01 · Operator
Who operates AliyunSecBot
- Company
- Alibaba Cloud
- Type
- Monitoring bot
- Official docs
- knownagents.com
02 · Behavior
What AliyunSecBot does
AliyunSecBot requests pages to look for security weaknesses, threats or compliance issues. It may probe sensitive paths such as login pages and API endpoints. Scan frequency depends on how the scan was configured.
03 · Impact
Why AliyunSecBot matters for your site
If you allow it
- Scans can be part of security services for Alibaba Cloud customers
- Probing is usually light
If you block it
- Probes login and API paths
- No public verification method
- Offers no visibility benefit
04 · Allow
How to allow AliyunSecBot
robots.txt
User-agent: AliyunSecBot
Allow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "AliyunSecBot")
Action: Skip › All Super Bot Fight Mode rules
# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.WordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: AliyunSecBot
Allow: /nginx
# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "AliyunSecBot") { return 403; }Apache
# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} AliyunSecBot [NC]
# RewriteRule .* - [F,L]05 · Block
How to block AliyunSecBot
Start with robots.txt. If AliyunSecBot keeps showing up in your logs, block it at your CDN or web server.
robots.txt
User-agent: AliyunSecBot
Disallow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "AliyunSecBot")
Action: BlockWordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: AliyunSecBot
Disallow: /nginx
# In your server { } block:
if ($http_user_agent ~* "AliyunSecBot") {
return 403;
}Apache
# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} AliyunSecBot [NC]
RewriteRule .* - [F,L]
</IfModule>06 · User agents
User agents we see for AliyunSecBot
The user agent published by the operator:
AliyunSecBot/Aliyun (AliyunSecBot@service.alibaba.com)07 · Verification
Is it really AliyunSecBot?
AliyunSecBot’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.
FAQ
Questions about AliyunSecBot
Who runs AliyunSecBot?
AliyunSecBot is operated by Alibaba Cloud, also known as Aliyun.
Why does AliyunSecBot request my login page?
It is a security scanner. It checks sensitive paths such as login pages and API endpoints for vulnerabilities.
How do I block AliyunSecBot?
Add 'User-agent: AliyunSecBot' and 'Disallow: /' to robots.txt, or block the user agent at your server or firewall.
Last reviewed Oct 7, 2026