General Discussion - Alibaba Cloud LLC attack

Alibaba Cloud LLC attack

Printed From: Web Wiz Forums
Category: General Discussion
Forum Name: General Discussion
Forum Description: General discussion and chat on any topic.
URL: https://forums.webwiz.net/forum_posts.asp?TID=31827
Printed Date: 27 March 2026 at 9:22pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: Alibaba Cloud LLC attack

Posted By: Roberto Randall
Subject: Alibaba Cloud LLC attack
Date Posted: 22 May 2025 at 3:09pm

For months, "Alibaba Cloud LLC" has been blocking my server, overloading my CPU for hours. It's an attack targeting hundreds of IP addresses at the same time. I put IP addresses in the firewall, and more "Alibaba Cloud LLC" IP addresses appear.

I've written to them many times, and they ignore them. Does anyone know who they are and why they're blocking servers? How can "Alibaba Cloud LLC" be stopped in one fell swoop?

When I look at where "Alibaba Cloud LLC" is listed, almost everything says "Error 404. Page not found."

I've searched the web and all I find is a bunch of people experiencing the same "Alibaba Cloud LLC" attack.

Thank you,

-------------
https://www.lanocion.es - https://www.lanocion.games - https://www.lanocion.chat

Replies:

Posted By: Roberto Randall
Date Posted: 22 May 2025 at 3:46pm

All these IPs are from "Alibaba Cloud" and they all entered the web at the same time:

8.210.176.195, 8.210.179.35, 8.210.189.26, 8.210.190.0, 8.210.190.63, 8.217.49.186, 8.217.83.244, 8.217.104.47, 47.76.162.83, 47.76.189.187, 47.76.216.48, 47.76.220.119, 47.76.222.244, 47.76.241.126, 47.76.242.106, 47.76.242.151, 47.79.192.50, 47.79.192.80, 47.79.192.100, 47.79.192.130, 47.79.192.140, 47.79.192.162, 47.79.192.185, 47.79.192.190, 47.79.192.207, 47.79.192.224, 47.79.192.228, 47.79.192.237, 47.79.192.240, 47.79.192.254, 47.79.193.57, 47.79.193.75, 47.79.193.101, 47.79.193.144, 47.79.193.146, 47.79.193.162, 47.79.193.174, 47.79.193.204, 47.79.193.217, 47.79.193.245, 47.79.193.253, 47.79.193.254, 47.79.194.14, 47.79.194.30, 47.79.194.90, 47.79.194.97, 47.79.194.231, 47.79.195.18, 47.79.195.36, 47.79.195.88, 47.79.195.105, 47.79.195.151, 47.79.195.162, 47.79.195.169, 47.79.195.179, 47.79.195.186, 47.79.195.224, 47.79.196.16, 47.79.196.29, 47.79.196.67, 47.79.196.70, 47.79.196.118, 47.79.196.181, 47.79.196.241, 47.79.197.17, 47.79.197.20, 47.79.197.28, 47.79.197.37, 47.79.197.39, 47.79.197.62, 47.79.197.69, 47.79.197.74, 47.79.197.75, 47.79.197.97, 47.79.197.157, 47.79.197.184, 47.79.197.211, 47.79.197.230, 47.79.197.233, 47.79.198.40, 47.79.198.70, 47.79.198.82, 47.79.198.117, 47.79.198.154, 47.79.198.167, 47.79.198.203, 47.79.199.12, 47.79.199.32, 47.79.199.42, 47.79.199.52, 47.79.199.55, 47.79.199.77, 47.79.199.79, 47.79.199.137, 47.79.199.179, 47.79.200.47, 47.79.200.65, 47.79.200.70, 47.79.200.87, 47.79.200.112, 47.79.200.139, 47.79.200.199, 47.79.200.246, 47.79.201.51, 47.79.201.102, 47.79.201.109, 47.79.201.122, 47.79.201.172, 47.79.201.246, 47.79.202.19, 47.79.202.36, 47.79.202.41, 47.79.202.84, 47.79.202.202, 47.79.202.212, 47.79.202.251, 47.79.203.0, 47.79.203.68, 47.79.203.89, 47.79.203.100, 47.79.203.112, 47.79.203.130, 47.79.203.147, 47.79.203.164, 47.79.203.168, 47.79.203.169, 47.79.204.43, 47.79.204.84, 47.79.204.122, 47.79.204.147, 47.79.204.159, 47.79.204.193, 47.79.204.201, 47.79.204.232, 47.79.204.239, 47.79.205.14, 47.79.205.22, 47.79.205.30, 47.79.205.58, 47.79.205.64, 47.79.205.71, 47.79.205.76, 47.79.205.80, 47.79.205.110, 47.79.205.115, 47.79.205.146, 47.79.205.148, 47.79.205.156, 47.79.205.167, 47.79.205.213, 47.79.205.230, 47.79.206.85, 47.79.206.111, 47.79.206.127, 47.79.206.128, 47.79.206.146, 47.79.206.169, 47.79.206.175, 47.79.206.201, 47.79.206.208, 47.79.206.240, 47.79.207.41, 47.79.207.47, 47.79.207.139, 47.79.207.156, 47.79.207.252, 47.79.212.7, 47.79.212.47, 47.79.212.67, 47.79.212.90, 47.79.212.114, 47.79.212.204, 47.79.212.206, 47.79.212.238, 47.79.213.5, 47.79.213.12, 47.79.213.32, 47.79.213.151, 47.79.213.166, 47.79.213.209, 47.79.213.237, 47.79.214.15, 47.79.214.22, 47.79.214.24, 47.79.214.91, 47.79.214.121, 47.79.214.184, 47.79.214.186, 47.79.214.195, 47.79.214.209, 47.79.214.214, 47.79.215.12, 47.79.215.27, 47.79.215.63, 47.79.215.96, 47.79.215.113, 47.79.215.203, 47.79.215.237, 47.79.215.246, 47.79.216.46, 47.79.216.51, 47.79.216.76, 47.79.216.153, 47.238.14.12

and more keep coming in.

-------------
https://www.lanocion.es - https://www.lanocion.games - https://www.lanocion.chat

Posted By: WebWiz-Bruce
Date Posted: 22 May 2025 at 3:47pm

"Alibaba Cloud LLC" is the Chinese version of AWS or Azure.

What your are seeing is web scraping by AI bots that are being used to train large language models. We have observed these bots targeting many websites within our network, which has led us to block numerous IP ranges associated with Alibaba at our network gateway.

All AI bots exhibit similar behaviour, they tend to access websites rapidly and continuously, causing slow response times for the websites, increased CPU usage, and higher electricity bills as a result. Where possible, we now block all AI bots.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: WebWiz-Bruce
Date Posted: 22 May 2025 at 3:53pm

Most of those IP address are part the same Alibaba range, so you would want to block the IP range below;

47.74.0.0/15

Posted By: Roberto Randall
Date Posted: 22 May 2025 at 4:08pm

Ok, so I put in my firewall: "47.74.0.0/15". Thanks.

And is blocking ports 80 and 443 enough?

-------------
https://www.lanocion.es - https://www.lanocion.games - https://www.lanocion.chat

Posted By: WebWiz-Bruce
Date Posted: 22 May 2025 at 4:23pm

Port 80 and 443 should be enough, although we just block the range for all ports.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: Roberto Randall
Date Posted: 22 May 2025 at 5:07pm

I searched for Alibaba Cloud IPs and found the following to block:

47.74.0.0/15, 47.76.0.0/14, 47.80.0.0/13, 8.210.0.0/16

-------------
https://www.lanocion.es - https://www.lanocion.games - https://www.lanocion.chat

Posted By: WebWiz-Bruce
Date Posted: 22 May 2025 at 5:21pm

You can use our Whois Tool, at the link below, if you put in the IP address it will often show the IP ranges for the IP address;

https://network-tools.webwiz.net/whois-lookup.htm?domain=47%2E79%2E215%2E203" rel="nofollow - https://network-tools.webwiz.net/whois-lookup.htm?domain=47%2E79%2E215%2E203

Posted By: Roberto Randall
Date Posted: 22 May 2025 at 5:43pm

Ok, thanks. I have traced the IPs of "Alibaba Cloud" with the link you have posted and it denied TCP access to: 8.208.0.0/12, 47.74.0.0/15, 47.76.0.0/14, 47.80.0.0/13, 47.235.0.0/16, 47.236.0.0/14, 47.240.0.0/14, 47.244.0.0/15, 47.246.0.0/16, 147.139.0.0/16

Very good page you recommended, I'm adding it to my favorites because I'll use it every time I see an unwanted IP. Thanks again.

-------------
https://www.lanocion.es - https://www.lanocion.games - https://www.lanocion.chat

Posted By: WebWiz-Bruce
Date Posted: 22 May 2025 at 6:02pm

Also bookmark this one as it can give you further information;

https://network-tools.webwiz.net/ip-information.htm" rel="nofollow - https://network-tools.webwiz.net/ip-information.htm