Query Alibaba Cloud DDoS Pro (ddoscoo) block/intercept reasons via SLS full logs and ddoscoo CLI. Analyzes detailed information about intercepted requests including CC protection rules, precise access control rules, region blocking, and IP blacklist policies.
Use when users report being blocked by DDoS Pro, encounter block pages, or need to investigate and remediate DDoS protection rules.
Trigger words: "DDoS block query", "blocked by DDoS Pro", "DDoS intercept", "ddoscoo intercept query", "CC block", "precise access control block", "高防拦截查询", "request blocked by anti-ddos"
Query and analyze DDoS Pro (ddoscoo) block/intercept events using SLS full logs and ddoscoo CLI commands. When a user reports being blocked by DDoS Pro or encounters a block page, this skill discovers DDoS instances, checks full log configuration, queries SLS logs by Request ID, retrieves rule details, and outputs a structured analysis report with recommendations.
Architecture: DDoS Pro Instance → Full Log (SLS) → Log Query → Rule Analysis → Report
Installation
Pre-check: Aliyun CLI >= 3.3.3 required
Run aliyun version to verify >= 3.3.3. If not installed or version too low,
see references/cli-installation-guide.md for installation instructions.
Pre-check: Aliyun CLI plugin update required
[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.
[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.
Pre-check: AI-Mode Lifecycle
At the start of the Core Workflow (before any CLI invocation):
[MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution.
Run the following commands before any CLI invocation:
[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason (workflow success, failure, error, user cancellation, or session end), always disable AI-mode first. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.
bash
aliyun configure ai-mode disable
Pre-check: SLS CLI plugin required
[MUST] Install the SLS CLI plugin before any log query operations:
bash
aliyun component install sls
Verify the plugin is available:
bash
aliyun sls --help
If aliyun component install is not available, use the legacy command:
bash
aliyun plugin install --names aliyun-cli-sls
Environment Variables
No additional environment variables required. Authentication is handled via the Aliyun CLI credential chain.
Authentication
Pre-check: Alibaba Cloud Credentials Required
Security Rules:
NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)
NEVER ask the user to input AK/SK directly in the conversation or command line
NEVER use aliyun configure set with literal credential values
ONLY use aliyun configure list to check credential status
bash
aliyun configure list
Check the output for a valid profile (AK, STS, or OAuth identity).
Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)
Return and re-run after aliyun configure list shows a valid profile
Note on 401 Unauthorized errors: A 401 The security token has expired error means the STS temporary credential has expired — this is not a RAM permission issue. Ask the user to refresh credentials outside this session via aliyun configure, then retry.
[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:
Read references/ram-policies.md to get the full list of permissions required by this SKILL
Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions
Pause and wait until the user confirms that the required permissions have been granted
Parameter Confirmation
IMPORTANT: Parameter Confirmation — Before executing any command or API call,
ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,
passwords, domain names, resource specifications, etc.) MUST be confirmed with the
user. Do NOT assume or use default values without explicit user approval.
Parameter Name
Required/Optional
Description
Default Value
Request ID
Required
The traceid from DDoS Pro's block response page
None
Domain
Optional
The website domain configured in DDoS Pro (auto-discovered if not provided)
Auto-discover
DDoS Instance ID
Optional
DDoS Pro instance ID (auto-discovered if not provided)
Auto-discover
SLS Project
Optional
SLS Project name (auto-discovered if not provided)
Auto-discover
SLS Logstore
Optional
SLS Logstore name (auto-discovered if not provided)
Auto-discover
RegionId
Optional
DDoS Pro region: cn-hangzhou (China Mainland) or ap-southeast-1 (International)
cn-hangzhou
Core Workflow
[MUST] Required API Call Sequence — The following API calls MUST be executed in order for every invocation of this skill. Do NOT skip any step, even if you believe the result is known in advance:
Step 2a → ddoscoo DescribeInstances (both regions) + if domain unknown: DescribeWebAccessLogDispatchStatus for domain discovery only
Step 2c → ddoscoo DescribeWebAccessLogStatus only (domain must be known from user or Step 2a; DescribeWebAccessLogDispatchStatus is NOT permitted here)
[MUST] User-Agent Header — Every aliyun CLI command in this skill MUST include --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query to identify the caller.
[MUST] Instance Discovery Validation — After calling describe-instances, inspect the response:
If Instances is a non-empty array → record the instance(s) and proceed to Step 2b.
If Instances is empty ([]) for one region → retry with the other region before proceeding.
If both regions return empty → stop and inform the user: "No DDoS Pro instances were found under this account. Please verify your credentials and region."
Do NOT proceed to Step 2b or beyond if describe-instances returns no results. An empty instance list means subsequent SLS and log queries will also fail — continuing will produce an empty or incorrect report.
[MUST] Domain Discovery — Step 2c requires a known domain name to call describe-web-access-log-status. If the user did NOT provide the domain in their message, discover it HERE in Step 2a before proceeding:
bash
# Discover all protected domains (domain discovery only — do NOT use the log status from this response)
aliyun ddoscoo describe-web-access-log-dispatch-status --page-number 1 --page-size 10 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
Extract the domain name(s) from the response and record them. This API is used only for domain name discovery, not for checking log status. The actual log status check happens in Step 2c using describe-web-access-log-status.
[MUST] International Region API Error Recovery: If any ap-southeast-1 API call returns InvalidRosettaRegionId, 400 Bad Request, or similar region-level errors:
Do NOT abandon the workflow — continue with available data
For SLS-related operations: International DDoS Pro SLS projects are typically hosted in cn-hangzhou (not ap-southeast-1), with project names like ddosdip-project-<uid>-ap-southeast-1. Always try cn-hangzhou as the SLS region.
For rule query APIs (e.g., describe-web-precise-access-rule, describe-l7-global-rule): If ap-southeast-1 fails, retry the same API call using cn-hangzhou endpoint
[MUST] Never skip a user-requested query step due to region API errors — always attempt recovery via the alternative region before reporting failure
Step 2b: Check SLS and Full Log Status
First check if SLS is opened and log store exists:
[IMPORTANT] Fallback for SLS Info Retrieval: If describe-sls-logstore-info returns an error (e.g., 400 InvalidRosettaRegionId in ap-southeast-1), use the following fallback methods in order:
Fallback 1 — Get SLS info from domain log status (requires knowing a domain):
Look for project names containing ddoscoo or ddosdip. Note: International DDoS Pro SLS projects may also be hosted in cn-hangzhou.
Step 2c: Check Domain Full Log Status
⛔ FORBIDDEN: describe-web-access-log-dispatch-status is NOT used in this step.
Domain discovery was completed in Step 2a. This step has exactly ONE permitted API call.
By this point the domain name MUST be known (provided by the user, or discovered in Step 2a). Call:
Constraint: This skill only supports enabling full log (enable-web-access-log-config). Disabling is not permitted via this skill. Never call disable-web-access-log-config.
[IMPORTANT] Error Handling for Enable: If enable-web-access-log-config returns an error:
DomainDoNotBelongToYou — Domain is not configured in this DDoS Pro instance. Verify the domain belongs to this instance, or try the other region (cn-hangzhou ↔ ap-southeast-1).
403 Forbidden / RAM permission error — See references/ram-policies.md.
[IMPORTANT] Historical Logs: Enabling full log only records future requests. If the block event occurred before enabling, no SLS log will exist for that Request ID. Inform the user: "Full log has been enabled, but the historical block event cannot be queried via SLS. Please reproduce the block and retry with the new Request ID."
Step 3: Query SLS Logs
[MUST] Use the SLS CLI plugin (aliyun sls get-logs) for all log queries.
Use the SLS project/logstore obtained from Step 2 to query block logs:
China Mainland instances (cn-hangzhou): SLS project is in cn-hangzhou
International instances (ap-southeast-1): SLS project is also typically in cn-hangzhou (not ap-southeast-1), with project names like ddosdip-project-<uid>-ap-southeast-1
[MUST] Do NOT guess SLS project names. Always use the exact project/logstore values obtained from Step 2b (describe-sls-logstore-info or its fallback). If both APIs failed, use aliyun sls list-project --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query to discover projects containing ddoscoo or ddosdip.
Step 4: Query Rule Details
After obtaining the SLS log, extract key fields to determine the block type and query the specific rule configuration.
Step 4a: Identify Block Type from Log Fields
The two most important log fields for identifying the block type are:
cc_phase — Identifies which protection module triggered the block
last_owner — Format is <rule_name>|<source>, where source is manual (user-created) or clover (auto-generated)
cc_phase → Block Type → Query API Mapping:
cc_phase value
Block Type
Rule Detail Query Command
gfcc / cc
CC Protection (频率控制自定义规则)
describe-web-cc-rules-v2
gfacl / acl
Precise Access Control (精确访问控制)
describe-web-precise-access-rule
gfai / ai
AI Smart Protection (AI智能防护)
describe-web-cc-protect-switch
gfglobal / global / gf_rule
Global Defense Policy (全局防护策略)
describe-l7-global-rule
gfbwip / blacklist
IP Blacklist (IP黑名单)
describe-web-rules (BlackList field)
gfareaban / region / geo
Region Blocking (区域封禁)
describe-web-area-block-configs
Other useful log fields:
Log Field
Description
cc_action
Action taken: block, captcha, close, watch
cc_rule_id
Specific rule ID that triggered
cc_blocks
Whether the request was blocked (1 = yes)
final_action
Final action taken on the request
final_plugin
Block plugin identifier
traceid
Request trace ID (same as Request ID in block page)
matched_host
The domain that matched the request
host
The Host header from the request
real_client_ip
Client's real IP address
last_owner
<rule_name>|<source> — identifies which rule and its origin
isp_line
DDoS Pro 接入线路（如：电信、联通、移动、香港、海外等）。注意：此字段反映的是 DDoS Pro 的接入线路，不等同于客户端的物理位置。报告中应表述为"请求经由 {isp_line} 线路接入"，不可将其直接等同于客户端所在地区
Step 4b: Query Strategy Switch Status (策略预检)
[MUST] Before querying specific rules, first check which protection modules are enabled:
Based on cc_phase, call the corresponding API to fetch the rule configuration.
If cc_phase = cc → CC Protection Rules:
bash
# Query all CC rules for the domain; use --owner manual for user rules, clover for auto rules
aliyun ddoscoo describe-web-cc-rules-v2 --domain '<domain>' --offset 0 --page-size 30 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
Then find the specific rule by matching last_owner's rule name (the part before |) against the rule's name field in the response.
If cc_phase = gfacl → Precise Access Control (ACL) Rules:
Then find the specific rule by matching last_owner's rule name against the rule's Name field in the response.
If cc_phase = ai → AI Smart Protection:
bash
# AI protection has no individual rules; check mode and level from switch status
aliyun ddoscoo describe-web-cc-protect-switch --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
Report the AiMode (watch/defense), AiTemplate (level30/60/90), and AiRuleEnable status.
If cc_phase = global or gf_rule → Global Defense Policy:
bash
# Get global rule list with RuleId, Action, Enabled, Description
aliyun ddoscoo describe-l7-global-rule --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
If cc_phase = blacklist → IP Blacklist/Whitelist:
bash
# Get blacklist and whitelist IPs from domain web rules
aliyun ddoscoo describe-web-rules --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
Extract BlackList and WhiteList arrays from the response.
[IMPORTANT] Domain Not Found: If the domain query returns DomainNotExist, the domain may have been removed from DDoS Pro after the block event. Report this to the user — the log is still valid but rule details cannot be retrieved.
See references/domain-security-policy.md for the complete domain security policy management reference including rule creation, modification, deletion, and field reference tables.
Step 5: Output Analysis Report
[MUST] Sensitive Data Masking — Apply the global masking rules defined in Core Workflow to all fields in this report, including any supplementary paragraphs. Never restore masked data in any section.
markdown
## DDoS Pro Intercept Analysis Report
### Request Information
- Request ID: {request_traceid}
- Block Time: {time}
- Client IP: {masked_real_client_ip, e.g. 192.***.***.***}
- ISP Line: {isp_line}（DDoS Pro 接入线路，非客户端实际位置）
- Domain: {matched_host}
- Request URL: {host}{request_path}?{masked_query_params}
### Block Details
- Rule ID: {final_rule_id 或 cc_rule_id；若日志中两个字段均不存在，输出 "N/A - 日志中未记录规则 ID"，不可省略此行}
- Block Type: {final_plugin / cc_phase}
- Action: {final_action or cc_action}
### Recommendations
{Based on block type, refer to references/common-block-reasons.md}
