All Products
Search
Document Center

Anti-DDoS:Billing of Sec-CMA for Anti-DDoS Proxy (Outside Chinese Mainland)

Last Updated:Nov 10, 2025

The fees for Sec-CMA for Anti-DDoS Proxy (Outside Chinese Mainland) consist of two parts: subscription fees for instances and pay-as-you-go fees for features that you enable. This topic describes the billing for Sec-CMA for Anti-DDoS Proxy (Outside Chinese Mainland).

Instance description

Sec-CMA for Anti-DDoS Proxy (Outside Chinese Mainland) provides secure acceleration and advanced mitigation for all protected services. Four types of instances are available. The following table describes the differences between the instances.

Instance type

Protected carrier lines

Advanced mitigation sessions

Purchase of mitigation sessions

Sec-CMA 1.0

The Chinese mainland: China Telecom and China Unicom

2 times per calendar month

Yes. Purchase a global advanced mitigation session.

Sec-CMA 1.0 (Basic Edition)

Note

Contact a pre-sales manager to purchase.

China Telecom, China Unicom (the Chinese mainland)

Once per calendar month

Yes. Purchase a global advanced mitigation session.

Sec-CMA 2.0 (Insurance)

China Telecom, China Unicom, and China Mobile in the Chinese mainland

2 times per calendar month

Mitigation sessions cannot be purchased, but you can upgrade to Sec-CMA 2.0 (Unlimited).

Sec-CMA 2.0 (Unlimited)

China Telecom, China Unicom, and China Mobile in the Chinese mainland

Unlimited

Not applicable

Billing

Note

The prices of billable items that are provided in this topic are for reference only. The actual prices on the Anti-DDoS Proxy (Outside Chinese Mainland) buy page shall prevail.

Total fees = Subscription instance fees + Pay-as-you-go fees.

Part 1: Subscription instance fees

Subscription instance fees = Basic instance fees + Fees for upgradable configuration items

Basic instance fees

Instance type

Unit price (USD/month)

Sec-CMA 1.0

15,480

Sec-CMA 1.0 (Basic Edition)

9,288

Sec-CMA 2.0 (Insurance)

15,480

Sec-CMA 2.0 (Unlimited)

36,843

The basic instance fees correspond to the default minimum specifications. The four instance types share the same default specifications, as shown in the following table. You can also upgrade the specifications of configuration items as needed.

Specification name

Sec-CMA specifications

Billing method

Description

Clean bandwidth

10 Mbit/s

Subscription

The maximum service traffic that the instance can process when no attacks occur. The specification is scalable.

95th percentile burstable clean bandwidth pattern

Disabled

Pay-as-you-go

Pay-as-you-go charges are incurred if the actual bandwidth is greater than the clean bandwidth but less than the 95th Percentile Burstable Clean Bandwidth.

Clean queries per second (QPS)

500

Subscription

The maximum rate of concurrent HTTP and HTTPS requests that the instance can process when no attacks occur. You can upgrade the specification.

Note

Set the Clean queries per second (QPS) based on your actual service usage. If your service usage exceeds the purchased QPS specification, packet loss can occur and full logs may be incomplete.

95th percentile burstable QPS

Disabled

Pay-as-you-go

If the actual QPS is greater than the clean QPS but less than the 95th percentile burstable QPS, pay-as-you-go bills are generated.

Function plan

Standard

Subscription

Includes Standard and Enhanced function plans. The Enhanced function plan provides advanced service access and DDoS attack mitigation capabilities.

For more information, see Differences between the Standard and Enhanced function plans.

Number of protected domain names

10

Subscription

The number of HTTP and HTTPS domain names that the instance supports. This limit is scalable.

One root domain is supported for every 10 domain names. For example, if an instance supports 50 domain names, they can belong to a maximum of 5 root domains.

Number of ports

5

Subscription

The number of TCP and UDP ports that the instance can protect. This limit can be increased.

Fees for upgradable configuration items

  • Clean bandwidth

    Price for every 10 Mbit/s of clean bandwidth increment: USD 1,548 per month

  • Clean QPS

    Clean QPS

    Unit price (USD per QPS-month)

    0 < QPS ≤ 500

    0

    500 < QPS ≤ 5,000

    1.5

    5,000 < QPS ≤ 8,000

    1.425

    8,000 < QPS ≤ 10,000

    1.35

    10,000 < QPS ≤ 50,000

    1.275

    50,000 < QPS ≤ 100,000

    1.05

    For example, if you set Clean QPS to 6,000 when you purchase an instance, the monthly fee for the Clean QPS specification is calculated as follows:

    (500 - 0) × 0 + (5,000 - 500) × 1.5 + (6,000 - 5,000) × 1.425 = USD 8,175

  • Function plan

    Enhanced function plan: USD 1,200 per month

  • Number of protected domain names

    Number of domain names

    Unit price for the Standard function plan (USD/domain name/month)

    Unit price for the Enhanced function plan (USD per domain name-month)

    0 < Number of domain names ≤ 10

    0

    0

    10 < Number of domain names ≤ 500

    4.5

    7.5

    500 < Number of domain names ≤ 1,000

    4.1

    7

    1,000 < Number of domain names ≤ 5,000

    3.7

    6.5

    5,000 < Number of domain names ≤ 10,000

    3.2

    5.8

    10,000 < Number of domain names ≤ 20,000

    2.7

    4.5

    For example, if you purchase an instance that uses the Standard function plan and set the number of protected domain names to 600, the monthly fee for the number of protected domain names is calculated as follows:

    (10 - 0) × 0 + (500 - 10) × 4.5 + (600 - 500) × 4.1 = USD 2,615

  • Number of ports

    Number of ports

    Unit price (USD/port/month)

    0 < Number of ports ≤ 5

    0

    5 < number of ports ≤ 50

    30

    50 < Number of ports ≤ 100

    26

    100 < Number of ports ≤ 500

    22

    500 < Number of ports ≤ 1,500

    18

    For example, if you set the number of ports to 80 when you purchase an instance, the monthly fee for the number of ports is calculated as follows:

    (5 - 0) × 0 + (50 - 5) × 30 + (80 - 50) × 26 = USD 2,130

Part 2: Pay-as-you-go fees

You can enable pay-as-you-go features as needed. After you enable a pay-as-you-go feature, bills are generated only if the usage meets the billing conditions.

Feature

Billing method

Description

95th Percentile Burstable Clean Bandwidth

Daily or monthly pay-as-you-go

The burstable clean bandwidth feature provides additional clean bandwidth for your instance. It prevents your service from being rate-limited when traffic spikes exceed the instance's clean bandwidth during peak hours. For more information, see Billing of the burstable clean bandwidth feature.

95th percentile burstable QPS

Daily or monthly pay-as-you-go

Burstable QPS provides additional clean queries per second (QPS) for your instance. This prevents your service from being rate-limited if traffic spikes during peak hours and your clean QPS exceeds the instance specification. For more information, see Burstable QPS billing.

Expiration policy

image

Time period

Service traffic forwarding

Instance configuration

Within 6 calendar days after the expiration date

  • The blackhole filtering threshold for the instance is 5 Gbps. If forwarded service traffic and attack traffic exceed 5 Gbps, blackhole filtering is triggered.

  • Secure acceleration is not provided.

The instance retains its configuration.

From 7 to 14 days after the expiration date

The instance no longer forwards service traffic.

Warning

If you no longer use Sec-CMA, switch service traffic from the Anti-DDoS instance to the origin server at least 7 calendar days before the instance expires. For website services, ensure that your domain name resolution does not point to the CNAME of the Anti-DDoS instance. For non-website services, ensure that your services do not use the exclusive IP address of the instance. Otherwise, your service will be interrupted when the instance expires.

The instance retains its configuration.

On Day 15 after the expiration date

The instance stops forwarding service traffic.

The instance is released.

Warning

After all Anti-DDoS Proxy instances under your account are released for 30 days, the system automatically clears all associated domain and port forwarding rules. The 30-day countdown starts from the release of the last instance.

Overdue payments

  • Your account is considered overdue if your available balance (cash, coupons, vouchers) is insufficient to cover the bill.

  • To avoid service disruption, top up your account balance promptly.

Renewal policy

You can manually or automatically renew an instance. For more information, see Renew an instance.

Refund policy

Refunds are not available after purchase.

Bill query

You can query bills in the Expenses and Costs console. For more information, see Overview of monthly bills.