Help Center/ Anti-DDoS Service/ Best Practices/ Best Practices of Advanced Anti-DDoS/ Solution to Origin Server IP Address Exposure
Updated on 2026-07-03 GMT+08:00
View PDF
Share

Solution to Origin Server IP Address Exposure

If your origin server continues to face DDoS attacks after Advanced Anti-DDoS is enabled, its IP address is likely exposed.

To prevent attackers from bypassing protection, identify the leak source and change the origin server IP address immediately.

Typical Causes of Origin Server IP Address Exposure

  • If the origin server IP was attacked before connecting to Advanced Anti-DDoS, it was already known to attackers.
  • Attackers may have recorded the origin server IP address before the service was routed through Advanced Anti-DDoS, allowing them to bypass protection and attack the backend directly. In this case, you need to change the origin server IP address.
Figure 1 Typical causes of origin server IP address exposure

Solution

Locate the cause of exposure and change the origin server IP address.

Troubleshooting

  • Verify DNS configurations: Review all the DNS records associated with your old origin server IP address. Ensure that all active domain names and subdomains route traffic through the Advanced Anti-DDoS CNAME or IP address, not exposing the new origin server IP address.
  • Scan for vulnerabilities: Check your website or application for information disclosure or remote code execution (RCE) vulnerabilities. Look for common exposure vectors, including exposed phpinfo() pages or leaked credentials in public GitHub repositories.

Changing the Origin IP Address

  • Choose a new origin IP address from a completely different subnet or CIDR block. Avoid adjacent IP ranges, as attackers often scan neighboring addresses to locate new backends.
  • You are advised to prepare a backup IP address, for example, an EIP. For details, see Obtaining an EIP.

Take an Elastic Load Balance (ELB) instance as an example. You can replace its exposed EIP with a new EIP.

  1. Log in to the EIP console.
  2. In the EIP list, locate the instance (for example, elb-123) associated with the exposed origin server IP address.
  3. Click the instance name. The ELB basic information page is displayed.
  4. Click the EIPs tab page. Click Bind EIP to bind the prepared backup IP address to the ELB instance.

    A message indicating successful binding is displayed.

  5. Log in to the AAD console.
  6. In the navigation pane on the left, choose Advanced Anti-DDoS > Forwarding Configuration.
  7. Locate the exposed origin server IP address and click Edit.

    Figure 2 Changing the origin server IP address

  8. Change the exposed origin server IP address to the one added in 4. Click OK.
  9. Log in to the EIP console.
  10. In the navigation pane on the left, choose EIPs.
  11. In the Operation column of the exposed EIP, click Unbind.
  12. In the displayed dialog box, confirm the information and click Yes.

    A message indicating successful unbinding is displayed.

Hardening the Origin Server

After changing the origin server IP address, optimize your security configurations to minimize the risk of future IP exposure. For details, see Protection Suggestions After AAD Is Connected.