>across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet.
This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.
Does Cloudflare have much if anything to do with X/Twitter and Facebook/Instagram and TikTok, or even Reddit?
Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.
And I doubt they have visibility on the most popular social networks.
The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).
You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.
Anyone that actually uses Cloudflare and manages their own bot traffic saw those graphs getting passed around and cringed. It has been an interesting thing to watch though as it was disseminated, echoed, and remixed with all sorts of "evidence" of this or that engagement dropping.
Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.
> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN
But the memes keep rolling. 57 channels and nothing on.
Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.
Yeah, it contradicted my intuition as a developer. If you take down a data center it isn't gone forever. The development team does not live there. Even if it's poorly backed up they're going to rebuild it.
Both were struck over half a year ago and me-south-01 (Bahrain) appears to be gone permanently, while the data loss in me-central-01 (UAE) is limited to one of the availability zones.
I don’t think many people were believing it was solved forever but just that there was a momentary disruption/decrease while they rebuilt it. But according to this report, even that impact was highly exaggerated.
I am in a couple political discussion groups and it was really curious how the traditional right-wing posters sort of disappeared right around the same time. There are several that people had suspected of being some type of plant that just were suddenly not posting any more and still haven't come back. No idea if it was related but the timing was so close that it raised a few eyebrows.
Just anecdotally I still see as many bots as always. Embrace the bots, have fun with them.
# nginx rule to Awaken AWS GuardDuty and GCP SCC, maybe get them to fix a few VMs, enable on all non-wordpress sites after testing in dev/qa
location ~* /(xmlrpc|wp-login\.php|wp-admin) { log_not_found off; access_log off; return 301 http://169.254.169.254$request_uri; }
There are different kinds of bots. The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites. Bots that are just trying generic hacks are more likely to be much more widely distributed, because not every country is trying to hack the US psyche.
The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites.
For those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now.
Incidentally, this morning I asked Gemini Argon 4 on High to do deep research on the effect of the strikes on russian bot farms and after some hours (it got stuck) it generated the report starting with a surprising (to me at the time) paragraph:
"Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."
Most social media bots are not hosted in datacenters. They are run on racks of mobile phones on regular cellular networks. Using real phones and residential IPs makes them harder to detect. These are often hosted around the world so they can appear as in your country while being remote controlled from Russia.
>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.
First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.
Plus, from my personal experience cloud is not as popular in Russia as in the west.
Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.
Small players use vps or something similar.
Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.
I cannot get it to return anything more than 10 results. Might be a design choice. Possibly for mobile. It’s certainly cleaner than the American options that way.
Confusing crawlbots for spambots missed the far bigger story: Russian government has encouraged adoption of digital services and centralization of them into a small number of handpicked "winners", who form the backbone of state surveillance system. This made the modern infrastructure a very attractive target. Ukrainian strikes on the datacenters are comparable to AWS, Google, Stripe and Dropbox going down, with no timeline when the services would be restored. It's been a week and Yandex still shows everything in red: https://status.yandex.cloud/en/dashboard
I don't understand why they are just starting with the assumption that all of the bot traffic would just go straight out to the internet from their ASNs
If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.
Buried lede:
>across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet.
This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.
Does Cloudflare have much if anything to do with X/Twitter and Facebook/Instagram and TikTok, or even Reddit?
Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.
And I doubt they have visibility on the most popular social networks.
The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).
You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.
Anyone that actually uses Cloudflare and manages their own bot traffic saw those graphs getting passed around and cringed. It has been an interesting thing to watch though as it was disseminated, echoed, and remixed with all sorts of "evidence" of this or that engagement dropping.
Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.
Additionally,
> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN
But the memes keep rolling. 57 channels and nothing on.
The popular memes that were based on people's assumptions or guesses or stories based on... cloudflare own tweets!
https://x.com/cloudflareradar/status/2108122893028671604
https://x.com/CloudflareRadar/status/2110113211059994638
Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.
This is how "news" and "facts" work in 2026.
>The popular memes that were based on people's assumptions or guesses or stories based on... cloudflare own tweets!
???
>"Bot traffic" refers to [...], not necessarily activity on social media platforms.
I guess they could have been more explicit and straight up said "no, that doesn't mean russian trolls are offline", but their tweet isn't ambiguous.
The clarifying tweet you're quoting was posted 5 days after the first tweet.
The first tweet doesn't even mention anything about bots.
I mostly saw the tomshardware.com link being the cause:
https://www.tomshardware.com/tech-industry/data-centers/russ...
The word "disinformation" doesn't show up in the post, only in the URL.
Yeah, it contradicted my intuition as a developer. If you take down a data center it isn't gone forever. The development team does not live there. Even if it's poorly backed up they're going to rebuild it.
> If you take down a data center it isn't gone forever.
AWS abandoned Bahrain as a region completely after data center strikes. All Infra went to the scrap
Counter-argument: https://health.aws.amazon.com/health/status
Both were struck over half a year ago and me-south-01 (Bahrain) appears to be gone permanently, while the data loss in me-central-01 (UAE) is limited to one of the availability zones.
I don’t think many people were believing it was solved forever but just that there was a momentary disruption/decrease while they rebuilt it. But according to this report, even that impact was highly exaggerated.
Most people making memes never built multicloud or across geo regions
I am in a couple political discussion groups and it was really curious how the traditional right-wing posters sort of disappeared right around the same time. There are several that people had suspected of being some type of plant that just were suddenly not posting any more and still haven't come back. No idea if it was related but the timing was so close that it raised a few eyebrows.
Just anecdotally I still see as many bots as always. Embrace the bots, have fun with them.
I really ought to do something like this rather than just allowing our logs to endlessly fill with requests for wp-admin.
<send friend request>
There are different kinds of bots. The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites. Bots that are just trying generic hacks are more likely to be much more widely distributed, because not every country is trying to hack the US psyche.
The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites.
For those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now.
Incidentally, this morning I asked Gemini Argon 4 on High to do deep research on the effect of the strikes on russian bot farms and after some hours (it got stuck) it generated the report starting with a surprising (to me at the time) paragraph:
"Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."
That's funny, this afternoon I asked Claude to think very hard about your comment, and it said you trust LLMs too much.
Most Russian bots have a better reputation for fact-checking than Gemini, mate
I thought it was established that those were search engine crawlers...
What other providers did they shift to? So we can block them?
Most social media bots are not hosted in datacenters. They are run on racks of mobile phones on regular cellular networks. Using real phones and residential IPs makes them harder to detect. These are often hosted around the world so they can appear as in your country while being remote controlled from Russia.
From the article:
>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.
What if they moved to AWS?
Two hosts they name in the post are Radist and Selectel
Residential proxies
What I’m far more interested in is what the consequences of Yandex cloud being offline are.
I feel like if us-east-1 was down for a week we’d see all kinds of consequences in everyday services. Are Russians enjoying the same?
Yandex cloud is not as big as AWS.
First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.
Plus, from my personal experience cloud is not as popular in Russia as in the west.
Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.
Small players use vps or something similar.
Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.
No. Some consequences lasted for a few days. It’s all fine now.
yandex.com's search results are currently only showing a single page of 10 results.
Works fine for me ("test" returned 5 pages). But try https://ya.ru too, for example.
I cannot get it to return anything more than 10 results. Might be a design choice. Possibly for mobile. It’s certainly cleaner than the American options that way.
Wouldn't it be easier to figure out where the bots originate now?
Confusing crawlbots for spambots missed the far bigger story: Russian government has encouraged adoption of digital services and centralization of them into a small number of handpicked "winners", who form the backbone of state surveillance system. This made the modern infrastructure a very attractive target. Ukrainian strikes on the datacenters are comparable to AWS, Google, Stripe and Dropbox going down, with no timeline when the services would be restored. It's been a week and Yandex still shows everything in red: https://status.yandex.cloud/en/dashboard
I don't understand why they are just starting with the assumption that all of the bot traffic would just go straight out to the internet from their ASNs
If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.
Do you think at this point you’re just looking for reasons to believe?
Would have been helpful if all these cloud corps had multiple ASNs.
I guess Ukraine has more work to do to cull the trolls.
are these "alternate cloud providers" inside Russia?
because Ukraine could offer datacenter-denial as a service