Anti-DDoS Origin pay-as-you-go - Anti-DDoS - Alibaba Cloud Documentation Center

Usage notes

Anti-DDoS Origin 2.0 is a pay-as-you-go service that protects your regular Alibaba Cloud service and EIP with Anti-DDoS (Enhanced) enabled.
The Anti-DDoS Origin 2.0 (Pay-as-you-go) fee is an additional security charge that does not affect the existing billing for your protected cloud service.
Each Alibaba Cloud account can protect up to 50 EIPs with Anti-DDoS (Enhanced) enabled. To request a higher quota, contact your business manager.
Each Anti-DDoS Origin 2.0 (Pay-as-you-go) instance can protect up to 2,000 assets.
Log on to the Traffic Security console and set the region to All Regions to view your Anti-DDoS Origin 2.0 (Pay-as-you-go) instance.

Billable items

The total fee is calculated using the following formula: DDoS protection fee = Protection feature fee + Protected IP count fee + Service traffic fee.

Billing is based on a daily cycle. Your resource usage is measured daily, and a bill is generated for the charges incurred. Bills are typically issued at 12:00 (UTC+8) on the following day, but the actual time may vary.

Part 1: Protection feature fee

Charged daily. The rate varies by the region of your assets.

Important

After activating Anti-DDoS Origin 2.0 (Pay-as-you-go), billing starts as soon as you add an asset for protection. After billing starts, if you have no protected assets on a given day, you are charged the daily rate for regions outside the Chinese mainland by default.
The protection feature fee is charged per Alibaba Cloud account and is independent of the number of protected IP addresses. For example, on Day T, if all your protected assets are located in the Chinese mainland, the protection feature fee for that day is USD 231, regardless of the number of protected IP addresses.

Region	Fee (USD/day/account)
Chinese mainland	231
Regions outside the Chinese mainland (including China (Hong Kong), China (Macao), China (Taiwan), and other regions)	100
All Regions (assets are in and outside the Chinese mainland)	331

For example, on Day T, if you protect assets in both the Chinese mainland and regions outside the Chinese mainland, your protection feature fee for that day is USD 331. If on Day T+1, you remove the assets located outside the Chinese mainland and only protect assets within the Chinese mainland, your fee for Day T+1 will be USD 231.

Part 2: Protected IP count fee

Uses tiered pricing based on the total number of protected IP addresses, including those for regular Alibaba Cloud services and EIPs with Anti-DDoS (Enhanced) enabled.

The protected IP count fee for a given day (Day T) is based on the number of IP addresses protected at the end of the previous day (Day T-1). The number of IP addresses is recorded in a snapshot taken at approximately 23:00 (UTC+8) daily. For example, if you protect 10 IP addresses on July 2, 2024, and 20 IP addresses on July 3, 2024, the usage data for July 3 is based on the 10 IP addresses from the previous day.

Pricing tier	Unit price (USD/day/IP)
0 < IP count ≤ 100	1
100 < IP count ≤ 300	0.8
300 < IP count ≤ 500	0.6
500 < IP count ≤ 700	0.5
700 < IP count ≤ 1,000	0.4
1,000 < IP count ≤ 10,000,000	0.3

For example, if you protect 400 IP addresses on Day T, the fee for that day is calculated as follows: (100 × 1) + (200 × 0.8) + (100 × 0.6) = USD 320.

Part 3: Service traffic fee

Charged based on the service traffic generated on your cloud service. Attack traffic is not billed. Regular Alibaba Cloud services and EIPs with Anti-DDoS (Enhanced) enabled have different unit prices and are billed separately. Traffic within the Chinese mainland and traffic in regions outside the Chinese mainland are billed separately based on tiered pricing. Service traffic usage on Day T is measured on Day T+1.

Traffic measurement

To simplify and standardize billing, traffic data is collected from the protected cloud service. The billable amount is based on the higher of the inbound or outbound traffic.
If you protect multiple cloud services, the traffic data is aggregated for services in the Chinese mainland and for services in regions outside the Chinese mainland (including China (Hong Kong), China (Macao), China (Taiwan), and other regions).

A minimum traffic commitment applies. If your daily traffic is less than the minimum commitment, you are billed for the minimum committed amount.

Asset type	Asset IP region	IP count	Minimum daily traffic per IP
Regular Alibaba Cloud service	Chinese mainland	No minimum traffic commitment. You are billed for your actual traffic.
Regular Alibaba Cloud service	Regions outside the Chinese mainland
EIP with Anti-DDoS (Enhanced) enabled	Chinese mainland	IP count ≤ 30	0 GB
		31 ≤ IP count ≤ 99	20 GB
		IP count ≥ 100	40 GB
	Regions outside the Chinese mainland	No minimum traffic commitment. You are billed for your actual traffic.

Example 1: You protect 32 EIPs with Anti-DDoS (Enhanced) enabled. Among them, 12 IP addresses each generate 10 GB of daily traffic, and 20 IP addresses each generate 15 GB of daily traffic.

The total billable daily traffic is 32 × 20 GB = 640 GB.
Example 2: You protect 32 EIPs with Anti-DDoS (Enhanced) enabled. Among them, 12 IP addresses each generate 30 GB of daily traffic, and 20 IP addresses each generate 15 GB of daily traffic.

The total billable daily traffic is (12 × 30 GB) + (20 × 20 GB) = 760 GB.

Bandwidth limits

EIPs with Anti-DDoS (Enhanced) enabled are subject to the following bandwidth limits, which vary by region. These limits do not apply to regular Alibaba Cloud services.

Peak inbound bandwidth for local region access: 2 Gbps for assets in regions outside the Chinese mainland, and 20 Gbps for assets in the Chinese mainland.
Peak inbound bandwidth for cross-region access: 100 Mbps for assets in regions outside the Chinese mainland, and unlimited for assets in the Chinese mainland.

If the bandwidth does not meet your business requirements, log on to the Traffic Security console. Go to the Network Security > Anti-DDoS Native > Billing Management page, and click Details to request an adjustment to the peak access bandwidth.

Note

Local region access: Your clients and the EIP with Anti-DDoS (Enhanced) enabled are in the same region.
Cross-region access: Your clients and the EIP with Anti-DDoS (Enhanced) enabled are in different regions.

For example, you purchased an EIP with Anti-DDoS (Enhanced) enabled in the China (Hong Kong) region. If your clients are primarily located in the China (Hong Kong) region, this is considered local region access. If your clients are primarily located in the US (Virginia) region, this is considered cross-region access.

Pricing details

Pricing tier	Regular Alibaba Cloud service		Enhanced EIP
Pricing tier	Mainland China (USD/GB)	Outside mainland China (USD/GB)	Mainland China (USD/GB)	Outside mainland China (USD/GB)
0 TB < Traffic ≤ 100 TB	0.1045	0.0500	0.1125	0.0500
100 TB < Traffic ≤ 500 TB	0.0804	0.0400	0.0900	0.0400
500 TB < Traffic ≤ 1,000 TB	0.0579	0.0300	0.0675	0.0300
1,000 TB < Traffic ≤ 1,500 TB	0.0386	0.0200	0.0450	0.0200
Traffic > 1,500 TB	For custom pricing, contact your business manager. For more information, see Contact us.

Billing example

The following example shows how the service traffic fee is calculated for an EIP with Anti-DDoS (Enhanced) enabled. From November 1 to November 5, it generates 200 TB of traffic, with 50 TB from the Chinese mainland and 150 TB from regions outside the Chinese mainland. On November 6, it generates 700 GB of traffic, with 300 GB from the Chinese mainland and 400 GB from regions outside the Chinese mainland. The service traffic fee for November 6 is calculated as follows:

Unit price for the 300 GB from the Chinese mainland: The cumulative monthly traffic from the Chinese mainland is 50 TB + 300 GB, which falls into the 0 TB < Traffic ≤ 100 TB tier. According to the pricing table, the unit price for this 300 GB is USD 0.1125/GB.
Unit price for the 400 GB from regions outside the Chinese mainland: The cumulative monthly traffic from outside the Chinese mainland is 150 TB + 400 GB, which falls into the 100 TB < Traffic ≤ 500 TB tier. According to the pricing table, the unit price for this 400 GB is USD 0.0400/GB.

The service traffic fee for November 6 is (300 GB × USD 0.1125/GB) + (400 GB × USD 0.0400/GB) = USD 49.75.

Release an instance

Warning

If you have an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance with no protected assets, you are not charged and can release the instance at any time.
If you add an asset to an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you must use the service for at least 30 days before you can release the instance.
Before you release an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you must first release all EIPs with Anti-DDoS (Enhanced) enabled and ensure that business traffic is migrated away from them. You do not need to release regular Alibaba Cloud services. After the instance is released, their protection is automatically disabled.

Instance configuration deletion

After an instance is released, its configurations are permanently deleted after 15 days and cannot be recovered.

Procedure

Log on to the Traffic Security console. In the upper-right corner of the Network Security > Billing Management page, click Disable Protection.

Overdue payments

An overdue payment occurs when your available balance, including cash, vouchers, and coupons, is insufficient to cover your bill.
If a payment becomes overdue, your service is suspended immediately. The instance is released 15 days after service suspension, and its configurations are permanently deleted and cannot be recovered.
If your account has an overdue payment, top up your account as soon as possible to ensure your pay-as-you-go services remain available.

Bills and usage

View bills in the Billing Management console.

Important

By default, a bill for charges incurred on Day T is issued on Day T+1. To ensure accuracy, Alibaba Cloud may review large bills, which can delay bill delivery by one to three days. If a delay occurs, bills for multiple days may be consolidated. To query your daily usage, log on to the Traffic Security console and go to the Network Security > Billing Management page.
A cost protection mechanism is available for service traffic charges. In rare cases, attack traffic might be counted as service traffic. For example, an HTTP GET flood attack can cause an abnormal increase in outbound traffic. If this occurs, you can contact technical support to request a waiver for the abnormal charges. When you contact support, provide supporting materials, such as server logs or traffic monitoring data, to help us resolve the billing discrepancy more quickly. For example, you can provide logs that show the normal and abnormal queries per second (QPS) during an HTTP GET flood attack.

To view usage, log on to the Traffic Security console and view the data on the Network Security > Billing Management page.

References

For protection capabilities and features of Anti-DDoS Origin 2.0 (Pay-as-you-go), see What is Anti-DDoS Origin?.
To purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, see Purchase an Anti-DDoS Origin instance.