All Products
Search

This Product

    CDN:Prevent traffic abuse

    Document Center

    CDN:Prevent traffic abuse

    Last Updated:May 11, 2026

    Malicious attacks or traffic abuse against your domain name can cause sudden bandwidth spikes, resulting in unexpectedly high bills. Because the resulting bills cannot be waived or refunded, this document outlines best practices to mitigate these risks.

    Mitigate immediate losses

    If your domain name experiences malicious attacks or traffic abuse resulting in high bills, take immediate action to mitigate losses. First, configure a bandwidth cap and enable traffic throttling for individual requests. After implementing these controls, you can analyze your logs to configure more targeted security settings.

    Bandwidth usage

    Set a bandwidth cap to control your bandwidth usage. If the average bandwidth for an accelerated domain name exceeds the preset cap within a one-minute interval, CDN stops serving content for that domain. CDN then resolves the domain name to an invalid address, offline.***.com, rendering it inaccessible. When setting the bandwidth cap, allow sufficient headroom above your normal peak traffic to avoid disrupting legitimate users. For more information, see Configure bandwidth cap.

    image

    Downstream speed

    Configure traffic throttling for individual requests to limit the downstream speed of all user requests to CDN points of presence (POPs). This helps suppress the peak bandwidth usage across the network for your accelerated domain name. For instructions, see Configure traffic throttling for individual requests.

    image

    Analyze the cause

    Check billing details for abnormal traffic

    You can view the billing details of cloud services on the Billing Details tab. Select a statistical dimension and a statistical period to view reports based on different dimensions. For more information, see Billing details.

    Set Statistical Period to By Detail and Product to Alibaba Cloud CDN. Review the bill carefully for unusual increases in traffic and bandwidth to identify the abnormal traffic periods. For more information, see Bill Query.

    Examine log files for abnormal traffic

    Basic query: offline logs

    Download offline logs to view access logs for the relevant time period. Analyze the HTTP request details to identify suspicious IP addresses, User-Agents, and more. Offline logs contain limited data fields. If you want to view more data, use the real-time logs feature.

    Use command-line tools to quickly parse the offline log files and extract information such as the top 10 IP addresses or User-Agents by request volume. For details, see Analysis methods for Alibaba Cloud CDN access logs.

    Advanced query: operation reports and real-time logs

    Important

    • You must customize operation reports to enable statistical analysis. If you have already configured real-time log delivery or subscribed to operation reports, you can view historical log data. Operation reports are a free, built-in feature of Alibaba Cloud CDN.

    • To generate real-time logs, you must first enable Log Service (SLS) and ensure logs are delivered successfully. This is a paid feature. For pricing details, see Pricing Details.

    • You must configure both real-time logs and operation reports in advance. If you did not configure these features before the high charges occurred, you can use only offline logs for historical analysis.

    Operation reports

    After customizing operation reports, you can view user access reports, including PV/UV, Regions and ISPs, Domain Name Ranking, Popular Referer Headers, Popular URLs, Popular Origin URLs, and Top Client IPs. For details, see Customize and Subscribe to Operation Reports.

    image

    Real-time logs

    To query more log information, such as Referer and URI details, enable Log Service (SLS) to collect real-time logs. You are billed based on the number of delivered log entries after this feature is enabled.

    1. Configure real-time log delivery for the accelerated domain name you want to analyze, as described in Configure real-time log delivery.

    2. On the Real-time Logs page, find the project you want to analyze and click Log analysis.

      image

    3. On the Log Analysis page, filter the time range in the upper-right corner. Click the Raw Logs tab on the left, find the refer_domain field, and view the Referer information sorted in descending order.

      image

    Resolve the issue

    After obtaining log or report data, analyze its characteristics to identify the attack type. You can typically extract features by analyzing key metrics such as Top IP, Top User-Agent, and Top Referer.

    Block suspicious IP addresses

    To restrict access from suspicious IP addresses, configure an IP blocklist. Analyze your logs to identify suspicious IP addresses and add them to this list. For detailed instructions, see Configure IP Blocklist/Whitelist.

    image

    Filter suspicious User-Agents

    Attackers send large volumes of requests with a spoofed User-Agent header to bypass security checks. A spoofed User-Agent can be an empty value, a random string, or a forged string that mimics a common browser. You can configure a User-Agent whitelist or blocklist to reject requests with abnormal User-Agents. For example, to reject requests with an empty User-Agent or a non-compliant random string, you can use the parameters this-is-empty-ua and RandomString respectively. For detailed instructions, see Configure UA Blocklist/Whitelist.

    image

    Block suspicious referers

    Attackers spoof the Referer header in requests to impersonate legitimate sources and send malicious requests. Configure a Referer blocklist or whitelist to allow access from legitimate referers, prevent unauthorized third-party websites from hotlinking your resources, and reject requests with malicious Referer values. In the Rules input field, enter the abnormal Referer values that you found in the logs. We recommend selecting the Ignore Scheme option. For detailed instructions, see Configure Referer Blocklist/Whitelist.

    image

    Upgrade to ESA and enable WAF and bot protection

    We recommend migrating your domain name to ESA. ESA provides a rich set of protection features that not only secure your data but also improve access speed and user experience. You can quickly migrate your domain name by using the Feature comparison of CDN, DCDN, and ESA guide. Then, follow the guide below to enable the security features of ESA.

    WAF

    ESA WAF provides a wide range of rule-matching and blocking capabilities, including IP access rules, whitelist rules, and custom rules, to prevent attacks and protect your core business data.

    Configure an IP access rule

    1. In the ESA console, go to Websites and click your target website in the Website column.

    2. On the website details page, choose Security > WAF > IP Access Rule.

    3. To define a rule, select a match type, such as IP/CIDR Block, ASN, or Region, enter a value, select an Action, and then click Create Rule. For more information about available actions, see Actions.

      image

    4. Optional: By default, created rules apply to all Layer 7 (HTTP) requests for your website. To apply a rule to Layer 4 (TCP/UDP) requests, go to TCP/UDP > Settings. On the Settings page, click Create Application. In the Create Application panel, enable IP Access Rules.

      image

    Create a whitelist rule

    1. In the ESA console, go to Websites. In the Actions column for the target site, click image > WAF.

    2. On the website details page, navigate to Security > WAF > Whitelist Rules.

    3. On the Whitelist Rules tab, click Create Rule.

      • Enter a Rule Name.

      • In the If requests match... section, specify the request characteristics. For more information, see Composition of a rule expression.

      • In the Then skip... section, specify the protection rules to skip.

        • All Rules: Bypasses all WAF and bot management rules.

        • Specific Rule Category/ID: Select rules to bypass. For example, for managed rules, you can enter a rule ID of specify a rule type, such as bot management or rate limiting.

    4. Click OK.

    Configure a custom rule

    1. In the ESA console, navigate to Websites. In the Website column, click the target site.

    2. In the left-side navigation pane, choose Security > WAF.

    3. Click the Custom Rules tab. On the Custom Rules tab, click Create Rule.

      • Enter a Rule Name.

      • In the If requests match... section, define the match conditions for requests. For more information, see Components of a rule expression.

      • In the Then execute... section, specify the action to perform on matching requests. For details, see Action descriptions.

    4. Click OK.

    Bot protection

    ESA's Quick Start supports configuration in both Simple Mode and Advanced Mode. Simple Mode allows you to quickly configure bot management for your current site, while Advanced Mode provides more precise bot rules for targeted adjustments to your website or app.

    Use Smart Mode

    Simple Mode is a bot and crawler management feature for entry-level users. It is available for all subscription plans, but some features may be subject to plan restrictions. Unlike Advanced Mode, which requires professional expertise to configure complex rules, Simple Mode categorizes traffic into three types by default. You can manage bots by selecting an action for each category.

    Configure global policies

    1. In the ESA console, select Websites. In the Website column, click the target site.

    2. In the navigation pane on the left, choose Security Protection > Bots.

    3. On the Bots page, select Smart Mode, configure the items as described below, and then click Configure.

      • Definite Bots: This category includes many malicious crawlers. Set the action to Block or Slider CAPTCHA.

      • Likely Bots: These requests have a lower risk than Definite Bots but may contain malicious crawlers and other traffic. Set the action to Monitor, or to Slider CAPTCHA during high-risk periods.

      • Verified Bots: This category usually includes crawlers from search engines that support your website's search engine optimization (SEO). Set the action to Allow. If you do not want any search engine crawlers to access your site, you can set the action to Block.

    Configure bots detection for static resource requests

    If you are on an Enterprise plan, you can configure protection for static resources against malicious bots.

    Important

    If you enable static resource protection, normal bots that periodically obtain static resources, such as email clients, may be blocked. Enable this feature with caution.

    Enable JavaScript detection

    If you are on an Enterprise plan, you can use lightweight and invisible JavaScript detection to collect browser fingerprints and improve bot detection results.

    Use Professional Mode

    You can configure protection rulesets for specific requests to your site and set a separate effective period for each protection action. Advanced Mode also protects mobile applications and lets you apply rulesets to other sites in your account. To configure a bot ruleset, follow these steps:

    1. In the ESA console, select Websites. In the Website column, click the target site.

    2. In the navigation pane on the left, choose Security > Bots.

    3. On the Bots page, select Professional Mode, and click Create Ruleset.

    4. Enter a Rule Set Name. Set Service Type to Browsers, and set SDK Integration to Automatic Integration (Recommended).

    5. In the If requests match... section, configure a rule expression to match the requests that you want to filter. For example, to apply bot protection to requests from the Chinese mainland, configure the expression as: (ip.geoip.country in {"CN"}). For more information about the supported fields, see available rule matching fields for Bots.image

    6. Select the protection actions to add.

      • For search engine bots:

        • Whitelist: Allow specific search engine bots that you trust.

        • Fake Crawler Interception: This feature blocks all search engine bots. You can use it with Legitimate Bot Management to allow only specific search engine bots.

      • For known bot libraries:

        • Bot Threat Intelligence Library: This is an IP address library of attack sources for malicious bots that are identified by Alibaba Cloud. You can enable Slider CAPTCHA to counter them.

        • IDC Blacklist Blocking: If your clients do not connect from public clouds or IDC data centers, you can use Data Center Blacklist to directly block requests from these sources.

      • For requests that need to be identified:

        • Identify bots by request characteristics: This feature identifies non-browser bots by comparing their access features with those of real user browsers.

        • Identify bots by request behavior: ESA analyzes traffic from clients, automatically trains a machine learning model, and generates protection rules or blacklists. You can then configure countermeasures based on the generated rules and blacklists.

        • Custom throttling: If you want to allow some bot requests but prevent them from accessing your site too frequently, you can limit the request rate from a specific IP address or session. A protection action is applied to requests that exceed a specified threshold.

    7. In the Effective Time area, click Edit next to the relevant rule, set the effective period, and then click OK.

    8. After you complete the configuration, click OK.

    Security Analytics

    Security Analytics displays data on blocked and monitored requests, as well as total request volume for WAF and bot management. Use this data to dynamically adjust your protection rules.

    Analysis dimensions

    • Filter: Filters data by dimensions such as Host, HTTP Version, and Client IP. Only data that matches the specified filters is displayed.

    • Query time: By default, data for the Last 24 Hours is displayed. You can specify a custom time range to query data from the last 30 days.

    View security analytics reports

    If your web application experiences a sudden traffic spike or you detect unusual attack behavior, use the security analytics module to analyze HTTP and HTTPS request traffic in real time. Compare the traffic against your predefined baseline for legitimate requests. Refer to characteristics such as header structure, payload patterns, and access frequency. For unexpected traffic that deviates from the baseline, such as traffic with SQL injection or CC attack features, the WAF Deep Packet Inspection (DPI) engine can dynamically load predefined or custom rulesets. These rules, such as regular expression matching and rate limiting policies, precisely block requests and help you trace the source of attacks. This process enables proactive threat management within a defense-in-depth framework.

    Note

    Data in Security Analytics is delayed by about 5 minutes.

    Account level

    Security analytics provides a centralized view for analyzing protection information across all sites under your account.

    1. Log on to the ESA console. In the navigation pane on the left, choose Analytics and Logs > Security Analytics.

    2. On the Security Analytics page, you can view protection information and use the Filter to select the data you need. You can click the image icon to print the page report or click the image icon to download the data as a CSV file for local analysis.

      image

    Site level

    Security analytics also provides reports for individual sites. You can use these reports to analyze protection information for a specific site.

    1. In the ESA console, go to Websites. In the Website column, click the target site.

    2. In the navigation pane on the left, choose Security > Security Analytics.

    3. On the Security Analytics page, you can view protection information and use the Filter to select the data you need. You can click the image icon to print the page report or click the image icon to download the data as a CSV file for local analysis.

      Note

      For more information, see Protect against unusual traffic. On the security protection page, you can centrally manage this protection by clicking Create Custom WAF Rule from Filters or Create Bot Management Rule from Filters.

      image

    Next steps

    Real-time monitoring

    Configure real-time monitoring for the peak bandwidth of specified domain names in CDN. If the peak bandwidth reaches the configured threshold, the system sends an alert to administrators by SMS, email, or DingTalk. This helps you promptly detect potential risks. For more information, see Configure alert rules.

    Cost alerts

    In the top navigation bar of the console, choose Expenses > Expenses and Costs. Configure the following features to better control your account spending and avoid high bills.

    • Low balance alert: You can set an alert to be sent by SMS when your account balance falls below a specified amount.

    • High bill alert: You can enable an alert that sends an SMS notification if a daily bill for a product exceeds a specified threshold.

    Note

    To ensure the integrity of the statistics and the accuracy of bills, Alibaba Cloud CDN issues the bill approximately 3 hours after a billing cycle ends. The point in time at which the relevant fees are deducted from your account balance may be later than the point in time at which the resources are consumed within the billing cycle. Alibaba Cloud CDN is a distributed service. Therefore, Alibaba Cloud does not provide the consumption details of resources in bills. Other CDN providers use a similar approach.