This topic describes the billing of Anti-DDoS Origin 2.0 (Pay-as-you-go).
Overview
Anti-DDoS Origin 2.0 supports the pay-as-you-go billing method and can protect the following types of Alibaba Cloud services:
Regular Alibaba Cloud service: If you do not specify a DDoS mitigation capability when you purchase an Alibaba Cloud service, only the basic DDoS mitigation capability from 500 Mbit/s to 5 Gbit/s is provided.
Elastic IP address (EIP) with Anti-DDoS (Enhanced) enabled: The EIPs for which Security Protection is set to Anti-DDoS (Enhanced) when you purchase the EIPs are supported.
For more information about the mitigation capabilities and features of Anti-DDoS Origin 2.0 (Pay-as-you-go), see What is Anti-DDoS Origin? For more information about how to purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, see Purchase an Anti-DDoS Origin instance.
Usage notes
Anti-DDoS Origin 2.0 (Pay-as-you-go) is billed on a monthly basis. The minimum subscription duration is 30 days. You cannot disable Anti-DDoS Origin 2.0 (Pay-as-you-go) within the first 30 days.
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you are charged for the instance. This does not affect the billing of the resource that you add to Anti-DDoS Origin 2.0 (Pay-as-you-go) for protection.
You can add a maximum of 50 EIPs with Anti-DDoS (Enhanced) enabled to Anti-DDoS Origin 2.0 (Pay-as-you-go) for each Alibaba Cloud account. If you want to increase the quota, contact your account manager.
Log on to the Traffic Security console. On the Instance Management page, select All Regions and find your Anti-DDoS Origin 2.0 (Pay-as-you-go) instance.
Billable items
Billing formula: Fee of the Anti-DDoS Origin 2.0 (Pay-as-you-go) service = Basic fee + Fee for the number of protected IP addresses + Fee for service traffic protection.
Billing cycle: Anti-DDoS Origin calculates all resource usage by calendar day and generates bills based on the actual usage. The bills are generated at 12:00 (UTC+8) on the next day. The bill generation time in the Alibaba Cloud Management Console shall prevail.
Basic fee
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you are charged for the instance based on the number of days for which you use the instance. The fee varies based on the region in which your asset resides.
After you purchase an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance and add an asset to the instance for protection, the billing starts. After the billing starts, if the number of the assets on a day is 0, the basic fee of the day is billed based on the tiered price for regions outside the Chinese mainland. The following table describes the tiered prices.
The basic fee for an Anti-DDoS Origin (Pay-as-you-go) instance is generated for each Alibaba Cloud account and independent of the number of IP addresses protected by the instance. For example, if all the protected IP addresses are in the Chinese mainland on Day T, the basic fee for Day T is fixed as USD 231 for the Alibaba Cloud account of the instance.
Region in which your asset resides | Fee (USD per day per account) |
Regions in the Chinese mainland | 231 |
Regions outside the Chinese mainland | 100 |
All regions (in and outside the Chinese mainland) | 331 |
If the Anti-DDoS Origin 2.0 (Pay-as-you-go) service protects assets that reside in and outside the Chinese mainland on Day T, the basic fee for Day T is USD 331. If you delete the asset that resides outside the Chinese mainland on Day T+1, the basic fee for Day T+1 is USD 231.
Fee for the number of protected IP addresses
Fees are generated based on the number of protected IP addresses and the number of cold standby IP addresses. The actual fee is calculated based on the tiered prices.
The number of IP addresses on Day T is collected on Day T+1. The number of IP addresses at approximately 23:00 (UTC+8) on Day T is used for billing. For example, if the number of IP addresses on July 2, 2024 is 10 and the number of IP addresses on July 3, 2024 is 20, the number of IP addresses that are billed on July 3, 2024 is 10.
Fee for the number of protected IP addresses
The number of protected IP addresses includes the number of IP addresses of regular Alibaba Cloud services and the number of EIPs with Anti-DDoS (Enhanced) enabled.
Pricing tier
Unit price (USD per day per IP address)
0 < Number of IP addresses ≤ 100
1
100 < Number of IP addresses ≤ 300
0.8
300 < Number of IP addresses ≤ 500
0.6
500 < Number of IP addresses ≤ 700
0.5
700 < Number of IP addresses ≤ 1,000
0.4
1,000 < Number of IP addresses ≤ 10,000,000
0.3
For example, the number of protected IP addresses on Day T is 400. The fee of the protected IP addresses on Day T is calculated by using the following formula: 100 × 1 + 200 × 0.8 + 100 × 0.6 = USD 320.
Fee for the number of cold standby IP addresses
Only the cold standby IP addresses of EIPs with Anti-DDoS (Enhanced) enabled are additionally billed. Regular Alibaba Cloud services are not involved.
If the monthly traffic of an EIP with Anti-DDoS (Enhanced) enabled is less than 1 GB, which is equivalent to a bandwidth of approximately 0.25 Mbit/s, no actual service traffic is generated. In this case, the EIP is considered a cold standby IP address. The monthly traffic is calculated based on the larger value between the inbound and outbound traffic.
Pricing tier
Unit price (USD per day per IP address)
0 < Number of cold standby IP addresses ≤ 30
0
30 < Number of cold standby IP addresses ≤ 10,000,000
2
Fee for service traffic protection
Only the service traffic of cloud services is billed. The unit prices of service traffic protection for regular Alibaba Cloud services and EIPs with Anti-DDoS (Enhanced) enabled are different. Service traffic from regions in and outside the Chinese mainland is separately billed based on the tiered prices. The service traffic protection usage on Day T is calculated on Day T+1.
Rules for calculating service traffic
Service traffic of cloud services is calculated by the cloud services.
If multiple cloud services that reside in and outside the Chinese mainland are protected, service traffic is calculated based on the sum of service traffic of each cloud service.
Service traffic of a cloud service is calculated based on the larger value between the inbound and outbound service traffic.
Limits on bandwidth specifications
Bandwidth specifications for EIPs with Anti-DDoS (Enhanced) enabled vary based on the regions of the EIPs. The limits do not affect assets of regular Alibaba Cloud services.
Peak inbound bandwidth for access from the local region: 2 Gbit/s for EIPs with Anti-DDoS (Enhanced) enabled in regions outside the Chinese mainland and 20 Gbit/s for EIPs with Anti-DDoS (Enhanced) enabled in regions in the Chinese mainland.
Peak inbound bandwidth for cross-region access: 100 Mbit/s for EIPs with Anti-DDoS (Enhanced) enabled in regions outside the Chinese mainland and unlimited for EIPs with Anti-DDoS (Enhanced) enabled in regions in the Chinese mainland.
If the preceding specifications cannot meet your business requirements, you can submit a request to change the specifications. To submit a request, perform the following steps: Log on to the Traffic Security console and choose . On the Billing Management page, click Details to submit a request to change the specifications. 
Access from the local region: Your service client and the EIP with Anti-DDoS (Enhanced) enabled reside in the same region.
Access across regions: Your service client and the EIP with Anti-DDoS (Enhanced) enabled reside in different regions.
For example, if the EIP with Anti-DDoS (Enhanced) enabled and your service client reside in the China (Hong Kong) region, your service client accesses the EIP with Anti-DDoS (Enhanced) enabled from the local region. If the EIP with Anti-DDoS (Enhanced) enabled resides in the China (Hong Kong) region and your service client resides in the US (Virginia) region, your service client accesses the EIP with Anti-DDoS (Enhanced) enabled across regions.
Pricing details
Pricing tier | Regular Alibaba Cloud service | EIP with Anti-DDoS (Enhanced) enabled | ||
Unit price in a region in the Chinese mainland (USD per GB) | Unit price in a region outside the Chinese mainland (USD per GB) | Unit price in a region in the Chinese mainland (USD per GB) | Unit price in a region outside the Chinese mainland (USD per GB) | |
0 TB < Traffic ≤ 100 TB | 0.1045 | 0.0500 | 0.1125 | 0.0500 |
100 TB < Traffic ≤ 500 TB | 0.0804 | 0.0400 | 0.0900 | 0.0400 |
500 TB < Traffic ≤ 1,000 TB | 0.0579 | 0.0300 | 0.0675 | 0.0300 |
1,000 TB < Traffic ≤ 1,500 TB | 0.0386 | 0.0200 | 0.0450 | 0.0200 |
Traffic > 1,500 TB | You can contact your account manager to change the specifications based on your business requirements. For more information, see Contact us. | |||
Billing example
The service traffic of an EIP with Anti-DDoS (Enhanced) enabled from November 1 to November 5 is 200 TB, which consists of 50 TB of traffic from regions in the Chinese mainland and 150 TB of traffic from regions outside the Chinese mainland. On November 6, the service traffic is 700 GB, which consists of 300 GB of traffic from regions in the Chinese mainland and 400 GB of traffic from regions outside the Chinese mainland. The following list describes how the fee of service traffic protection on November 6 is calculated:
Unit price of traffic from regions in the Chinese mainland on November 6: Until November 6, the total generated traffic is 50 TB plus 300 GB, which is within the 0 TB < Traffic ≤ 100 TB tier. The unit price of traffic from regions in the Chinese mainland on November 6 is USD 0.1125 per GB.
Unit price of traffic from regions outside the Chinese mainland on November 6: Until November 6, the total generated traffic is 150 TB plus 400 GB, which is within the 100 TB < Traffic ≤ 500 TB tier. The unit price of traffic from regions outside the Chinese mainland on November 6 is USD 0.0400 per GB.
The fee of service traffic protection on November 6 is calculated based on the following formula: 300 GB × USD 0.1125 per GB + 400 GB × USD 0.0400 per GB = USD 49.75.
Release the Anti-DDoS Origin (Pay-as-you-go) instance
After you purchase an instance and add an asset to the instance for protection, the instance must be used for at least 30 days.
Before you can release an Anti-DDoS Origin 2.0 (Pay-as-you-go) instance, you must release the EIPs with Anti-DDoS (Enhanced) enabled that are added to the instance. Make sure that your service traffic is redirected from the EIPs. You do not need to remove the assets of regular Alibaba Cloud services that are added to the instance. That is because after the instance is released, the system automatically stops protecting the assets.
Log on to the Traffic Security console and choose . In the upper-right corner of the page that appears, click Disable Protection.
Manage overdue payments
If the balance of your Alibaba Cloud account, including cash, vouchers, and coupons, is insufficient to settle an outstanding payment, your account has an overdue payment.
If your Alibaba Cloud account has an overdue payment, you must top up your account at the earliest opportunity to ensure that the balance of your account is sufficient. Otherwise, your Anti-DDoS Origin (Pay-as-you-go) service may become unavailable.
Query bills and resource usage
You can query bills in the Expenses and Costs console.
By default, bills for resource usage on Day T are sent on Day T+1. To protect your interests, Alibaba Cloud may double-check large bills. In this case, the bills may be sent one to three days later. If a delay occurs, bills of multiple days may be merged into one bill. To query your daily usage, log on to the Traffic Security console and choose .
A fee protection mechanism is supported for service traffic protection. In rare cases, attack traffic may be counted as service traffic. For example, HTTP GET flood attacks may increase outbound traffic. In this case, you can submit a ticket to contact technical support to waive the fee that is caused by the abnormal traffic increase. To help Alibaba Cloud find the fee that is caused by the abnormal traffic increase, you must provide server logs or traffic monitoring records, such as logs of normal and abnormal queries per second (QPS) during HTTP GET flood attacks.
You can also query the usage of the Anti-DDoS Origin 2.0 (Pay-as-you-go) service. To query the usage, log on to the Traffic Security console and choose .