Each public IP address includes free DDoS scrubbing up to 5 Gbps. For stronger protection, use Anti-DDoS Origin or Anti-DDoS Pro and Anti-DDoS Premium.
Security risks
In a distributed denial-of-service (DDoS) attack, attackers use many compromised hosts to flood a target, such as your web server or application API, with seemingly legitimate requests. These requests exhaust system resources such as bandwidth, CPU, memory, or connections, causing slow responses or crashes. Legitimate users lose access, resulting in financial losses and brand damage. Services such as e-commerce, online games, and financial payments are common targets, especially during promotions or major events.
Alibaba Cloud provides free Anti-DDoS protection of up to 5 Gbps for each public IP address. This basic protection has the following limitations:
Limited mitigation threshold: Modern attacks can reach hundreds of Gbps, easily exceeding the 5 Gbps limit. When attack traffic exceeds this threshold, blackhole filtering is triggered—all Internet traffic to your server is discarded, including non-malicious traffic, causing a complete service disruption.
Limited protection types: The Free Edition scrubs common network-layer and transport-layer attacks, such as UDP reflection attacks and SYN Floods. It cannot defend against application-layer attacks such as HTTP Floods (CC attacks), which mimic real user behavior and exhaust CPU and memory resources.
No fine-grained policies: The Free Edition uses a fixed automated policy. You cannot customize mitigation settings or obtain detailed attack reports.
Best practices
Reduce Internet exposure
DDoS attacks require a public IP address. If your services are internal or serve specific networks, avoid Internet exposure. See Reduce the Internet exposure risk of ECS instances, Access cloud services over an internal network or a leased line, and Use PrivateLink to reduce unnecessary Internet communication.
Use the free Anti-DDoS edition
The basic DDoS scrubbing service requires no purchase or configuration. Each public IP address has a scrubbing threshold of 500 Mbps to 5 Gbps. Below this threshold, attack traffic is automatically filtered while non-malicious traffic passes through. The Free Edition scrubs only common network-layer and transport-layer attacks, such as UDP reflection attacks, SYN Floods, and ACK Flood attacks. It cannot scrub application-layer attacks such as CC attacks. If the threshold is exceeded, blackhole filtering discards all traffic to the attacked IP address. The Free Edition suits low-volume network-layer and transport-layer DDoS defense.
Go to the Traffic Security - Overview page.
View the DDoS attack status of assets under your account to determine whether they are under attack or have been attacked.
The Overview page's Historical Attack Analysis area provides four analysis dimensions: Attack Trends, Hot Assets, Peak Attacks, and Attack Duration. You can filter by time range (last 1 week, 1 month, 3 months, or 1 year) to view bar chart trends for metrics such as Scrubbing Count, Blackhole Count, Scrubbed IPs, and Blackholed IPs.
Go to the Traffic Security - Asset Center page. In the upper-left corner of the menu bar, select the region of the asset.
Select the cloud product tab, such as ECS.
View the security status of specific assets, such as ECS instances and EIPs.
The asset list displays columns including Instance ID, IP, IP Status, Defense Capability, and Scrubbing Threshold. The DDoS Attack Protection Description area at the top of the page shows information such as scrubbing thresholds, basic protection thresholds, and blackhole release time.
Use a paid Anti-DDoS edition
The Free Edition caps at 5 Gbps per IP address—exceeding this triggers blackhole filtering and service interruption. It also cannot defend against application-layer attacks. If you face volumetric or application-layer attacks, or need advanced mitigation policies, select a paid Anti-DDoS edition.
Anti-DDoS Origin: Integrates natively with cloud products such as ECS and Server Load Balancer (SLB)—no IP address or DNS changes required. During an attack, traffic is diverted to a scrubbing center on the Alibaba Cloud backbone network. Clean traffic is then forwarded to your server. Benefits include transparent deployment, low latency, mitigation capacity up to Tbps, and fine-grained CC attack policies. See Purchase an Anti-DDoS Origin instance.
Anti-DDoS Pro and Anti-DDoS Premium: Uses DNS redirection or IP pointing to route traffic through globally distributed protection nodes with massive bandwidth. Clean traffic is forwarded to your origin server regardless of whether it is on Alibaba Cloud, making these services ideal for hiding your origin IP address. See Purchase an Anti-DDoS Proxy instance.
View attack status
Alibaba Cloud handles over 100,000 DDoS attacks daily. If your service becomes inaccessible, experiences severe timeouts, or shows degraded performance, check the Traffic Security - Overview page for current and historical attack information.
Set DDoS attack alerts
By default, no notifications are sent during a DDoS attack. Configure alert rules in CloudMonitor alerts (Anti-DDoS Origin) or CloudMonitor alerts (Anti-DDoS Pro and Anti-DDoS Premium):
Traffic Alerts: Set inbound and outbound traffic thresholds for your IP address in CloudMonitor. An alert is sent when traffic exceeds the threshold, which is effective because DDoS attacks generate traffic far above normal levels.
Event Alerts: Subscribe to Alerts for DDoS blackhole filtering alerts and Alerts on Scrubbing Events in CloudMonitor. When an Anti-DDoS action is triggered, a notification is sent through the CloudMonitor alert channel.