Safe Official docs Cloud Services

AliyunSecBot

Q: What is the official user-agent string for AliyunSecBot?

The official user-agent string for AliyunSecBot is: AliyunSecBot . This is the exact string you must use in robots.txt, Nginx, Apache, or Cloudflare firewall rules to target this bot. User-agent matching in robots.txt is case-insensitive, but the string must be spelled correctly. You can verify that a request genuinely comes from AliyunSecBot by performing a reverse-DNS lookup on the source IP - legitimate bots resolve back to their operator's domain.

Q: Is AliyunSecBot safe?

Yes, AliyunSecBot is a safe and legitimate crawler. It is operated by Alibaba Cloud, which publicly documents its crawler at an official URL and follows the Robots Exclusion Protocol (RFC 9309). The user-agent string AliyunSecBot is verifiable via reverse-DNS lookup on the crawling IP addresses. You can safely allow it unless you have a specific reason to block (e.g., AI training opt-out or SEO tool visibility).

Q: Will blocking AliyunSecBot hurt my SEO?

❓ Impact Unknown - The SEO consequences of blocking AliyunSecBot are not fully documented. Before blocking, check your analytics to confirm whether this bot generates referral traffic, review your server logs for crawl frequency, and test in a staging environment if possible.

Q: How do I block AliyunSecBot in robots.txt?

Add the following lines to your /robots.txt file: User-agent: AliyunSecBot Disallow: / This instructs AliyunSecBot not to crawl any path on your site. The Disallow: / directive covers the entire domain including subfolders. To only block specific sections, replace / with the path (e.g., Disallow: /blog/ ). Note: robots.txt is publicly readable - any bot or human can inspect it at yourdomain.com/robots.txt .

Q: How do I verify if AliyunSecBot is crawling my site?

Search your web server access logs for the string AliyunSecBot (case-insensitive grep: grep -i "AliyunSecBot" /var/log/nginx/access.log ). You can also check Google Search Console → Coverage → Crawl Stats for Googlebot variants. For AliyunSecBot specifically, filter by user-agent in your log analysis tool (GoAccess, AWStats, etc.).

Operated by Alibaba Cloud

Scout's quick take

AliyunSecBot does not publish a clear purpose. Check your logs for how often it visits before deciding.

# Block only if you really mean to
User-agent: AliyunSecBot
Disallow: /

See which AI bots are blocked Build a full robots.txt

Quick Facts

User-Agent:: AliyunSecBot
Category:: Cloud Services
Operator:: Alibaba Cloud
Safety:: Safe
Blocking Impact:: Varies - Evaluate before blocking
SEO Impact Score:: 0/10
Official docs:: help.aliyun.com

Confirmed by the operator

Alibaba Cloud names AliyunSecBot on its own documentation page, linked above. The token, purpose and robots.txt behaviour on this profile come from that page, re-checked on October 19, 2026.

What is AliyunSecBot?

AliyunSecBot is a security crawler from Alibaba Cloud (Aliyun), used to scan for vulnerabilities or malicious content.

AliyunSecBot is a security crawler from Alibaba Cloud (Aliyun), used to scan for vulnerabilities or malicious content.
AliyunSecBot is operated by Alibaba Cloud as part of their cloud infrastructure stack. It may perform security scanning, CDN pre-warming, or threat intelligence collection. It uses the user-agent AliyunSecBot. Evaluate whether your site uses Alibaba Cloud services before blocking, as this crawler may be required for service functionality.

What happens if you block AliyunSecBot?

❓ Impact Unknown - The SEO consequences of blocking AliyunSecBot are not fully documented. Before blocking, check your analytics to confirm whether this bot generates referral traffic, review your server logs for crawl frequency, and test in a staging environment if possible.

Generally safe to allow; provides legitimate crawling value.

How to block AliyunSecBot with robots.txt

<code>User-agent: AliyunSecBot</code> - Matching is case-insensitive. Robots.txt is fetched from the root of each subdomain separately.

Block completely (robots.txt)

User-agent: AliyunSecBot
Disallow: /

Allow all (robots.txt)

User-agent: AliyunSecBot
Allow: /

Block private only (robots.txt)

User-agent: AliyunSecBot
Disallow: /private/
Disallow: /api/
Disallow: /admin/
Allow: /

Nginx server block

# Nginx: Hard-block AliyunSecBot
if ($http_user_agent ~* "AliyunSecBot") {
    return 403 "Bot blocked";
}

Apache .htaccess

# Apache: Hard-block AliyunSecBot
SetEnvIfNoCase User-Agent "AliyunSecBot" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_bot

Meta robots tag

X-Robots-Tag header

X-Robots-Tag: noindex, nofollow

Is AliyunSecBot safe to allow?

Yes, AliyunSecBot is a safe and legitimate crawler. It is operated by Alibaba Cloud, which publicly documents its crawler at an official URL and follows the Robots Exclusion Protocol (RFC 9309). The user-agent string AliyunSecBot is verifiable via reverse-DNS lookup on the crawling IP addresses. You can safely allow it unless you have a specific reason to block (e.g., AI training opt-out or SEO tool visibility).

Verify by reverse-DNS lookup: legitimate AliyunSecBot requests resolve to alibaba-cloud's domain.

What does AliyunSecBot do?

Understanding AliyunSecBot's purpose helps you decide whether to allow or block it.

Monitors website uptime and performance
Provides cloud-based analytics and insights
May be part of CDN or security services
Performs health checks and availability tests
Supports infrastructure and DevOps tools

AliyunSecBot in context

AliyunSecBot is a utility crawler operated by Alibaba Cloud. In plain terms, it checks pages for an SEO, uptime or analytics service. Our database files it under cloud services and ranks it Tier 6, the lowest priority: scrapers and tools that offer most sites little or nothing. 1 of the 3 cloud services in our database share this tier.

Its safety rating is safe and its blocking impact is not documented. So the decision about AliyunSecBot rests on what you want from Alibaba Cloud, not on its behaviour. How we rate safety and impact.

How site owners treat AliyunSecBot

Our robots.txt study of the Tranco top 10,000 did not track AliyunSecBot as a named token, so we do not publish an adoption figure for it. If you run a large site, your own logs are the best evidence of how often it visits.

Does it follow robots.txt?

AliyunSecBot's operator does not clearly document how it treats robots.txt. Write the AliyunSecBot rule anyway, then confirm in your logs that its requests stop.

Alibaba Cloud crawlers and close alternatives

Alibaba Cloud runs only this one crawler in our database, so a single User-agent: AliyunSecBot group controls everything Alibaba Cloud fetches through it.

No other crawler in our cloud services category has exactly the same purpose, which makes AliyunSecBot an unusual case: decide about it on its own merits.

We first recorded AliyunSecBot on March 17, 2026. Alibaba Cloud documents it on help.aliyun.com, and we recheck that page before each release.

Which rule AliyunSecBot actually follows

AliyunSecBot reads exactly one group in robots.txt, the most specific one that names AliyunSecBot, and never combines rules across groups. This short file shows the trap:

User-agent: *
Disallow: /private/

User-agent: AliyunSecBot
Disallow: /drafts/

Find the group. AliyunSecBot looks for a group naming AliyunSecBot. One exists, so it ignores User-agent: * completely.
Apply only that group. It is refused /drafts/ and nothing else.
The surprise. /private/ is open to AliyunSecBot, because that rule lives in the * group it no longer reads. To keep it out of both, repeat Disallow: /private/ inside its own group.

Test yourself: does a rule under User-agent: * apply to AliyunSecBot if the file also has a User-agent: AliyunSecBot group?

No. Once a group names it, AliyunSecBot reads only that group. Put every rule you want it to follow inside its own group.

Test yourself: will blocking AliyunSecBot remove your pages from AI answers?

Often, yes. AliyunSecBot is a utility crawler, so pages it cannot fetch can drop out of the answers or results it supports.

Test yourself: is User-agent: aliyunsecbot the same as User-agent: AliyunSecBot?

Yes. RFC 9309 makes user-agent matching case-insensitive. Paths are a different story: Disallow: /Blog/ does not block /blog/.

Should you allow AliyunSecBot? Decide by situation

Recommended setting for AliyunSecBot by type of site
If you are...	Recommended setting
You publish content and want AI answers to cite it	Low stakes either way. It does not decide whether AI answers cite you.
You license content and want to stop AI training	Blocking it does not stop training, because AliyunSecBot is a utility crawler. Block the operator's training crawler instead.
You run an online shop	Allow it unless your logs show it is costly.
Your server is under load from bots	Rate-limit before blocking. It is rated safe in our database.

Check AliyunSecBot on your own site

Open /robots.txt on your domain and search for AliyunSecBot. If it is not named, it follows User-agent: *.
List the Disallow lines in the group AliyunSecBot follows and test your key URLs against them; the longest match wins, and Allow wins a tie.
Look beyond the file. A firewall or bot manager can refuse AliyunSecBot even when robots.txt allows it, and that never shows in the file.
Run our AI crawler access test to see how AliyunSecBot and every other crawler we track are treated in one pass, including firewall refusals.

Common mistakes with AliyunSecBot

The errors we see most often with AliyunSecBot in the files and firewalls we test:

Treating AliyunSecBot as an AI or search crawler. Blocking it has little effect on visibility; decide based on load and what it does with your data.
Relying on robots.txt alone when AliyunSecBot is rated caution or aggressive. Back the rule with a server-side block.
Blocking AliyunSecBot by IP alone. Ranges change; match the token and verify with logs.

All three hide inside a file that looks correct, so check AliyunSecBot from outside after every change.

Spotting AliyunSecBot in your logs

robots.txt says what AliyunSecBot may do; your access logs show what it actually did.

Count requests

On a server with standard Nginx or Apache logs, this counts matching requests per day (adjust the log path for your host):

grep -iE "AliyunSecBot" /var/log/nginx/access.log \
  | awk '{print $4}' | cut -d: -f1 | sort | uniq -c

And this shows which paths it requested most, which is the quickest way to see whether your Disallow lines are being respected:

grep -iE "AliyunSecBot" /var/log/nginx/access.log \
  | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Check the requests are genuine

Anyone can send the AliyunSecBot user-agent, so confirm the source before acting on a match:

AliyunSecBot: we hold no published IP list, so use reverse DNS where the operator documents a hostname and treat an unverifiable AliyunSecBot request with caution.

Frequently Asked Questions

What is the official user-agent string for AliyunSecBot?

The official user-agent string for AliyunSecBot is: AliyunSecBot. This is the exact string you must use in robots.txt, Nginx, Apache, or Cloudflare firewall rules to target this bot. User-agent matching in robots.txt is case-insensitive, but the string must be spelled correctly. You can verify that a request genuinely comes from AliyunSecBot by performing a reverse-DNS lookup on the source IP - legitimate bots resolve back to their operator's domain.

Is AliyunSecBot safe?

Will blocking AliyunSecBot hurt my SEO?

How do I block AliyunSecBot in robots.txt?

Add the following lines to your /robots.txt file:

User-agent: AliyunSecBot
Disallow: /

This instructs AliyunSecBot not to crawl any path on your site. The Disallow: / directive covers the entire domain including subfolders. To only block specific sections, replace / with the path (e.g., Disallow: /blog/). Note: robots.txt is publicly readable - any bot or human can inspect it at yourdomain.com/robots.txt.

Does AliyunSecBot respect robots.txt?

Yes - AliyunSecBot is a well-behaved bot operated by Alibaba Cloud. It fetches and parses /robots.txt before crawling any page, following RFC 9309.

How do I verify if AliyunSecBot is crawling my site?

Search your web server access logs for the string AliyunSecBot (case-insensitive grep: grep -i "AliyunSecBot" /var/log/nginx/access.log). You can also check Google Search Console → Coverage → Crawl Stats for Googlebot variants. For AliyunSecBot specifically, filter by user-agent in your log analysis tool (GoAccess, AWStats, etc.).

What is the crawl frequency of AliyunSecBot?

AliyunSecBot crawls at a moderate rate. If you notice excessive traffic in your logs, you can add a Crawl-delay directive:

User-agent: AliyunSecBot
Crawl-delay: 10

(10 second delay between requests).

Can I block AliyunSecBot from specific pages only?

Yes. Instead of a global Disallow: / you can restrict AliyunSecBot to specific paths:

User-agent: AliyunSecBot
Disallow: /private/
Disallow: /staging/
Allow: /

This allows AliyunSecBot everywhere except the listed paths. Path matching in robots.txt uses prefix matching - Disallow: /private/ blocks /private/page.html but NOT /public/private/.