Malicious attacks or traffic abuse against your domain name can cause bandwidth peak or heavy traffic consumption, resulting in bills that are higher than your usual spending. Bills incurred by malicious attacks or traffic abuse cannot be waived or refunded. To minimize such risks, this topic describes how you can respond to these situations.
Mitigate immediate losses
If you find that malicious attacks or traffic abuse against your domain name have resulted in high bills, first configure a bandwidth cap and single-request throttling to prevent further losses. After the configuration is complete, analyze logs and configure targeted security settings.
Control bandwidth usage
Limit downstream speed
Analyze causes
Check billing details to identify periods of unusual traffic
You can view the billing details of cloud services on the Billing Details tab. Select a statistical dimension and a statistical period to view reports based on different dimensions. For more information, see Billing details.
Set Statistical Period to By Detail and Product to CDN. Review the bill carefully for unusual increases in traffic and bandwidth, and identify the periods of unusual traffic. For more information, see Query bills.
If you have purchased a CDN resource plan, also check its status. On the Resource Plans page of the CDN console, review the remaining quota and expiration time to determine whether the resource plan has expired or has been exhausted. After a resource plan expires or is exhausted, subsequent traffic is billed on a pay-as-you-go basis, which can also increase your bill. For instructions, see Resource plans. A resource plan applies only to new traffic generated after purchase and cannot be purchased later to offset charges that have already been billed. For detailed rules, see Rules for applying resource plans.
Examine log files to identify unusual traffic
Basic query: offline logs
Download offline logs to view the access logs of the relevant period, analyze the details of HTTP requests, and identify suspicious IP addresses, User-Agents, and other information. Offline logs contain relatively few fields. To view more data, use the real-time logs feature.
CDN log records contain basic access information, including access time, client IP address, request URL, User-Agent, Referer, response size, and HTTP status code. These fields cannot directly determine whether requests originate from a packet-capture tool or a normal browser. Although the User-Agent field can indicate the client type, it can be forged and is not a reliable basis for judgment. Analyze high-frequency IP addresses, unusual User-Agents, and access behavior patterns to identify suspicious traffic indirectly.
After you obtain offline log files, you can use command-line tools to quickly parse them and extract information such as the top 10 IP addresses or User-Agents by number of requests. For more information, see Analyze offline logs.
Advanced query: operations reports and real-time logs
Operations reports generate statistical analysis only after you customize them. If you have configured real-time log delivery or subscribed to operations reports, you can view historical log information. Operations reports are free of charge.
Real-time logs are generated only after you activate Simple Log Service (SLS) and logs are successfully delivered. Real-time logs are a paid feature. For more information about billing, see Billing rules.
Both real-time logs and operations reports must be configured in advance. If you did not configure either feature before the high bill was incurred, you can analyze historical data only by using offline logs.
Set protection strategies
After you obtain log or report data, you can analyze attack types based on data characteristics. Typically, you can extract characteristics by analyzing top information, such as Top IP, Top User-Agent, and Top Referer.
Restrict access from suspicious IP addresses
Configure an IP blacklist to restrict access from source IP addresses. After you analyze logs and identify suspicious attack IP addresses, add these IP addresses to the blacklist. For more information, see Configure an IP blacklist or whitelist.
Blocking a single IP address is effective only against fixed attack IP addresses. If attackers keep changing IP addresses and blacklist blocking becomes ineffective, see the "Upgrade to ESA and enable WAF and bot protection" section below for a more effective protection solution.
Filter suspicious User-Agents
Attackers send a large number of requests with forged User-Agent fields to try to bypass security checks. A forged User-Agent can be an empty value, a random string, or a forged string of a common browser. You can configure a User-Agent whitelist or blacklist to reject requests with abnormal User-Agents. For example, to reject empty User-Agents or random strings that do not conform to specifications, you can use the parameters this-is-empty-ua and RandomString to represent an empty User-Agent and a random string, respectively. For more information, see Configure a User-Agent blacklist or whitelist.
Add suspicious Referers to the blacklist
Attackers forge the Referer field in request headers to impersonate legitimate referring sources and send malicious requests. Configure a Referer blacklist or whitelist to allow access from legitimate Referers, prevent unauthorized third-party websites from linking to your resources, and reject requests that carry malicious Referers. In the Rules field, enter the unusual Referers found in the logs. We recommend that you select Ignore Scheme. For more information, see Configure a Referer blacklist or whitelist.
Upgrade to ESA and enable WAF and bot protection
If attackers frequently rotate IP addresses and blacklist blocking becomes ineffective, or if you need more comprehensive security protection, we recommend that you migrate your domain name to ESA. ESA provides a wide range of protection features that protect data security and improve access speed and user experience. Follow the instructions in CDN, DCDN, and ESA: Feature comparison to quickly migrate your domain name. Then, use the following guidance to quickly enable the security protection features of ESA.
WAF
ESA WAF provides extensive rule-matching and blocking capabilities, including IP access rules, whitelist rules, and custom rules. These capabilities help prevent malicious intrusions into website servers and protect core business data.
Configure IP access rules
In the ESA console, select Websites, and in the Website column, click the target site.
On the site details page, choose .
Select and enter the IP/CIDR Block, ASN, or Region information to protect, set the Action, and then click Create Rule.
Optional: By default, created rules apply to all Layer 7 HTTP requests for the site. To apply them to Layer 4 TCP/UDP proxy requests, make sure that your plan is the Enterprise plan. Then, on the site details page, choose TCP/UDP > Settings. On the Settings page, click Create Application. On the Create Application page, enable IP Access Rules.
Create a whitelist rule
In the ESA console, go to Websites. In the Actions column for the target site, click
> WAF.On the website details page, navigate to .
On the Whitelist Rules tab, click Create Rule.
Enter a Rule Name.
In the If requests match... section, specify the request characteristics. For more information, see Composition of a rule expression.
In the Then skip... section, specify the protection rules to skip.
All Rules: Bypasses all WAF and bot management rules.
Specific Rule Category/ID: Select rules to bypass. For example, for managed rules, you can enter a rule ID of specify a rule type, such as bot management or rate limiting.
Configure custom rules
In the ESA console, select Websites, and in the Website column, click the target site.
In the left navigation pane, choose .
Click the Custom Rules tab. On the Custom Rules tab, click Create Rule.
Enter a Rule Name.
In the If requests match... section, configure the request characteristics to match. For more information about request matching rules, see Rules language.
In the Then execute... section, set the protection action to perform when a request matches the rule.
Click OK.
Bot protection
ESA Get started with bots supports Simple Mode and Advanced Mode. Simple Mode lets you quickly configure bot management for the current site, whereas Advanced Mode provides more precise bot rules for targeted adjustments to your website or app.
Use Smart Mode
Simple Mode is a bot and crawler management feature for entry-level users. Unlike Advanced Mode, which requires professional expertise to configure complex rules, Simple Mode categorizes traffic into three types by default and lets you select an action for each category. Available for all plans, though some features have plan restrictions.
Configure global policies
In the ESA console, select Websites. In the Website column, click the target site.
In the navigation pane on the left, choose .
On the Bots page, select Smart Mode, configure the items as described below, and then click Configure.
Definite Bots: This category includes many malicious crawlers. Set the action to Block or Slider CAPTCHA.
Likely Bots: Lower risk than Definite Bots but may include malicious crawlers and other traffic. Set the action to Monitor, or to Slider CAPTCHA during high-risk periods.
Verified Bots: This category usually includes crawlers from search engines that support SEO. Set the action to Allow. To block all search engine crawlers, set the action to Block.
Protect static resources from bots
On an Enterprise plan, configure protection for static resources against malicious bots.
Enabling static resource protection may block legitimate bots that periodically fetch static resources, such as email clients. Enable with caution.
Enable JavaScript detection
On an Enterprise plan, use lightweight and invisible JavaScript detection to collect browser fingerprints and improve bot detection accuracy.
Use Professional Mode
Configure protection rulesets for specific requests with separate effective periods. Advanced Mode also protects mobile applications and lets you apply rulesets to other sites in your account.
In the ESA console, select Websites. In the Website column, click the target site.
In the navigation pane on the left, choose .
On the Bots page, select Professional Mode, and click Create Ruleset.
Enter a Rule Set Name. Set Service Type to Browsers, and set SDK Integration to Automatic Integration (Recommended).
In the If requests match... section, configure a rule expression to match target requests. For example, to protect against bots from the Chinese mainland:
(ip.geoip.country in {"CN"}). Supported fields are listed in available rule matching fields for Bots.
Select the protection actions to add.
For search engine bots:
Whitelist: Allow specific search engine bots that you trust.
Fake Crawler Interception: Blocks all search engine bots. Use with Legitimate Bot Management to allow only specific bots.
For known bot libraries:
Bot Threat Intelligence Library: An Alibaba Cloud IP library of known malicious bot sources. Enable Slider CAPTCHA to counter them.
IDC Blacklist Blocking: If your clients do not connect from public clouds or IDCs, use Data Center Blacklist to block requests from these sources.
For requests that need to be identified:
Identify bots by request characteristics: Identifies non-browser bots by comparing their access features with those of real user browsers.
Identify bots by request behavior: ESA analyzes client traffic, automatically trains a machine learning model, and generates protection rules and blacklists. Configure countermeasures based on these rules and blacklists.
Custom throttling: If you want to allow some bot requests but prevent them from accessing your site too frequently, you can limit the request rate from a specific IP address or session. A protection action is applied to requests that exceed the specified threshold.
In the Effective Time area, click Edit next to the relevant rule, set the effective period, and then click OK.
After you complete the configuration, click OK.
Security analytics
Security analytics displays data such as blocked, monitored, and total requests of WAF and bot management, so that you can dynamically adjust your protection rules based on the data.
Analysis dimensions
Filter: Filters by Host, HTTP Version, and Client IP. Only matching data is displayed.
Query time: By default, data for the Last 24 Hours is displayed. You can set a custom range to query data from the last 30 days.
View security analytics reports
During traffic spikes or suspected attacks, use security analytics to analyze HTTP/HTTPS traffic in real time. Compare traffic against your baseline for legitimate requests by examining header structure, payload patterns, and access frequency. For anomalous traffic such as SQL injection or CC attacks, the WAF DPI engine dynamically loads predefined or custom rulesets to block malicious requests and trace attack sources.
Data in Security Analytics is delayed by about 5 minutes.
Account level
View protection data across all sites in your account from a centralized dashboard.
Log on to the ESA console. In the navigation pane on the left, choose .
On the Security Analytics page, you can view protection information and use the Filter to select the data you need. You can click the
icon to print the page report or click the 
icon to download the data as a CSV file for local analysis.
Site level
You can also view protection data for individual sites.
In the ESA console, go to Websites. In the Website column, click the target site.
In the navigation pane on the left, choose .
On the Security Analytics page, you can view protection information and use the Filter to select the data you need. You can click the
icon to print the page report or click the icon to download the data as a CSV file for local analysis.NoteProtect against unusual traffic covers anomaly response. You can create rules by clicking Create Custom WAF Rule from Filters or Create Bot Management Rule from Filters.
Subsequent protection
Set up real-time monitoring
Configure peak bandwidth monitoring for specified domain names of CDN . When the bandwidth reaches the specified peak, alerts are sent to administrators by email, so that you can identify potential risks in a timely manner. For more information, see Configure alert rules.
Set up cost alerts
In the top navigation bar of the console, choose Expenses > Expenses and Costs. Configure the following features to better control your account spending and avoid high bills.
-
Low balance alert: You can set an alert to be sent by SMS when your account balance falls below a specified amount.
-
High bill alert: You can enable an alert that sends an SMS notification if a daily bill for a product exceeds a specified threshold.
To ensure the integrity of the statistics and the accuracy of bills, Alibaba Cloud CDN issues the bill approximately 3 hours after a billing cycle ends. The point in time at which the relevant fees are deducted from your account balance may be later than the point in time at which the resources are consumed within the billing cycle. Alibaba Cloud CDN is a distributed service. Therefore, Alibaba Cloud does not provide the consumption details of resources in bills. Other CDN providers use a similar approach.
Configure a usage cap
You can Configure a usage cap to control the maximum bandwidth, traffic, and number of HTTPS requests for access to the domain name. If you configure auto-repurchase for a resource plan, traffic abuse can quickly consume the resource plan and automatically trigger a repurchase, which generates charges for a new resource plan. New resource plans inherit the repurchase configuration of the original resource plan by default, so ongoing unusual traffic can trigger multiple consecutive repurchases. In this case, we strongly recommend that you also configure a usage cap and promptly update the auto-repurchase rules of the resource plan after you discover traffic abuse.
Access rate limiting
CDN does not support access rate limiting. If you need bot traffic blocking capabilities such as rate limiting and JavaScript challenges, we recommend that you upgrade to Edge Security Acceleration (ESA).