This topic describes the billing of Anti-DDoS Origin 2.0 (Pay-as-you-go).
Overview
Anti-DDoS Origin 2.0 supports the pay-as-you-go billing method and can protect the following types of Alibaba Cloud services:
Regular Alibaba Cloud service: If you do not specify a DDoS mitigation capability when you purchase an Alibaba Cloud service, only the basic DDoS mitigation capability from 500 Mbit/s to 5 Gbit/s is provided.
Elastic IP address (EIP) with Anti-DDoS (Enhanced) enabled: The EIPs for which Security Protection is set to Anti-DDoS (Enhanced) when you purchase the EIPs are supported.
For more information about the mitigation capabilities and features of Anti-DDoS Origin 2.0 (Pay-as-you-go), see What is Anti-DDoS Origin? For more information about how to purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, see Purchase an Anti-DDoS Origin instance.
Usage notes
Anti-DDoS Origin 2.0 (Pay-as-you-go) is billed on a monthly basis. The minimum subscription duration is 30 days. You cannot disable Anti-DDoS Origin 2.0 (Pay-as-you-go) within the first 30 days.
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you are charged for the instance. This does not affect the billing of the resource that you add to Anti-DDoS Origin 2.0 (Pay-as-you-go) for protection.
You can add a maximum of 50 EIPs with Anti-DDoS (Enhanced) enabled to Anti-DDoS Origin 2.0 (Pay-as-you-go) for each Alibaba Cloud account. If you want to increase the quota, contact your account manager.
Log on to the Traffic Security console. On the Instance Management page, select All Regions and find your Anti-DDoS Origin 2.0 (Pay-as-you-go) instance.
Billable items
Billing formula: Fee of the Anti-DDoS Origin 2.0 (Pay-as-you-go) service = Basic fee + Fee for the number of protected IP addresses + Fee for service traffic protection.
Billing cycle: Anti-DDoS Origin calculates all resource usage by calendar day and generates bills based on the actual usage. The bills are generated at 12:00 (UTC+8) on the next day. The bill generation time in the Alibaba Cloud Management Console shall prevail.
Part 1: Basic fee
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you are charged for the instance based on the number of days for which you use the instance. The fee varies based on the region in which your asset resides.
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance and add an asset to the instance for protection, the billing starts. After the billing starts, if the number of the assets on a day is 0, the basic fee of the day is billed based on the tiered price for regions outside the Chinese mainland. The following table describes the tiered prices.
The basic fee for an Anti-DDoS Origin (Pay-as-you-go) instance is generated for each Alibaba Cloud account and independent of the number of IP addresses protected by the instance. For example, if all the protected IP addresses are in the Chinese mainland on Day T, the basic fee for Day T is fixed as USD 231 for the Alibaba Cloud account of the instance.
Region in which your asset resides | Fee (USD per day per account) |
Regions in the Chinese mainland | 231 |
Regions outside the Chinese mainland | 100 |
All regions (in and outside the Chinese mainland) | 331 |
If the Anti-DDoS Origin 2.0 (Pay-as-you-go) service protects assets that reside in and outside the Chinese mainland on Day T, the basic fee for Day T is USD 331. If you delete the asset that resides outside the Chinese mainland on Day T+1, the basic fee for Day T+1 is USD 231.
Part 2: Fee for the number of protected IP addresses
Fees are generated based on the number of protected IP addresses, including those of regular Alibaba Cloud services and EIPs with Anti-DDoS (Enhanced) enabled.
The number of IP addresses on Day T is collected on Day T+1. The number of IP addresses at approximately 23:00 (UTC+8) on Day T is used for billing. For example, if the number of IP addresses on July 2, 2024 is 10 and the number of IP addresses on July 3, 2024 is 20, the number of IP addresses that are billed on July 3, 2024 is 10.
Pricing tier | Unit price (USD per day per IP address) |
0 < Number of IP addresses ≤ 100 | 1 |
100 < Number of IP addresses ≤ 300 | 0.8 |
300 < Number of IP addresses ≤ 500 | 0.6 |
500 < Number of IP addresses ≤ 700 | 0.5 |
700 < Number of IP addresses ≤ 1,000 | 0.4 |
1,000 < Number of IP addresses ≤ 10,000,000 | 0.3 |
For example, the number of protected IP addresses on Day T is 400. The fee of the protected IP addresses on Day T is calculated by using the following formula: 100 × 1 + 200 × 0.8 + 100 × 0.6 = USD 320.
Part 3: Fee for service traffic protection
Only the service traffic of cloud services is billed. The unit prices of service traffic protection for regular Alibaba Cloud services and EIPs with Anti-DDoS (Enhanced) enabled are different. Service traffic from regions in and outside the Chinese mainland is separately billed based on the tiered prices. The service traffic protection usage is calculated the next day.
Rules for calculating service traffic
To simplify billing, service traffic data is collected from cloud services, and the larger value of inbound or outbound traffic is used for billing.
If multiple cloud services in different regions are protected, service traffic is calculated as the traffic sum of each service.
A minimum traffic mechanism is employed when calculating traffic. If daily service traffic falls below the daily minimum threshold, billing will reflect the daily minimum traffic amount.
For instance, consider a scenario where there are 40 EIPs with Anti-DDoS (Enhanced) enabled in regions within the Chinese mainland, and each IP address has a minimum service traffic of 20 GB. Billing is based on the minimum service traffic if actual usage per IP is below this threshold. Suppose 30 IP addresses each use 50 GB and the remaining 10 use only 15 GB; the total daily service traffic would be calculated as follows: 30 × 50 + 10 × 20 = 1,700 GB, or roughly 1.66 TB.
Asset type
Region of the IP addresses
Number of IP addresses
Minimum service traffic of each IP address
Regular Alibaba Cloud service
Regions in the Chinese mainland
No minimum service traffic mechanism is used.
The actual service traffic is used for billing.
Regions outside the Chinese mainland
EIP with Anti-DDoS (Enhanced) enabled
Regions in the Chinese mainland
[0, 30]
0 GB
[31, 99]
20 GB
[100, +∞)
40 GB
Regions outside the Chinese mainland
No minimum service traffic mechanism is used. The actual service traffic is used for billing.
Limits on bandwidth specifications
Bandwidth specifications for EIPs with Anti-DDoS (Enhanced) enabled vary by region and do not affect regular Alibaba Cloud service assets.
Peak inbound bandwidth for local region access: 2 Gbit/s for EIPs with Anti-DDoS (Enhanced) enabled outside the Chinese mainland and 20 Gbit/s for those within the mainland.
Peak inbound bandwidth for cross-region access: 100 Mbit/s for EIPs with Anti-DDoS (Enhanced) enabled outside the Chinese mainland and unlimited for those within the mainland.
If the bandwidth does not meet your business requirements, log on to the Traffic Security console and navigate to the page. Click Details to request an increase in peak inbound bandwidth. 
Local region access: Your service client and the EIP with Anti-DDoS (Enhanced) enabled are in the same region.
Cross-region access: Your service client and the EIP with Anti-DDoS (Enhanced) enabled are in different regions.
For example, if the EIP with Anti-DDoS (Enhanced) enabled and your service client are in the China (Hong Kong) region, access is considered local. If the EIP is in China (Hong Kong) and your service client is in the US (Virginia), access is considered cross-region.
Pricing details
Pricing tier | Regular Alibaba Cloud service | EIP with Anti-DDoS (Enhanced) enabled | ||
Unit price in a region in the Chinese mainland (USD per GB) | Unit price in a region outside the Chinese mainland (USD per GB) | Unit price in a region in the Chinese mainland (USD per GB) | Unit price in a region outside the Chinese mainland (USD per GB) | |
0 TB < Traffic ≤ 100 TB | 0.1045 | 0.0500 | 0.1125 | 0.0500 |
100 TB < Traffic ≤ 500 TB | 0.0804 | 0.0400 | 0.0900 | 0.0400 |
500 TB < Traffic ≤ 1,000 TB | 0.0579 | 0.0300 | 0.0675 | 0.0300 |
1,000 TB < Traffic ≤ 1,500 TB | 0.0386 | 0.0200 | 0.0450 | 0.0200 |
Traffic > 1,500 TB | You can contact your account manager to change the specifications based on your business requirements. For more information, see Contact us. | |||
Billing example
The service traffic of an EIP with Anti-DDoS (Enhanced) enabled from November 1 to November 5 is 200 TB, which consists of 50 TB of traffic from regions in the Chinese mainland and 150 TB of traffic from regions outside the Chinese mainland. On November 6, the service traffic is 700 GB, which consists of 300 GB of traffic from regions in the Chinese mainland and 400 GB of traffic from regions outside the Chinese mainland. The following list describes how the fee of service traffic protection on November 6 is calculated:
Unit price of traffic from regions in the Chinese mainland on November 6: Until November 6, the total generated traffic is 50 TB plus 300 GB, which is within the 0 TB < Traffic ≤ 100 TB tier. The unit price of traffic from regions in the Chinese mainland on November 6 is USD 0.1125 per GB.
Unit price of traffic from regions outside the Chinese mainland on November 6: Until November 6, the total generated traffic is 150 TB plus 400 GB, which is within the 100 TB < Traffic ≤ 500 TB tier. The unit price of traffic from regions outside the Chinese mainland on November 6 is USD 0.0400 per GB.
The fee of service traffic protection on November 6 is calculated based on the following formula: 300 GB × USD 0.1125 per GB + 400 GB × USD 0.0400 per GB = USD 49.75.
Release the Anti-DDoS Origin (Pay-as-you-go) instance
After you purchase an instance and add an asset to the instance for protection, the instance must be used for at least 30 days.
Before you can release an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you must release the EIPs with Anti-DDoS (Enhanced) enabled that are added to the instance. Make sure that your service traffic is redirected from the EIPs. You do not need to remove the assets of regular Alibaba Cloud services that are added to the instance. That is because after the instance is released, the system automatically stops protecting the assets.
Log on to the Traffic Security console and choose . In the upper-right corner of the page that appears, click Disable Protection.
Manage overdue payments
If the balance of your Alibaba Cloud account, including cash, vouchers, and coupons, is insufficient to settle an outstanding payment, your account has an overdue payment.
If your Alibaba Cloud account has an overdue payment, you must top up your account at the earliest opportunity to ensure that the balance of your account is sufficient. Otherwise, your Anti-DDoS Origin (Pay-as-you-go) service may become unavailable.
Query bills and resource usage
You can query bills in the Expenses and Costs console.
By default, bills for resource usage on Day T are sent on Day T+1. To protect your interests, Alibaba Cloud may double-check large bills. In this case, the bills may be sent one to three days later. If a delay occurs, bills of multiple days may be merged into one bill. To query your daily usage, log on to the Traffic Security console and choose .
A fee protection mechanism is supported for service traffic protection. In rare cases, attack traffic may be counted as service traffic. For example, HTTP GET flood attacks may increase outbound traffic. In this case, you can submit a ticket to contact technical support to waive the fee that is caused by the abnormal traffic increase. To help Alibaba Cloud find the fee that is caused by the abnormal traffic increase, you must provide server logs or traffic monitoring records, such as logs of normal and abnormal queries per second (QPS) during HTTP GET flood attacks.
You can also query the usage of the Anti-DDoS Origin 2.0 (Pay-as-you-go) service. To query the usage, log on to the Traffic Security console and choose .