Anti-DDoS Proxy uses a global scrubbing network to defend against large-scale DDoS attacks. For services whose origin servers are deployed outside the Chinese mainland, choose the Global, Global Partner, or Outside Chinese Mainland protection plan based on user location and protection method.
How it works
Anti-DDoS Proxy maintains service stability in the following three steps:
Traffic redirection: By modifying DNS records or pointing your service IP address to an Anti-DDoS Proxy IP address, you redirect all access traffic from the Internet to an Anti-DDoS Proxy scrubbing center. For details, see Traffic redirection methods.
Traffic scrubbing: The Anti-DDoS Proxy scrubbing center uses multilayer detection and filtering engines. It defends against Layer 3 and Layer 4 volumetric attacks, such as SYN floods and UDP floods, and protects against Layer 7 application-layer attacks, such as HTTP floods. Malicious traffic is precisely identified and dropped.
Traffic forwarding to the origin: After scrubbing, legitimate access traffic is securely and reliably returned to your origin server through port and protocol forwarding.
Traffic redirection methods
Use either of the following methods to redirect service traffic to the Anti-DDoS Proxy IP address for scrubbing.
Redirection method | Description | Use cases | Advantages | Disadvantages |
DNS resolution | Change the DNS record of your service domain name (for example, | Services accessed through domain names, such as websites, web applications, and APIs. | Simple to configure, quick to take effect, and easy to switch during an attack. | Cannot protect against attacks that directly target the origin IP address. |
Direct IP pointing | Configure forwarding rules in an Anti-DDoS Proxy instance to use the Anti-DDoS Proxy IP address as the service entry point and forward traffic to the real server IP address. Clients access the Anti-DDoS Proxy IP address directly. | Non-website services accessed directly through IP addresses, such as games and app backend services. | Protects the IP address directly and hides the origin server. | Switching IP addresses might affect connections for some clients. |
Benefits
Quick and easy deployment
Anti-DDoS Proxy offers two onboarding methods: DNS resolution and direct IP pointing. No software or hardware installation and no routing changes are required. Onboarding is typically complete within minutes, depending on factors such as DNS propagation time. Your origin IP address stays hidden, which protects the origin server.
AI-driven intelligent and precise protection
Network-layer attack protection: Building on traditional techniques such as signature detection, Anti-DDoS Proxy combines an IP reputation database with deep packet inspection (DPI) to precisely identify and block volumetric attacks.
Application-layer CC attack protection: The AI engine automatically learns your service model to precisely identify and filter CC attack traffic. Protection policies can be as granular as the URL level, which greatly reduces operational complexity.
Massive global mitigation capacity
The global protection network of Anti-DDoS Proxy provides more than 20 Tbps of total bandwidth, including more than 5 Tbps of protection bandwidth outside the Chinese mainland. It defends against DDoS attacks at the network, transport, and application layers and ensures a global access experience for your services.
Flexible burstable protection
You can upgrade protection bandwidth online on a self-service basis, and the upgrade takes effect within seconds. When a burst attack occurs, you can increase mitigation capacity at any time without changing your services or interrupting them.
Financial-grade stability and high availability
A fully redundant architecture monitors data centers, servers, engines, and links, and provides automatic failover and recovery mechanisms to ensure 99.95% service availability.
Intelligent traffic rerouting
Anti-DDoS Proxy can work with other Alibaba Cloud services to automatically reroute traffic to Anti-DDoS Proxy when an attack occurs. During normal operations, it does not intervene, which balances cost and security.
New protection plans
Starting October 15, 2026, when you purchase a new Anti-DDoS Proxy (Outside Chinese Mainland) instance, you can choose the Global, Global Partner, or Outside Chinese Mainland protection plan.
Protection plan | Use cases | Protection method | Available specifications |
Global | The origin server is outside the Chinese mainland, and the service must serve users in the Chinese mainland and overseas. | A single instance IP address provides cross-border acceleration and global protection outside the Chinese mainland. Attacks from different directions share mitigation sessions. | 0, 1, 2, or unlimited full-capacity scrubbing sessions per month. The 0-session tier provides best-effort scrubbing only. |
Global Partner | Services purchased through a channel that need to select specifications based on a cross-border protection threshold. | Cross-border traffic is protected up to the selected committed threshold, and overseas traffic receives best-effort protection. Free best-effort protection applies after the threshold or mitigation sessions are exceeded. | The 100–1,000 Gbit/s tiers include one overseas full-capacity scrubbing session per month. The best-effort protection tier includes unlimited overseas full-capacity scrubbing sessions. Initially available only to eligible channel customers. |
Outside Chinese Mainland | Both the origin server and users are overseas, and cross-border acceleration to the Chinese mainland is not required. | Retains the previous international service model and provides Anycast access and full-capacity scrubbing outside the Chinese mainland. | Insurance: two sessions per month. Unlimited: no session limit. |
Both Global and Global Partner include 10 Mbit/s of cross-border bandwidth and provide an equal amount of overseas bandwidth at a 1:1 ratio. For Global Partner, the protection threshold is committed only for the cross-border direction, and overseas sessions and the cross-border threshold are calculated separately.
Chinese mainland plans and legacy plans outside the Chinese mainland
Anti-DDoS Proxy is divided into two categories based on the physical region in which your service servers are deployed: Anti-DDoS Proxy (Chinese Mainland) and Anti-DDoS Proxy (Outside Chinese Mainland).
Chinese mainland plans follow the existing descriptions. The legacy plans outside the Chinese mainland in the following table are for reference by existing instances only. For a new cross-border service that serves both locations, choose the Global plan instead of purchasing two instances together.
Product type | Instance edition | Core features and differences | Notes |
Anti-DDoS Proxy (Chinese Mainland) | Profession | Provides a dedicated IP address and multi-line BGP protection, and supports basic and burstable protection. | - |
Advanced | Provides two Key concepts sessions per month, which reset monthly. | Contact your account manager to activate this edition. | |
Anti-DDoS Proxy (Outside Chinese Mainland) | Insurance, Unlimited |
| - |
Sec-CMA 2.0 | Provides access acceleration for the Chinese mainland and application-layer DDoS protection. After you select a specific number of DDoS mitigation sessions, it can defend against volumetric DDoS attacks on China Telecom, China Unicom, and China Mobile lines. | None | |
Sec-CMA 2.0 (Insurance), Sec-CMA 2.0 (Unlimited) | Features are basically the same as Sec-CMA 2.0. You can disable the Metering Method of 95th Percentile Burstable Clean Bandwidth and 95th Percentile Burstable QPS modes. | Features have been migrated to Sec-CMA 2.0. New purchases are not recommended. This plan is retained only for existing instances. | |
Chinese Mainland Acceleration, Sec-CMA 1.0 | Legacy editions that do not support China Mobile lines. | New purchases are not recommended. Upgrade to Sec-CMA 2.0. Contact your account manager to activate the upgrade. |
About the IP registration location: The IP registration location refers only to the registered address of an Anti-DDoS Proxy IP address and is used to meet compliance requirements. It is not the physical deployment location of the protection resources or scrubbing clusters. Alibaba Cloud Anti-DDoS uses a global Anycast network architecture, so regardless of the IP registration location that you select, service traffic accesses the nearest scrubbing center for protection. Even if you select an IP registration location outside Japan, an origin server deployed in Japan still receives efficient, low-latency protection. This configuration does not affect actual protection performance.
Is the Anti-DDoS Proxy IP address static? Does it change during an attack?
Each Anti-DDoS Proxy instance is assigned a dedicated static IP address. The IP address does not change after purchase and can be used long term. It remains unchanged during a DDoS attack or traffic scrubbing, which ensures stable service access.
After you purchase Anti-DDoS Proxy, the system assigns a new Anti-DDoS Proxy IP address. The origin IP address is not directly protected by Anti-DDoS Proxy. Protection takes effect only after you complete the onboarding configuration:
Website services: Change the DNS record for your domain name to the CNAME address provided by Anti-DDoS Proxy to redirect access traffic to the Anti-DDoS Proxy scrubbing center.
Non-website services: Configure port forwarding rules in the Anti-DDoS Proxy instance and point the destination IP address accessed by clients directly to the Anti-DDoS Proxy IP address.
Plan selection reference
Server location | User Source | Business requirements | Recommended edition |
The Chinese mainland | the Chinese mainland and outside the Chinese mainland | General-purpose DDoS protection. | Anti-DDoS Proxy (Chinese Mainland) - Profession |
Outside the Chinese mainland | Outside the Chinese mainland only | No cross-border acceleration needed. | Anti-DDoS Proxy (Outside Chinese Mainland) -Insurance or Unlimited |
Outside the Chinese mainland | the Chinese mainland | Requires cross-border acceleration to ensure low latency and stability. | Anti-DDoS Proxy (Outside Chinese Mainland)-Sec-CMA 2.0 |
Outside the Chinese mainland | the Chinese mainland and outside the Chinese mainland | Cross-border acceleration needed without server migration, plus access from outside the Chinese mainland. | Combined purchase:
|
Outside the Chinese mainland | within and outside the Chinese mainland | Migrate servers by user region. After migration, each region's users access locally hosted services protected by the corresponding edition. |
|
Billing
Anti-DDoS Proxy fees consist of subscription instance fees and pay-as-you-go burstable fees.
Instance fees (subscription): You pay monthly or yearly based on the specifications that you select, such as basic protection bandwidth, clean bandwidth, and QPS. For details, see Billing for Anti-DDoS Proxy (Outside Chinese Mainland) Insurance and Unlimited mitigation plans, Billing for the MCA feature of Anti-DDoS Pro and Anti-DDoS Premium (Outside the Chinese mainland), and Billing of Anti-DDoS Proxy (Outside Chinese Mainland).
Burstable protection fees (pay-as-you-go): You are charged only when DDoS attack traffic exceeds the basic protection bandwidth. The fee is calculated daily based on the peak actual attack traffic. For details, see Billing of elastic protection capability.
Burstable clean bandwidth and QPS fees (pay-as-you-go): You are charged only when normal service traffic or QPS exceeds the basic specifications. The fee is calculated based on the 95th percentile of a calendar day or a calendar month. For details, see Billing of burstable clean bandwidth and Billing of burstable QPS.
Advanced mitigation resource plan: For specific instances, you can also purchase an advanced mitigation resource plan as needed. For details, see Billing of global advanced mitigation sessions.
What are the differences between Anti-DDoS Proxy, Anti-DDoS Basic, and ESA (Edge Security Acceleration)?
The three services differ in protection positioning and use cases:
Comparison dimension | Anti-DDoS Proxy | Anti-DDoS Basic | ESA (Edge Security Acceleration) |
Use cases | Services that face intense attacks and must defend against volumetric attacks and application-layer CC attacks. | Protection against small-scale attacks, suitable for non-core services that can be interrupted. | Services that are sensitive to latency and primarily require edge acceleration and content delivery. |
Protection capability | Professional in-depth protection that supports basic and burstable protection bandwidth, and defends against Layer 3 and Layer 4 volumetric attacks and Layer 7 CC attacks. | Platform-level basic defense that covers basic DDoS attacks. | Built-in basic DDoS protection that, by default, provides capabilities comparable to Anti-DDoS Basic. Not a professional DDoS protection product. |
Traffic onboarding method | Redirects traffic through DNS to a dedicated scrubbing center, or points the IP address directly to the Anti-DDoS Proxy IP address. Can hide the origin IP address. | Requires no configuration. The platform defends automatically. | Distributes and accelerates traffic through globally distributed edge nodes. |
Billing | A paid service, billed based on specifications such as basic protection bandwidth and clean bandwidth. | Free. | Billed based on edge acceleration usage. Enhanced DDoS protection requires a separate application. |
Selection recommendations:
If your services face the risk of large-scale DDoS attacks or CC attacks, choose Anti-DDoS Proxy for professional in-depth protection.
If your services are small in scale and can tolerate brief interruptions, the free defense of Anti-DDoS Basic meets basic needs.
If your core requirement is edge acceleration and the DDoS risk is low, choose ESA. If you also face significant DDoS risk, use ESA together with Anti-DDoS Proxy.