Anti-DDoS Origin lets you manually remove blackhole filtering from protected public IP addresses that are currently in a blackhole state. Manual deactivation consumes a monthly quota — check your remaining quota before proceeding.
Is your IP under blackhole now and you need to restore service immediately? Go to Manual deactivation.
Want to understand how automatic removal works? See Automatic deactivation.
Deactivation methods
Blackhole filtering can be removed automatically or manually.
Automatic deactivation: The blackhole is removed without user action after a period determined by attack frequency and continuity. More frequent or sustained attacks result in a longer blackhole duration.
Manual deactivation: Immediately removes the blackhole for a protected object, subject to a monthly quota per instance.
The monthly deactivation quota resets at the beginning of each month. Unused deactivations do not roll over, and renewing your instance does not increase the current month's quota.
The following table summarizes the deactivation methods and manual quotas by edition.
| Edition | Deactivation methods | Monthly manual quota |
|---|---|---|
| Anti-DDoS Origin Basic | Automatic only | None |
| Anti-DDoS Origin 1.0 (Subscription) Enterprise Edition | Automatic and manual | Equals the IP Addresses quota per instance, up to 200. For example, an IP Addresses quota of 50 gives you 50 manual deactivations per month. |
| Anti-DDoS Origin 2.0 (Subscription) Enterprise Edition | Automatic and manual | — |
| Anti-DDoS Origin 2.0 (Subscription) Inclusive Edition for SMEs | Automatic and manual | 5 per instance |
| Anti-DDoS Origin 2.0 (Pay-as-you-go) | Automatic and manual | 200 per instance |
Automatic deactivation
By default, a blackhole is automatically removed after 2.5 hours. The actual duration ranges from 30 minutes to 24 hours — or longer in rare cases — based on two factors:
Attack continuity: If the attack persists, the blackhole duration extends and the removal timer restarts.
Attack frequency: A first-time attack on an asset shortens the blackhole duration. Assets that are attacked frequently are treated as high-risk targets, so their blackhole duration is extended.
For assets that are frequently placed under blackhole filtering, Alibaba Cloud reserves the right to extend the blackhole duration and lower the blackhole threshold. The actual removal time is included in the security event notification sent to your account.
Manual deactivation
Usage notes
Wait at least 40 minutes between manual deactivations for the same public IP address.
If blackhole filtering is triggered again shortly after a manual deactivation, the DDoS attack is still ongoing. Wait at least 40 minutes before trying again.
If an IP address is frequently placed under blackhole filtering, the attack volume exceeds the protection capacity of Anti-DDoS Origin. Consider upgrading to Anti-DDoS Pro or Anti-DDoS Premium, which provide terabit-level protection.
Steps
Prerequisites
Before you begin, make sure that you have:
An Anti-DDoS Origin 1.0 or 2.0 instance (Anti-DDoS Origin Basic does not support manual deactivation)
At least one remaining manual deactivation in your monthly quota
A protected object whose status is Under blackhole
Procedure
Log on to the Traffic Security console.
In the left-side navigation pane, choose Network Security > Anti-DDoS Native > Protected Objects.
In the top navigation bar, select the resource group and region for your instance:
Anti-DDoS Origin 1.0 (Subscription) instances: select the region where the instance resides.
Anti-DDoS Origin 2.0 (Subscription) and Anti-DDoS Origin 2.0 (Pay-as-you-go) instances: select All Regions.
On the Protected Objects page, select your Anti-DDoS Origin instance, find the protected object whose status is Under blackhole, and click Deactivate Blackhole Filtering in the Actions column.
In the Deactivate Blackhole Filtering dialog box, review your remaining deactivation quota and click Confirm.
The deactivation may fail due to Alibaba Cloud's backend risk control policies. A failed attempt does not consume your manual deactivation quota.
Result
Success: The status of the protected object changes from Under blackhole to Normal.
Failure: An error message appears. Wait 1 minute, then try again.
Related topics
Only save images, do not translate or publish