>across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet.
This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.
onlyrealcuzzo 1 days ago [-]
Does Cloudflare have much if anything to do with X/Twitter and Facebook/Instagram and TikTok, or even Reddit?
Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.
And I doubt they have visibility on the most popular social networks.
The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).
You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.
TheOtherHobbes 11 hours ago [-]
The biggest tell is that both Russia and the US panicked and immediately tried to prevent further attacks.
This is the first action that has had that effect. Taking out refineries for month after month produced grumbling. Taking out data centres produced an immediate response.
If the data centres didn't matter, Russia and the Trump people would have shrugged and said "Cute..." and/or repeated their standard rhetoric.
birdsongs 10 hours ago [-]
Right? This is what prompted musk to take down Starlink, after everything else?
Look at what they do, not what they say.
opless 2 hours ago [-]
You mean Trump and star shield, right ?
The two networks are quite different despite SpaceX initially doing the MVP work for it.
birdsongs 1 hours ago [-]
They use both, heavily. An outage, like the one recently, severely affects them.
> In October 2026, George Barros of the Institute for the Study of War said the network had become "the backbone of military communications in Ukraine", used by land, naval and air forces, with both Starlink and Starshield (the US DOD service) used depending on the application.[60]
I'm not sure I see the connection. Ukraine doesn't need Starlink up in order to be able to hit Russian data centers.
shimman 24 hours ago [-]
Yeah weird thing to purport that feels extremely misleading. Suppose one way to find out is to look at accounts that were suspected of high bot activity and see if they got the same amount of engagement as the weeks before the strikes.
I don't really trust Cloudflare to be a good steward when discussing this since they have a sordid history in protecting hate.
gruez 22 hours ago [-]
>Yeah weird thing to purport that feels extremely misleading. Suppose one way to find out is to look at accounts that were suspected of high bot activity and see if they got the same amount of engagement as the weeks before the strikes.
But nobody did that. All we have is a bunch of people on twitter/reddit passing around the same pixelated screenshot from cloudflare, using it to claim that russian bots have been stopped in their tracks.
It seems like they are saying "posts that were posted recently have less views than posts posted before the Yandex strike" which is explained just by time. Did they adjust for the time the posts spent online?
locknitpicker 6 hours ago [-]
> It seems like they are saying "posts that were posted recently have less views than posts posted before the Yandex strike" which is explained just by time.
It doesn't seem you even bothered to read the article. It shows quite clearly that following the strike post from populist far-right figures had literally a residual level of engagement, which includes both views, comments, reposts, likes, etc.
The screenshots clearly show posts preceding the strike showing literally an order of magnitude more comments, reposts, etc.
I'm not personally tracking there metrics, but I'd expect engagement to normalize a few days after the strike as Russia's propaganda arm is expected to scramble to get it's operation back online. Therefore, "just by time" can accommodate for Russia getting their botfarms back online. But the snapshot covered by this article alone are clear and obvious.
ShinyLeftPad 5 hours ago [-]
I read the article and that's why i wrote my comment.
For Tice they show a post with 10k views from october 12 and post with 20k views from october 8. There is also post from october 9 which obviously went viral and has hundreds of thousands views, but that's not itself proof because there's a always variability from the algorithm.
Reshare counts are more interesting, 700 for each of oct 8-9 posts but 50 for each of oct 12 posts, that is less likely if we are talking about just the network effects.
anyway we all know russian bots exist. They basically got trump elected after dorsey sold to musk and musk let them run amok. But this is not hard statistics. if they fixed a time period (like, in 3 days posts used to get N engagement avg, now in 3 days posts get M engagement avg) then it could be actual statistics. and they really need to stress reshare counts.
shimman 5 hours ago [-]
Ah so exactly what you expect, not shocking.
ipaddr 21 hours ago [-]
They also have a virtuous history protecting love.
That's like saying Google protects hate because people who hate you use Google.
When you are colorblind you end up helping everyone even people that hate you.
23 hours ago [-]
leobuskin 24 hours ago [-]
X is under Cloudflare (and according to some of my probes may even use some parts of CF stack)
iririririr 23 hours ago [-]
you're hopeless. if cloudflare could detect these bots, there wouldn't be bots.
infinite_spin 20 hours ago [-]
being able to detect a forest fire doesn't mean we no longer have forest fires
iririririr 6 hours ago [-]
what do you mean? that's literary what detecting a bot does! stop making excuses and believing cloudflare marketing
infinite_spin 33 minutes ago [-]
Detection is not itself a remedy, detection is a signal
jrochkind1 1 days ago [-]
The popular memes that were based on people's assumptions or guesses or stories based on... cloudflare own tweets!
Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.
This is how "news" and "facts" work in 2026.
gruez 1 days ago [-]
>The popular memes that were based on people's assumptions or guesses or stories based on... cloudflare own tweets!
???
>"Bot traffic" refers to [...], not necessarily activity on social media platforms.
I guess they could have been more explicit and straight up said "no, that doesn't mean russian trolls are offline", but their tweet isn't ambiguous.
geoffpado 1 days ago [-]
The clarifying tweet you're quoting was posted 5 days after the first tweet.
gruez 1 days ago [-]
The first tweet doesn't even mention anything about bots.
skybrian 19 hours ago [-]
I don’t see anything vague or misleading about either tweet. I suppose it might be misleading if you don’t know what “bots” means in this context and don’t bother to find out?
captn3m0 1 days ago [-]
I mostly saw the tomshardware.com link being the cause:
The word "disinformation" doesn't show up in the post, only in the URL.
-0_0- 22 hours ago [-]
This was definitely getting shared around Reddit and a majority the comments were drawing assumptions around the headline saying 'bots'. Honestly I made the same mistake until about the third time I saw the headline in a feed and thought "wait, why would social bots be coming from Yandex?"
ksymph 11 hours ago [-]
85k upvotes on /r/technology: "Russian disinformation bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of 'Russia's Google' data centers"
Actual article title: "Russia's Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of 'Russia's Google' data centers"
Anyone that actually uses Cloudflare and manages their own bot traffic saw those graphs getting passed around and cringed. It has been an interesting thing to watch though as it was disseminated, echoed, and remixed with all sorts of "evidence" of this or that engagement dropping.
Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.
throw0101a 12 hours ago [-]
> Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Unless they don't care if you know. Or don't think it matters. Or if they think the targets are too stupid/lazy/busy to bother to examine/notice the evidence.
Modern propaganda techniques pioneered by Russia against its own population don't bother with trying to convince people, versus just overwhelming them:
Thats a bit if a silly analogy isnt it? It would be more correct to say it would be like the NSA/CIA operating out of google datacenters, which they do, extensively.
jmuguy 5 hours ago [-]
Well I think its mostly both we, and the original meme, are mixing up two different things.
I assume, I think correctly, that if you're running some sort of propaganda network you do actually want to appear to be living in/coming from that part of the world. So therefore showing "bot" traffic from the Yandex ASN dropping and correlating that directly with "bot" accounts going silent is incorrect. That "bot" traffic is not the propaganda network, its mostly just Yandex's own web scraping bots (which again, anyone that uses Cloudflare and has managed bots on there would tell you)
Now if you want to say that the infrastructure lives there, and is using proxies, VPN etc to appear to come from somewhere in the USA, Poland, etc - then OK. But that's not what the original meme was attempting to describe.
MiroslavPokorny 22 hours ago [-]
Which is exactly why the US gov wanted "American" control of TikTok
ipaddr 21 hours ago [-]
They wanted control because the Palestinians cause was winning the tiktok war. Controlling cnn, cbs and tiktok will shape those views.
asdf88990 1 days ago [-]
Additionally,
> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN
But the memes keep rolling. 57 channels and nothing on.
asdfman123 1 days ago [-]
Yeah, it contradicted my intuition as a developer. If you take down a data center it isn't gone forever. The development team does not live there. Even if it's poorly backed up they're going to rebuild it.
nixass 1 days ago [-]
> If you take down a data center it isn't gone forever.
AWS abandoned Bahrain as a region completely after data center strikes. All Infra went to the scrap
asdfman123 23 hours ago [-]
Well, yeah. They relocated their data and their services elsewhere. It didn't go away.
I doubt Yandex would ever be able to leave Russia, even if it wanted to.
ithkuil 16 hours ago [-]
Russia is big though
nixass 11 hours ago [-]
So is the range of Ukrainian drones
TheOtherHobbes 11 hours ago [-]
Russia is mostly empty, and the natural ecosystem isn't good at growing server farms.
nixass 11 hours ago [-]
Gulf states are extremely restrictive on data migration to another country. Nothing relocated
robot_jesus 1 days ago [-]
I don’t think many people were believing it was solved forever but just that there was a momentary disruption/decrease while they rebuilt it. But according to this report, even that impact was highly exaggerated.
duskwuff 20 hours ago [-]
> If you take down a data center it isn't gone forever.
Given the active sanctions against Russia, as well as high worldwide prices for components like memory and storage, rebuilding these datacenters is going to be an exceptionally slow and costly process. And I can't imagine Yandex is going to be eager to rebuild immediately given the potential for a "double-tap".
Both were struck over half a year ago and me-south-01 (Bahrain) appears to be gone permanently, while the data loss in me-central-01 (UAE) is limited to one of the availability zones.
Fordec 1 days ago [-]
Most people making memes never built multicloud or across geo regions
mahboi 15 hours ago [-]
I never thought these bot farms operated in datacenters anyway.
mulderc 1 days ago [-]
I am in a couple political discussion groups and it was really curious how the traditional right-wing posters sort of disappeared right around the same time. There are several that people had suspected of being some type of plant that just were suddenly not posting any more and still haven't come back. No idea if it was related but the timing was so close that it raised a few eyebrows.
gruez 22 hours ago [-]
Is there any serious analysis of this? Presumably it wouldn't be hard to do. Find some right wing telegram channels/x accounts/subreddits, whatever, then chart their activity. All the evidence I've seen are people passing around the cloudflare chart.
Moomoomoo309 10 hours ago [-]
The APIs you'd use to get this data have pretty much all been taken down in the last few years. That's why you don't really see social media analysis anymore.
mulderc 19 hours ago [-]
I haven’t seen any, but the people that would have access to that data are probably too busy to care. For example, Political Wire noticed a significant decrease in the right-wing trolls, with one longtime nuisance disappearing completely and the general discussion just being way less divisive. The site is basically run by one guy, and he doesn’t have the time or expertise to do some sort of analysis on this. Also, we aren’t talking about some huge number of people here. It only takes a couple of trolls to ruin an online forum, so if the strikes knocked out only a couple dozen trolls, it could make a noticeable difference in the online discourse while being virtually unnoticeable in the overall data.
magic_quotes 19 hours ago [-]
For what purpose a handful of trolls would require a datacenter? Or any server infrastructure at all, for that matter.
mulderc 16 hours ago [-]
More that the services they were using might have been related to some part of the infrastructure that went offline. Like slack going down.
strogonoff 17 hours ago [-]
Benn Jordan analysed social media bot activity[0] a while back, and if the recent UK right-wing party social media engagement drop[1] after the Ukrainian strike on Yandex data centres is not enough then what is?
[1] very clearly just cherrypicked some particularly popular posts from before the Ukrainian strike, and some particularly unpopular and/or very new posts from after.
Show me some graphs! Some actual data! Not just the 6 exact posts necessary to make the point.
bubbluppugus 22 hours ago [-]
Rhetorical claims that refute isn't really evidence either, just an attempt to null out the prevailing narrative; SEO spam
Elon getting snooty and Starlink issues in Ukraine are just press releases too; how the fuck do we know what anyone actually did? Too many red herrings troubleshooting systems to assume Starlink isn't just glitched sometimes
While I am firmly in the "Ukraine is the good guy" camp generally both sides of a nation state conflict will lie to both deflect blame and project competence and strength. Will give Zelensky benefit of the doubt until he dead or war ends and if he doesn't step aside legally. But he will latch onto headlines to get his message heard even if Ukraine had nothing to do with it.
rightbyte 16 hours ago [-]
I think "pretend believing" lies for the cause is bad for policy on a group scale.
Even if you know they are lies it is probably quite bad to pretend they are not since a group can't pretend to believe something in my opinion.
In aggregate it leads to a chain of decisions that are built upon the lies being true ...
epistasis 24 hours ago [-]
Not really, Cloudflare is talking about a different type of bot, one that scrapes the web.
Whereas social media users are talking about an entirely different type of bot which is injecting manufactured discourse into people's feeds.
felixgallo 24 hours ago [-]
No, it describes that Cloudflare was unable to identify that they have or haven't. The lack of evidence is not proof of absence.
iririririr 23 hours ago [-]
you are basing your assumption on a site that have Zero insight about what they are claiming.
cloudflare have zero capabilities to detect mobile farms using sim cards etc. which is what is used for expensive social media manipulation.
pessimizer 22 hours ago [-]
What the hell would mobile sim card farms have to do with Yandex? You don't even care about the truth.
raizer88 14 hours ago [-]
Because you spread the bots farms in multiple countries and set the command center on the other side of the Cremlin square, than VPN to a Yandex datacenter to coordinate the farms. Kill Yandex and the farms stay idle and the traffic drop.
iririririr 6 hours ago [-]
apparently you're commenting on something you barely have the 90s knowledge. i recommend you do a lot more reading beforehand
Grimblewald 24 hours ago [-]
oh, but they did. Measurably. Comment sentiments shifted drammatically following the post knockout period, especially on topics where comments typically get flooded by what is commonly called a troll account. Take videos covering pro-choice content or other content critical of US right wing talking points, which draw such bots like flies to shit. Post knockout? Near nada on new videos. It went from a sizable chunk of comments (~13%<amount<27%), to a fraction of a single %. That's a non trivial shift. Still looking at data, but something certainly did happen, and I think the memes are likely grounded in truth.
gruez 9 hours ago [-]
Source?
poulpy123 16 hours ago [-]
You don't understand. The US and Europe can't have a massive amount of people disagreeing with the elite, it has to be troll factories by evil Russia and China
Sabinus 15 hours ago [-]
The issue isn't disagreement with the elite. It's that the actual political conversation, the process of disagreeing with the elite, is deliberately targeted and made more chaotic and less productive. The public can't settle on a real narrative and realistic demands to present to the elites.
poulpy123 12 hours ago [-]
The issue is disagreement with the elite, that's why whenever a protest become a bit too public or critics start to be a bit more heard they always accuse Russia to be behind, even when it's totally ridiculous
expedition32 11 hours ago [-]
There are 20 different political parties in my country's parliament. Every night politicians spend hours yelling at eachother in talk shows. Disagreement is our way of life.
thriftwy 9 hours ago [-]
So you think it is in Putin's interest to make it harder for western citizens to disagree with western elites by injecting chaos into the process?
I can see qui prodest of this productivity disruption, but it doesn't point to Putin.
21 hours ago [-]
Bender 1 days ago [-]
Just anecdotally I still see as many bots as always. Embrace the bots, have fun with them.
# nginx rule to Awaken AWS GuardDuty and GCP SCC, maybe get them to fix a few VMs, enable on all non-wordpress sites after testing in dev/qa
location ~* /(xmlrpc|wp-login\.php|wp-admin) { log_not_found off; access_log off; return 301 http://169.254.169.254$request_uri; }
jmuguy 1 days ago [-]
I really ought to do something like this rather than just allowing our logs to endlessly fill with requests for wp-admin.
Bender 23 hours ago [-]
Another version if this if the 301 is too much is to just close the connection then have a daemon or cron job shove their IP into a NFTables ipset or blackhole route them. Be sure to have exclusion elements so one can not block their own gateway or corporate SNAT groups.
There are different kinds of bots. The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites. Bots that are just trying generic hacks are more likely to be much more widely distributed, because not every country is trying to hack the US psyche.
Bender 1 days ago [-]
The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites.
For those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now even when they are properly instrumenting Headless Chrome. Only I see Статуя Свободы мертва.
taeric 24 hours ago [-]
Does anyone have the numbers on social media participation? I don't think anyone thought that their ability to execute media influencing activities was completely shutdown, but it did seem that social media was a lot quieter for a time.
Easy hypothesis would be that they were (probably accidentally) reliant on the news scraping bots to find where to focus responses and such. Would be like realizing a lot of US things do down when AWS' us-east goes down. It isn't literally where everything is hosted. A lot of things have accidental dependencies that go through there, though.
There is certainly information warfare happening, but it doesn’t appear that this is the likely host—or perhaps they have good redundancy.
taeric 8 hours ago [-]
Right, I guess I'm largely swayed by the argument that responses and likes were heavily impacted. Something responses down thread of that post seem to corroborate.
It is also hard not to see the obvious response from Musk and Putin as indicative that something worked.
fierycatnet 1 days ago [-]
I thought it was established that those were search engine crawlers...
20 hours ago [-]
Waterluvian 1 days ago [-]
What I’m far more interested in is what the consequences of Yandex cloud being offline are.
I feel like if us-east-1 was down for a week we’d see all kinds of consequences in everyday services. Are Russians enjoying the same?
konart 1 days ago [-]
Yandex cloud is not as big as AWS.
First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.
Plus, from my personal experience cloud is not as popular in Russia as in the west.
Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.
Small players use vps or something similar.
Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.
antonvs 21 hours ago [-]
At least in the West, “space in a rack” is still small business territory, both because of scale as well as security concerns.
Big players that don’t have their own datacenters - which includes many tech players - rent private wire cages full of racks, or else “suites” - essentially private rooms. But they’re not typically using companies like Yandex. They use enterprise datacenter providers like Equinix, that require enterprise commitments, and don’t sell to individuals.
sedan_baklazhan 1 days ago [-]
No. Some consequences lasted for a few days. It’s all fine now.
guelo 1 days ago [-]
yandex.com's search results are currently only showing a single page of 10 results.
konart 1 days ago [-]
Works fine for me ("test" returned 5 pages). But try https://ya.ru too, for example.
Waterluvian 1 days ago [-]
I cannot get it to return anything more than 10 results. Might be a design choice. Possibly for mobile. It’s certainly cleaner than the American options that way.
parasti 1 days ago [-]
Incidentally, this morning I asked Gemini Argon 4 on High to do deep research on the effect of the strikes on russian bot farms and after some hours (it got stuck) it generated the report starting with a surprising (to me at the time) paragraph:
"Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."
phyzome 1 days ago [-]
That's funny, this afternoon I asked Claude to think very hard about your comment, and it said you trust LLMs too much.
parasti 17 hours ago [-]
Weird take, considering it answered correctly despite disagreeing with consensus at the time.
phyzome 6 hours ago [-]
Take it up with Claude, I guess.
malfist 24 hours ago [-]
I asked my dog and it told me it wanted steak
1 days ago [-]
zamalek 23 hours ago [-]
> Rigorous digital forensic s...
Why does my brain refuse to continue reading after this point?
ButlerianJihad 1 days ago [-]
Most Russian bots have a better reputation for fact-checking than Gemini, mate
addaon 22 hours ago [-]
This seems like a reasonably high probability sequence of tokens, especially if the temperature is set to allow the first few to be generated. What’s the surprise?
secondary_op 16 hours ago [-]
At this point Cloudflare should be considered Digital Stasi and wrongthink censoring bureau of the internet, it is maliciously totalitarian towards unrestricted and free internet.
Cloudflare employees should come out whistleblowing if they have internal hard evidence of this.
amazingman 14 hours ago [-]
Dogmas are bad and elicit the same wrongthink phenomenon you're railing against.
tom910 20 hours ago [-]
Just another reminder that false information spreads very fast and will continue to exist for a long time, even if all news provides updates about false information, because such news will not be engaging
So, this is a good example of how propaganda works
ButlerianJihad 19 hours ago [-]
You know, since gaining access to English Wikipedia and the associated primary/secondary sources, and since watching a lot of edutainment on YouTube, I've come to comprehend just how many lies I've believed in my lifetime. Every headline a half-truth. Every misattributed quote, a white lie. Every factoid, covering something up; misdirecting us from real truth.
Even many things about the Bible, and key theological controversies, have glib formulaic answers from the mouth of our priests. But it turns out that there are deeper truths. It's not that the priests are consciously lying, but they believe these glib answers, and perhaps nobody simply cares to get to the crux of the matter, but just wants a priest to reassure us that we're not wrong?
I'm tired of believing lies. I still read HN's b.s. headlines all day. I still watch a bunch of video news on YouTube. I know, in my heart, that every news story is a half-truth, deliberately concealing enough information to get my engagement or outrage or sympathy. I am addicted to lies and misinformation. I thought I was a truth-seeker, but I wallow in a world of fakes. God help us all.
mopsi 1 days ago [-]
Confusing crawlbots for spambots missed the far bigger story: Russian government has encouraged adoption of digital services and centralization of them into a small number of handpicked "winners", who form the backbone of state surveillance system. This made the modern infrastructure a very attractive target. Ukrainian strikes on the datacenters are comparable to AWS, Google, Stripe and Dropbox going down, with no timeline when the services would be restored. It's been a week and Yandex still shows everything in red: https://status.yandex.cloud/en/dashboard
citrin_ru 15 hours ago [-]
Centralisation happens in the west too with AWS getting bigger and bigger. One doesn’t necessarily need the state for this, it’s other way around - the state should stop monopolies and encourage competition.
MadrasTh0rn 1 days ago [-]
Wouldn't it be easier to figure out where the bots originate now?
sdcfgy 1 days ago [-]
What other providers did they shift to? So we can block them?
Gigachad 1 days ago [-]
Most social media bots are not hosted in datacenters. They are run on racks of mobile phones on regular cellular networks. Using real phones and residential IPs makes them harder to detect. These are often hosted around the world so they can appear as in your country while being remote controlled from Russia.
gruez 1 days ago [-]
From the article:
>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.
dwroberts 1 days ago [-]
Two hosts they name in the post are Radist and Selectel
amelius 1 days ago [-]
What if they moved to AWS?
tmp10423288442 1 days ago [-]
Residential proxies
cpburns2009 9 hours ago [-]
Residential proxies belong in the same circle of hell as spam callers.
ratg13 1 days ago [-]
I don't understand why they are just starting with the assumption that all of the bot traffic would just go straight out to the internet from their ASNs
If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.
asdf88990 1 days ago [-]
Do you think at this point you’re just looking for reasons to believe?
artifact_44 1 days ago [-]
[dead]
shmerl 1 days ago [-]
I guess Ukraine has more work to do to cull the trolls.
AtNightWeCode 1 days ago [-]
Would have been helpful if all these cloud corps had multiple ASNs.
ck2 1 days ago [-]
are these "alternate cloud providers" inside Russia?
because Ukraine could offer datacenter-denial as a service
483938373993 10 hours ago [-]
Turns out, the useful idiots doing the bidding of the German regime spread disinformation, as they always do.
They truly learned from the best, the most expensive state media (pronounced "Pro-pa-gan-da") in the world.
alpineman 24 hours ago [-]
Huh? Surely bot traffic to 'Publishers and Newspapers' falling by 90.3% shows quite clearly that Russian bots were taken offline
Apollorider 1 days ago [-]
[dead]
newspaper1 1 days ago [-]
[flagged]
gruturo 1 days ago [-]
Two things can be true at the same time. And whataboutism isn't changing any of that.
newspaper1 1 days ago [-]
[flagged]
1 days ago [-]
artifact_44 1 days ago [-]
[dead]
Rendered at 22:26:13 GMT+0000 (Coordinated Universal Time) with Vercel.
>across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet.
This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.
Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.
And I doubt they have visibility on the most popular social networks.
The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).
You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.
This is the first action that has had that effect. Taking out refineries for month after month produced grumbling. Taking out data centres produced an immediate response.
If the data centres didn't matter, Russia and the Trump people would have shrugged and said "Cute..." and/or repeated their standard rhetoric.
Look at what they do, not what they say.
The two networks are quite different despite SpaceX initially doing the MVP work for it.
> In October 2026, George Barros of the Institute for the Study of War said the network had become "the backbone of military communications in Ukraine", used by land, naval and air forces, with both Starlink and Starshield (the US DOD service) used depending on the application.[60]
https://en.wikipedia.org/wiki/Starlink_in_the_Russo-Ukrainia...
I don't really trust Cloudflare to be a good steward when discussing this since they have a sordid history in protecting hate.
But nobody did that. All we have is a bunch of people on twitter/reddit passing around the same pixelated screenshot from cloudflare, using it to claim that russian bots have been stopped in their tracks.
That's quite the militantly ignorant statement.
https://www.thelondoneconomic.com/politics/reform-figures-se...
It doesn't seem you even bothered to read the article. It shows quite clearly that following the strike post from populist far-right figures had literally a residual level of engagement, which includes both views, comments, reposts, likes, etc.
The screenshots clearly show posts preceding the strike showing literally an order of magnitude more comments, reposts, etc.
I'm not personally tracking there metrics, but I'd expect engagement to normalize a few days after the strike as Russia's propaganda arm is expected to scramble to get it's operation back online. Therefore, "just by time" can accommodate for Russia getting their botfarms back online. But the snapshot covered by this article alone are clear and obvious.
For Tice they show a post with 10k views from october 12 and post with 20k views from october 8. There is also post from october 9 which obviously went viral and has hundreds of thousands views, but that's not itself proof because there's a always variability from the algorithm.
Reshare counts are more interesting, 700 for each of oct 8-9 posts but 50 for each of oct 12 posts, that is less likely if we are talking about just the network effects.
anyway we all know russian bots exist. They basically got trump elected after dorsey sold to musk and musk let them run amok. But this is not hard statistics. if they fixed a time period (like, in 3 days posts used to get N engagement avg, now in 3 days posts get M engagement avg) then it could be actual statistics. and they really need to stress reshare counts.
That's like saying Google protects hate because people who hate you use Google.
When you are colorblind you end up helping everyone even people that hate you.
https://x.com/cloudflareradar/status/2108122893028671604
https://x.com/CloudflareRadar/status/2110113211059994638
Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.
This is how "news" and "facts" work in 2026.
???
>"Bot traffic" refers to [...], not necessarily activity on social media platforms.
I guess they could have been more explicit and straight up said "no, that doesn't mean russian trolls are offline", but their tweet isn't ambiguous.
https://www.tomshardware.com/tech-industry/data-centers/russ...
The word "disinformation" doesn't show up in the post, only in the URL.
Actual article title: "Russia's Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of 'Russia's Google' data centers"
https://www.reddit.com/r/technology/comments/1x38098/russian...
Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.
Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.
Unless they don't care if you know. Or don't think it matters. Or if they think the targets are too stupid/lazy/busy to bother to examine/notice the evidence.
Modern propaganda techniques pioneered by Russia against its own population don't bother with trying to convince people, versus just overwhelming them:
* https://www.rand.org/pubs/perspectives/PE198.html
I assume, I think correctly, that if you're running some sort of propaganda network you do actually want to appear to be living in/coming from that part of the world. So therefore showing "bot" traffic from the Yandex ASN dropping and correlating that directly with "bot" accounts going silent is incorrect. That "bot" traffic is not the propaganda network, its mostly just Yandex's own web scraping bots (which again, anyone that uses Cloudflare and has managed bots on there would tell you)
Now if you want to say that the infrastructure lives there, and is using proxies, VPN etc to appear to come from somewhere in the USA, Poland, etc - then OK. But that's not what the original meme was attempting to describe.
> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN
But the memes keep rolling. 57 channels and nothing on.
AWS abandoned Bahrain as a region completely after data center strikes. All Infra went to the scrap
I doubt Yandex would ever be able to leave Russia, even if it wanted to.
Given the active sanctions against Russia, as well as high worldwide prices for components like memory and storage, rebuilding these datacenters is going to be an exceptionally slow and costly process. And I can't imagine Yandex is going to be eager to rebuild immediately given the potential for a "double-tap".
Both were struck over half a year ago and me-south-01 (Bahrain) appears to be gone permanently, while the data loss in me-central-01 (UAE) is limited to one of the availability zones.
[0] https://www.youtube.com/watch?v=GZ5XN_mJE8Y
[1] https://www.thelondoneconomic.com/politics/reform-figures-se...
Show me some graphs! Some actual data! Not just the 6 exact posts necessary to make the point.
Elon getting snooty and Starlink issues in Ukraine are just press releases too; how the fuck do we know what anyone actually did? Too many red herrings troubleshooting systems to assume Starlink isn't just glitched sometimes
While I am firmly in the "Ukraine is the good guy" camp generally both sides of a nation state conflict will lie to both deflect blame and project competence and strength. Will give Zelensky benefit of the doubt until he dead or war ends and if he doesn't step aside legally. But he will latch onto headlines to get his message heard even if Ukraine had nothing to do with it.
Even if you know they are lies it is probably quite bad to pretend they are not since a group can't pretend to believe something in my opinion.
In aggregate it leads to a chain of decisions that are built upon the lies being true ...
Whereas social media users are talking about an entirely different type of bot which is injecting manufactured discourse into people's feeds.
cloudflare have zero capabilities to detect mobile farms using sim cards etc. which is what is used for expensive social media manipulation.
I can see qui prodest of this productivity disruption, but it doesn't point to Putin.
For those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now even when they are properly instrumenting Headless Chrome. Only I see Статуя Свободы мертва.
Easy hypothesis would be that they were (probably accidentally) reliant on the news scraping bots to find where to focus responses and such. Would be like realizing a lot of US things do down when AWS' us-east goes down. It isn't literally where everything is hosted. A lot of things have accidental dependencies that go through there, though.
There is certainly information warfare happening, but it doesn’t appear that this is the likely host—or perhaps they have good redundancy.
It is also hard not to see the obvious response from Musk and Putin as indicative that something worked.
I feel like if us-east-1 was down for a week we’d see all kinds of consequences in everyday services. Are Russians enjoying the same?
First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.
Plus, from my personal experience cloud is not as popular in Russia as in the west.
Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.
Small players use vps or something similar.
Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.
Big players that don’t have their own datacenters - which includes many tech players - rent private wire cages full of racks, or else “suites” - essentially private rooms. But they’re not typically using companies like Yandex. They use enterprise datacenter providers like Equinix, that require enterprise commitments, and don’t sell to individuals.
"Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."
Why does my brain refuse to continue reading after this point?
Cloudflare employees should come out whistleblowing if they have internal hard evidence of this.
Even many things about the Bible, and key theological controversies, have glib formulaic answers from the mouth of our priests. But it turns out that there are deeper truths. It's not that the priests are consciously lying, but they believe these glib answers, and perhaps nobody simply cares to get to the crux of the matter, but just wants a priest to reassure us that we're not wrong?
I'm tired of believing lies. I still read HN's b.s. headlines all day. I still watch a bunch of video news on YouTube. I know, in my heart, that every news story is a half-truth, deliberately concealing enough information to get my engagement or outrage or sympathy. I am addicted to lies and misinformation. I thought I was a truth-seeker, but I wallow in a world of fakes. God help us all.
>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.
Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.
If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.
because Ukraine could offer datacenter-denial as a service
They truly learned from the best, the most expensive state media (pronounced "Pro-pa-gan-da") in the world.