All Products
Search

This Product

    Anti-DDoS:View blackhole event details

    Document Center

    Anti-DDoS:View blackhole event details

    Last Updated:Oct 22, 2026

    When the volume of DDoS attack traffic against your Alibaba Cloud service exceeds the blackhole triggering threshold, the service enters blackhole filtering. All traffic from external sources is dropped, and the related services become inaccessible. This topic describes how to query the details of a blackhole filtering event.

    Background information

    • Alibaba Cloud provides a free basic DDoS mitigation capability of 500 Mbit/s to 5 Gbit/s for specific Alibaba Cloud services (Anti-DDoS Basic). When the peak bandwidth of a DDoS attack exceeds the mitigation capability, Alibaba Cloud implements the blackhole filtering policy and blocks all inbound traffic to the service. This prevents greater damage to the service, and also prevents a DDoS attack on a single IP address from affecting the normal operation of other services on the network. For more information about blackhole filtering, see Alibaba Cloud blackhole filtering policy.

    • Anti-DDoS Basic does not support manual deactivation of blackhole filtering. Blackhole filtering is automatically deactivated only after the DDoS attack stops for a period of time.

    • For the blackhole triggering thresholds of Alibaba Cloud services, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic and Configure traffic scrubbing thresholds.

    Applicable scope

    • If the IP address of the asset is an IPv4 address, you can view the details only within 7 days after the blackhole filtering event occurred. If the IP address of the asset is an IPv6 address, you can view the details only within 3 hours after the blackhole filtering event occurred. After the period expires, View Details is dimmed, and you cannot view the details.

    • If the asset is an AnycastEIP, View Details is dimmed, and you cannot view the details of the blackhole filtering event.

    • If the asset has been released, you cannot view the details of the blackhole filtering event.

    Procedure

    1. Log on to the Traffic Security console. In the left-side navigation pane, choose DDoS.

    2. In the left-side navigation pane, click Event Center.

    3. Enter the IP address of the asset, set the event type to Blackhole, select a time range, and then click Search to view historical blackhole filtering events.

    4. (Optional) In the Actions column, click View Details to view the trend charts of Traffic and Inbound Traffic (pps) when the blackhole filtering event occurred.

    5. (Optional) In the Traffic section of the details page, click Download to download the evidence of the attack.

    FAQ

    • How do I find out the exact time when blackhole filtering is deactivated?

      You cannot query the exact deactivation time, and manual deactivation is not supported. For more information, see Deactivate blackhole filtering.

      • Automatic deactivation:
        The system automatically clears the blackhole filtering status after it detects that the attack has stopped for a period of time. You cannot manually deactivate blackhole filtering in advance, and you cannot query the exact deactivation time or estimate the service recovery time.

      • Duration reference:

        • Default duration: approximately 2.5 hours.

        • Range: generally between 30 minutes and 24 hours.

        • Influencing factors: The exact duration depends on the duration, type, and frequency of the attack, as well as the overall network load of Alibaba Cloud.

    • Which domain names are affected after an IP address enters blackhole filtering?

      Blackhole filtering is applied at the IP address level. All domain names that resolve to the IP address become inaccessible.

      • General impact:
        The blackhole filtering policy takes effect at the IP address layer instead of the application layer (domain names). After an IP address enters blackhole filtering, all inbound traffic destined for the IP address is dropped. Therefore, all domain names that resolve to the blackholed IP address become inaccessible.

      • Special notes for WAF (Web Application Firewall) users:

        • Risk: If you use WAF and the attacked IP address is the virtual IP address (VIP) of the WAF instance, the impact may extend to all domain names under the instance.

        • Cause: Multiple domain names usually share the same WAF VIP. External traffic is entirely blocked at the IP address stage of the network layer before it reaches WAF for domain-level forwarding.

        • Consequence: Once the WAF VIP enters blackhole filtering, access to all domain names attached to the WAF instance is interrupted at the same time.

        • Troubleshooting: To confirm the list of affected domain names, log on to the WAF console and view the configurations of all domain names attached to the instance.

    References