a single IP address provides high-speed access for users across multiple carriers — including China Telecom, China Unicom, and China Mobile.

• Massive bandwidth. Provides large-scale traffic scrubbing bandwidth suitable for sales promotions, product launches, and core business services.

• Flexible sharing. Multiple IP addresses can share one protection instance, efficiently covering multiple assets.

Key concepts

DDoS attack: A distributed denial-of-service (DDoS) attack uses malicious traffic to exhaust network or device resources, preventing websites or services from operating normally. For details, see What is a DDoS attack.

Regular Alibaba Cloud service vs. EIP with Anti-DDoS (Enhanced) enabled:

Editions

Anti-DDoS Origin 1.0 is no longer available for new purchases. All information below refers to version 2.0. Mitigation capability is not a fixed value — it is dynamically adjusted based on the overall protection level of the cloud data center.

Anti-DDoS Origin 2.0 is available in three editions:

Clean bandwidth is shared across all protected cloud products. The instance specification must exceed the total bandwidth of all protected assets. For example, to protect three products with a combined bandwidth of 2,000 Mbps, select an instance with clean bandwidth greater than 2,000 Mbps.

Get started

Follow these steps to start using Anti-DDoS Origin:

1. Purchase an Anti-DDoS Origin instance

2. Add protected objects — add cloud resources with public IP addresses to the instance

3. Configure mitigation policies — customize policies based on your traffic characteristics (Mitigation Settings (Legacy))

4. Monitor service traffic — view real-time traffic data (Business Monitoring)

5. Enable mitigation analysis — query mitigation logs and view built-in reports

6. View attack events — inspect details of attack events on protected assets (Attack analysis)

7. View blackhole filtering and scrubbing events — track events in Event Center

FAQ

What is the difference between Anti-DDoS Origin and Anti-DDoS Proxy?

Anti-DDoS Origin attaches directly to your existing public IP addresses — no IP changes required. It provides region-level shared protection (Gbps-scale) and is cost-effective for general volumetric attack mitigation.

Anti-DDoS Proxy requires routing traffic through an Anti-DDoS Proxy IP address. It provides dedicated, Tbps-level protection with a higher SLA and supports Layer 7 attack mitigation. Use Anti-DDoS Proxy for core services or when you need to handle ultra-large-scale attacks.

Can Anti-DDoS Origin mitigate HTTP flood attacks?

No. Anti-DDoS Origin mitigates only Layer 3 and Layer 4 volumetric attacks — for example, UDP floods and SYN floods. For Layer 7 attack protection, use Anti-DDoS Proxy.