wanwang.aliyun.com - suspicious URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned wanwang.aliyun.com and returned a suspicious verdict (score 46). The page resolved to 47.246.41.177 on Alibaba Cloud LLC in AU. The domain was registered 6902 days ago through Alibaba Cloud Computing (Beijing) Co., Ltd.. 16 domains and 3 IPs were contacted, over 12 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 2 redirects before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 46) · Confidence 52%
- Scanned URL:
http://gysanya.com/upload/file/210923075554044229ug8gs99ljfb9.pdf - Domain: wanwang.aliyun.com · IP: 47.246.41.177 · AS24429 · AU
- Server: Tengine
- Page title: 阿里云万网虚机手工关停页面
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd. · domain age 6902 days · created 2007-09-28
- HTTP requests captured: 12
- Scan tier: fast · observed 2026-08-22 04:46:44 UTC
Redirect chain
http://gysanya.com/upload/file/210923075554044229ug8gs99ljfb9.pdfhttp://wanwang.aliyun.com/hosting/manual_stop/https://wanwang.aliyun.com/hosting/manual_stop/
Malware communicating with this URL (1)
These samples were observed contacting or being served from wanwang.aliyun.com. Each links to its full analysis.
- Phishing - referenced ·
528b2e1474c63eee7f0b493a6bf4b6c2· first seen 2026-08-22
Antivirus & YARA (1 of 48 engines)
- YARA: Yara-Rules community [yara]: YR_Packer_ASPack_MPRESS (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Antivirus/YARA detection in page content: YR_Packer_ASPack_MPRESS
- Cross-host redirect chain
Detected technologies
- React
- jQuery
Contacted infrastructure
- 47.246.41.177 - AS24429 Alibaba Cloud LLC (Australia)
- 139.129.175.169 - AS37963 Aliyun Computing Co., LTD (China)
- 47.246.41.174 - AS24429 Alibaba Cloud LLC (Australia)
Observed indicators
- wanwang.aliyun.com
- img.alicdn.com
- g.alicdn.com
- gw.alicdn.com
- gm.mmstat.com
- log.mmstat.com
- query.aliyun.com
- at.alicdn.com
- www.aliyun.com
- www.qianwenai.com
- market.aliyun.com
- partner.aliyun.com
- help.aliyun.com
- beian.aliyun.com
- home.console.aliyun.com
- cloud-assets.alicdn.com
- 47.246.41.177
- 139.129.175.169
- 47.246.41.174
- https://wanwang.aliyun.com/hosting/manual_stop/
Other scans of wanwang.aliyun.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/stop_flow/ - 22 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 20 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 19 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop - 19 Aug 2026 - unknown ·
https://wanwang.aliyun.com/hosting/ipvisit_stop
Questions about wanwang.aliyun.com
- Is wanwang.aliyun.com safe?
- No. MalwareAnalyzer scanned wanwang.aliyun.com on 22 Aug 2026 and returned a suspicious verdict with a score of 46 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with wanwang.aliyun.com?
- 1 analysed samples communicate with this URL, including Phishing.
- How was wanwang.aliyun.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of wanwang.aliyun.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan