How Do I Determine My Workloads Are Under an Attack?

To check whether a public IP address is attacked, perform the following operations:

For details about how to query attack traffic information and anomaly events within 24 hours, see Method 1: Viewing Monitoring Reports.
For details about how to query information about public IP addresses attacked within one month, see Method 2: Viewing the Security Report.

Log in to the management console.
Select a region in the upper part of the page, click in the upper left corner of the page, and choose Security & Compliance > Anti-DDoS Service. The Anti-DDoS page is displayed.
Click the Public IP Addresses tab, locate the row that contains the IP address of which you want to view its monitoring report, and click View Monitoring Report.

Figure 1 Viewing a monitoring report
Check whether there are attack traffic and anomaly events.
- On the Traffic tab page, check whether there is attack traffic displayed in the corresponding time range. If there is, the public IP address is attacked.
- Check whether there are abnormal events in the event list at the bottom. If there are abnormal events, the public IP address is attacked.
Figure 2 Monitoring reports

Log in to the management console.
Select a region in the upper part of the page, click in the upper left corner of the page, and choose Security & Compliance > Anti-DDoS Service. The Anti-DDoS page is displayed.
Click the Security Report tab, select a time range, and check whether the queried public IP address is in Top 10 Attacked Public IP Addresses.
If the public IP address is in Top 10 Attacked Public IP Addresses, the public IP address is attacked.

Figure 3 Security report