Yandex outage: data shows that instead of going dark, malicious bots moved(blog.cloudflare.com) |
Yandex outage: data shows that instead of going dark, malicious bots moved(blog.cloudflare.com) |
>across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet.
This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.
Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.
And I doubt they have visibility on the most popular social networks.
The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).
You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.
I don't really trust Cloudflare to be a good steward when discussing this since they have a sordid history in protecting hate.
Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.
https://x.com/cloudflareradar/status/2108122893028671604
https://x.com/CloudflareRadar/status/2110113211059994638
Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.
This is how "news" and "facts" work in 2026.
???
>"Bot traffic" refers to [...], not necessarily activity on social media platforms.
I guess they could have been more explicit and straight up said "no, that doesn't mean russian trolls are offline", but their tweet isn't ambiguous.
https://www.tomshardware.com/tech-industry/data-centers/russ...
The word "disinformation" doesn't show up in the post, only in the URL.
> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN
But the memes keep rolling. 57 channels and nothing on.
cloudflare have zero capabilities to detect mobile farms using sim cards etc. which is what is used for expensive social media manipulation.
AWS abandoned Bahrain as a region completely after data center strikes. All Infra went to the scrap
Both were struck over half a year ago and me-south-01 (Bahrain) appears to be gone permanently, while the data loss in me-central-01 (UAE) is limited to one of the availability zones.
Whereas social media users are talking about an entirely different type of bot which is injecting manufactured discourse into people's feeds.
# nginx rule to Awaken AWS GuardDuty and GCP SCC, maybe get them to fix a few VMs, enable on all non-wordpress sites after testing in dev/qa
location ~* /(xmlrpc|wp-login\.php|wp-admin) { log_not_found off; access_log off; return 301 http://169.254.169.254$request_uri; } location ~* /(xmlrpc|wp-login\.php|wp-admin) { set $ban 1; return 444 ''; }
# grep banip /etc/nginx.conf
log_format banip '$remote_addr';
# grep banip /etc/nginx/http.d/some-server.conf
access_log /var/log/nginx/ban.log banip if=$ban;For those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now even when they are properly instrumenting Headless Chrome. Only I see Статуя Свободы мертва.
Easy hypothesis would be that they were (probably accidentally) reliant on the news scraping bots to find where to focus responses and such. Would be like realizing a lot of US things do down when AWS' us-east goes down. It isn't literally where everything is hosted. A lot of things have accidental dependencies that go through there, though.
There is certainly information warfare happening, but it doesn’t appear that this is the likely host—or perhaps they have good redundancy.
"Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."
Why does my brain refuse to continue reading after this point?
I feel like if us-east-1 was down for a week we’d see all kinds of consequences in everyday services. Are Russians enjoying the same?
First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.
Plus, from my personal experience cloud is not as popular in Russia as in the west.
Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.
Small players use vps or something similar.
Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.
>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.
If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.
because Ukraine could offer datacenter-denial as a service
I doubt Yandex would ever be able to leave Russia, even if it wanted to.