Billing FAQ

• When you change the billing method, you will receive a refund for the remaining subscription fees.

  We refund the amount you actually paid to your original payment source. For information about how refunds are calculated, see Refunds for changing the billing method from subscription to pay-as-you-go.

• After the change, you are charged for the pay-by-bandwidth EIP based on usage.

  The fee for a pay-by-bandwidth EIP = Bandwidth fee + EIP configuration fee (public IP retention fee).

Example: You have a subscription EIP with a maximum bandwidth of 300 Mbps in the China (Beijing) region that uses the BGP (Multi-ISP) line type. The EIP is not associated with any cloud resource. At 08:15:00 on November 20, 2024, you change the billing method of this EIP to EIP. After the change, you release the EIP at 22:30:00 on November 20, 2024. You will receive a bill for the pay-as-you-go EIP on November 21, 2024. The pay-as-you-go EIP fees for November 20, 2024 are calculated as follows:

The prices in this example are for reference only. For actual prices, see the buy page.

• You can switch a pay-as-you-go (pay-by-bandwidth) EIP to a subscription. The change takes effect immediately.

  You cannot switch EIPs protected by Anti-DDoS Origin Enterprise to the subscription billing method.

• You cannot directly switch a pay-as-you-go (pay-by-traffic) EIP to a subscription. You must first switch the EIP to the pay-by-bandwidth method, and then switch it to a subscription.

  While a billing method change is pending, you cannot submit another request to modify the bandwidth limit.

Currently, you can only change the billing method of EIPs from pay-as-you-go to subscription one at a time. Batch conversion is not supported.

Account requirements

• Both the source and target Alibaba Cloud accounts must be registered on the China site and have completed real-name registration.

• If the source account is registered under an enterprise, the target account must also be registered under an enterprise with the same name.

  For example, if the source account is registered under Company A, the target account must also be registered under Company A.

  To change the enterprise entity or update the name for an Alibaba Cloud account that has completed enterprise real-name registration, see Change Enterprise Entity.

• If the source account is registered to an individual, the target account can be registered to either an individual or an enterprise, and the names do not need to match. The following rules apply:

  • For example, a source account registered under Name A can transfer resources to only one of multiple target accounts registered under different names, such as B, C, or D.

  • For example, if both the source account and multiple target accounts are registered under the same name, the source account can transfer resources to all of them.

• Transfers are not supported for accounts from resellers or virtual operators.

• The source account and the target account cannot be the same account.

• Neither the source nor the target account can be pending cancellation or frozen.

• Neither the source account nor the target account can be a managed account.

  For accounts in a financial hosting relationship, the managing account (host) can participate in transfers, but the managed account cannot. For example, if Account A delegates its financial management to Account B, Account B can transfer resources, but Account A cannot.

• Both the source account and the target account must have an available balance, including cash and credit line.

• If the target account already has pay-as-you-go resources, its available balance must be at least CNY 100.

EIP requirements

• You must convert a subscription EIP to pay-as-you-go before you can transfer it.

• Before the transfer, you must disassociate it from all associated cloud resources.

• The EIP cannot be under risk control or have overdue payments.

• An EIP can be transferred only five days after it was created or converted from a static public IP address.

• There must be no unpaid orders to convert the EIP's billing method to subscription.

Transfer rules

• Each EIP can be transferred only once. Proceed with caution.

• EIPs can be transferred only within the same region. Cross-region transfers are not supported.

• After the transfer, the total number of EIPs in the target account must not exceed its EIP quota.

• After the source account initiates the transfer, the target account must accept it within 24 hours. Otherwise, the transfer request automatically expires.

• While the EIP transfer is in progress, you cannot perform the following operations on the EIP: convert it to a subscription EIP, associate it with a cloud resource, resize it, change its billing method, or release it.

• The source account can cancel the transfer at any time before the target account accepts or rejects it.

• For a pay-as-you-go EIP:

  • You are charged an EIP configuration fee (public IP retention fee) immediately after you apply for an EIP. You are not charged this fee if the EIP is allocated from a specified IP address pool.

  • After you associate the EIP with a resource, the EIP configuration fee (public IP retention fee) is waived only if the EIP is directly associated with an ECS or ECI instance in a VPC and the EIP quota for your Alibaba Cloud account is 2,000 or less.

  To avoid unnecessary charges, we recommend that you apply for an EIP only when you need it.

• For a subscription EIP: You are not charged an EIP configuration fee (public IP retention fee).

A sudden spike in EIP data transfer can lead to an increase in fees. You can troubleshoot the issue based on the following information:

Possible causes

• Business-related issues: Increased traffic due to system updates or business growth.

• System vulnerabilities: Flaws in your applications that inadvertently generate a large number of network requests.

• Malicious intrusions or scanning: Increased traffic caused by malicious attacks, web crawlers, and other forms of unwanted access.

• Improper network configuration: Misconfigured rules for security groups or firewalls that allow a large number of unwanted requests.

Troubleshooting guide

1. Check monitoring data

   You can use Cloud Monitor to view the traffic and bandwidth usage of your EIP and analyze the patterns and trends of abnormal traffic. For more information, see Monitoring and alerting.

   You can also take the following measures to more quickly and accurately identify abnormal traffic in the future:

   • Configure fine-grained monitoring: You can monitor changes in Internet service traffic in real time and adjust the maximum bandwidth of your EIP accordingly.

   • View traffic analysis: You can view top traffic information consumed by communication between your EIP and external IP addresses.

   • Create an alert rule for bandwidth usage: When bandwidth usage abnormally increases, Cloud Monitor can send prompt alert notifications, allowing you to quickly investigate and address the issue.

2. Locate the abnormal process

   • Use Cloud Monitor: Use the process monitoring feature of Cloud Monitor to identify the abnormal process that occupies network resources based on the time period of the traffic spike. For more information, see Process monitoring.

   • Use network monitoring tools: Use the appropriate tools based on the operating system of the server associated with the EIP to view traffic usage and identify the abnormal process that occupies network resources.

     • Linux: You can use tools such as sar, iftop, and nethogs to check the network traffic load on an ECS instance. For more information, see Troubleshoot high network bandwidth usage on Linux instances.

     • Windows: You can use built-in Microsoft tools such as Task Manager, Resource Monitor, Performance Monitor, Process Explorer, and Xperf (available in Windows Server 2008 and later) to analyze traffic usage. For more information, see Troubleshoot high network bandwidth usage on Windows instances.

3. Analyze log files

   By viewing and analyzing server log files, you can identify the source of the traffic and the type of requests.

   Command examples: View server logs

   View logs in Linux

   • View NGINX access log: cat /var/log/nginx/access.log

   • View Apache access log (choose the path based on your distribution):

     • Debian/Ubuntu: cat /var/log/apache2/access.log

     • CentOS/RHEL: cat /var/log/httpd/access_log

   View logs on Windows

   The specific path of NGINX and Apache access log files depends on the installation and configuration. Use your actual installation path. The paths in the following commands are common default examples.

   • If the NGINX access log path is C:\Program Files\nginx\logs\access.log, run the following command to view the access log: type "C:\Program Files\nginx\logs\access.log"

   • If the Apache access log path is C:\Program Files\Apache Software Foundation\Apache2.4\logs, run the following command to view the access log: type "C:\Program Files\Apache Software Foundation\Apache2.4\logs\access.log"

   Identify IPs with high request frequency

   After viewing the log file, you can use the following command to count the IPs with the most requests in access.log and quickly spot suspicious sources. The example uses Linux and the default NGINX log path.

   awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

   Command description:

   • awk '{print $1}': Extract the first field from each log line. With the default combined log format, this is the client IP ($remote_addr).

   • sort: Sort the extracted IP addresses to prepare for aggregation.

   • uniq -c: Count the occurrences of each IP address.

   • sort -rn: Sort the counts in descending order.

   • head -20: Return the top 20 IP addresses with the most requests.

   To count entries in Apache logs, replace the path with the actual Apache log path, for example, /var/log/apache2/access.log.

   Note: The command above assumes the log uses the default combined format for NGINX or Apache, in which the first field is the client IP address. If your server sits behind a reverse proxy, a CDN, Server Load Balancer (SLB), or Global Accelerator (GA), the first field is the upstream proxy IP address rather than the real client IP address, and the resulting statistics will point entirely to the proxy side. The real client IP address is typically carried in the X-Forwarded-For request header. In this case, first add $http_x_forwarded_for to the NGINX log_format directive to record this header, and then adjust the field that awk extracts (for example, take the first IP address in the XFF list).

4. Check security group and firewall configurations

   Check your security group rules or firewall configurations to close unnecessary ports and services and strictly control access permissions.

   For information about how to configure security groups, see Add security group rules. If you need customized or more fine-grained access control, configure your system firewall based on the following information:

   • Linux firewall configuration example: Block suspicious IP addresses and ports

     # View firewall rules (iptables)
     sudo iptables -L -n -v
     # Add a firewall rule to block a suspicious IP address
     sudo iptables -A INPUT -s <suspicious-ip> -j DROP

   • On a Windows system, you can configure firewall rules by using the Windows Defender Firewall with Advanced Security interface.

5. Check your applications

   Use antivirus software or security tools to check for malware. Scan your servers for vulnerabilities and promptly update your systems and software.

   You can use Alibaba Cloud Security Center to detect and block various security threats, including virus propagation, hacker attacks, ransomware encryption, vulnerability exploits, AccessKey pair leaks, and malicious mining.