| ▲ | Sudden drop in Cloudflare bot traffic after strike on Yandex datacenter(radar.cloudflare.com) |
| 325 points by walrus01 3 hours ago | 101 comments |
| |
|
| ▲ | londons_explore 2 hours ago | parent | next [-] |
| Yandex is Russian Google. Of course they have bots... That's how you index the web. If we took Google offline I bet there would also be a reduction in bot traffic from them too! Indexing is also probably a low priority task, so if half their datacenter capacity is taken offline, their bot traffic probably reduces by more than 50%. |
| |
| ▲ | cromka 2 hours ago | parent | next [-] | | I don't think these are the boys they refer to? EDIT: I was wrong, they're just generic bot vs human traffic numbers and you're right. | |
| ▲ | asdfsa32 2 hours ago | parent | prev | next [-] | | Don't let logic get in the way of a good propaganda. | | |
| ▲ | lukan an hour ago | parent | next [-] | | Logic says google bots do not come disguised, but as google agents. Or is there other information? Now there is probably also AI agent spam from google, but not at this level I believe. Also I am not fully clear what they count as spam, I doubt they would include google in this list, so do they include yandex bots here, if they come officially? | | |
| ▲ | asdfsa32 an hour ago | parent | next [-] | | I am unsure what you're trying to say. But it seems like you don't understand what Bot means in general and how is it specifically defined for the metric provided in that page. From that pages point of view, a Google bot, Yandex bot, or your uncle Tom's AI agent spam is the same, a bot. | | |
| ▲ | lukan an hour ago | parent [-] | | I know what it means in general, but like I said indeed not "how is it specifically defined for the metric provided in that page." |
| |
| ▲ | konart an hour ago | parent | prev [-] | | Neither do Yandex bots. What's your point? | | |
| ▲ | lukan an hour ago | parent [-] | | If official yandex bots ain't included in this data here - then it means spam/scam bots come indeed from yandex servers. As they stopped working, when the yandex data center was hit. | | |
|
| |
| ▲ | wewxjfq an hour ago | parent | prev | next [-] | | From submission title down this comment chain, I'd say the logic stops and propaganda starts with your comment. | | |
| ▲ | asdfsa32 an hour ago | parent [-] | | Thanks for making it clear that you didn't look past the submission title. |
| |
| ▲ | caaqil an hour ago | parent | prev [-] | | It's a nice reminder that HN is just filled with the same primitive tribal normies and is always getting oneshotted by the same transparent xenophobic hysteria that plagues the rest of the internet. | | |
| ▲ | loeg an hour ago | parent | next [-] | | > HN is just filled with the same primitive tribal normies Yes, but it's mostly the opposite tribe of the one you're complaining about. | |
| ▲ | Citizen_Lame an hour ago | parent | prev | next [-] | | Will someone think of the Russkies. | | |
| ▲ | kakacik 4 minutes ago | parent [-] | | I keep thinking about them often, what a definition of cancer on modern humanity that country is. Not all people inside, far from it, but that country - absolutely, definitely and consistently. And most of those inside allowed this to happen over decades since even harsh dictatorships represent underlying population in many ways, many even cheered / still cheer on direction their country has taken, and non-trivial amount also like raiding neighbors for the kill, loot and money in general. A stark warning to US if you keep letting things slide to evil direction, this is roughly how you end up over time. |
| |
| ▲ | GlacierFox an hour ago | parent | prev | next [-] | | Yeah for real, enlightened one. Russia is great by every metric /s. | |
| ▲ | wiseowise 35 minutes ago | parent | prev [-] | | > normies Touch grass. |
|
| |
| ▲ | walrus01 an hour ago | parent | prev | next [-] | | The other Yandex AS which is their hosting/hypervisor platform, broadly similar to AWS, Azure, whatever also shows a major drop in bot traffic: https://radar.cloudflare.com/bots/as200350?dateRange=7d https://www.peeringdb.com/net/20950 | |
| ▲ | dgellow 2 hours ago | parent | prev | next [-] | | Yandex has cloud offering, their servers are used for actual bot traffic, not just crawlers. Yandex hasn’t been only a search company for a very long time. | | |
| ▲ | nik282000 an hour ago | parent [-] | | Google hosts a significant number of bots. About half of my fail2ban list is google cloud IPs. | | |
| ▲ | alephnerd 42 minutes ago | parent [-] | | Of course they do, but they are quick with account bans when notified because of the liability issue unlike Yandex. | | |
| ▲ | saghm a few seconds ago | parent | next [-] | | That must be why Google has such a stelly reputation for the quality of their support operations | |
| ▲ | luckylion 11 minutes ago | parent | prev [-] | | I've reported high-volume exploit scanners multiple times, and when expiring blocks a week later, they typically would show up & resumt with the same IP at some point. Maybe they'd care if the account was using a stolen credit card and there was a chance they wouldn't get their money, but they definitely do not care otherwise for normal people like me. I'm sure that'd be different if it's a multinational or a country-level government body is reporting something, but I can't get those to do my bidding. |
|
|
| |
| ▲ | AlienRobot 2 hours ago | parent | prev | next [-] | | I wonder how this will affect the Yandex search engine. I think I've read they split the Russian one and .com, but I'm not sure. | |
| ▲ | wiseowise 36 minutes ago | parent | prev [-] | | All bot lives matter! Bots have no ethnicity! Bot Russophobia!
Hypocritical West attacks Russian bots only, what about US/European bots! |
|
|
| ▲ | throwaw12 an hour ago | parent | prev | next [-] |
| Someone needs to learn how to read the Bot Traffic page. That is a drop in traffic specifically from Yandex bots (which includes their crawlers and other apps hosted in their DC) Now compare it with Bot Traffic in: * Russia: https://radar.cloudflare.com/bots/ru?dateRange=7d * Europe: https://radar.cloudflare.com/bots/europe?dateRange=7d * Worldwide: https://radar.cloudflare.com/bots?dateRange=7d Dip is barely noticeable even in Russia. Its like saying, "API requests are completely down" (and small disclaimer: only from your server, because your server is down) |
|
| ▲ | timr 2 hours ago | parent | prev | next [-] |
| Isn't this showing the percentage of bot traffic from the Yandex IP range? If so, it isn't particularly surprising that the line would go down. EDIT: yes, it is. Looking at the same graph for all of Russia, and there's no discernible pattern: https://radar.cloudflare.com/bots/ru?dateRange=7d same for the 48h view: https://radar.cloudflare.com/bots/ru?dateRange=2d |
| |
| ▲ | onemanstartup an hour ago | parent [-] | | USA accounts for 44% bot traffic worldwide. Russia 0.9%. Russia derangement syndrome on HN as usual. |
|
|
| ▲ | schleck8 2 hours ago | parent | prev | next [-] |
| The HTTP traffic from Yandex is down to ~ 0 % after the third strike, after the first two strikes already degraded it. I wonder how this looks like at the network level because their search page still serves, but presumably their crawler is inactive now Edit: Here is some more info, they do have availability issues as is to be expected > Because three of its primary facilities were knocked offline within four days, Yandex’s failover mechanisms broke down[1][8]. > Outages have cascaded across Yandex Go (taxis), Yandex Pay, food delivery, smart home platforms, internal logistics, and third-party corporate services hosted on Yandex Cloud[2][7]. Problems have spilled into neighboring countries using these systems (Belarus, Kazakhstan, Armenia, Serbia)[2][7]. Edit 2: Here is the Yandex Cloud status page, their GCP/AWS equivalent. The entire compute core is offline, and even worse, Cloud Backup https://status.yandex.cloud/ru/dashboard > ru Compute Cloud, ru Kubernetes, ru PostgreSQL, ru ClickHouse, ru MySQL, ru YDB, ru Kafka, ru Application Load Balancer Interestingly, Yandex tells its users on the status page to switch to competitors Selectel, K2Cloud, and VK Cloud. Which will probably be hit next |
| |
| ▲ | Bluestein 2 hours ago | parent | next [-] | | This will be a case study in catastrophic events for HA and Ops folks.- | | |
| ▲ | walrus01 an hour ago | parent | next [-] | | I don't know how useful it will be as a case study since an HA/Ops person in (let's say, the US, Canada, AU, western european countries) has access to do things like buy hypervisor capacity or colocation in just about any location. I could go buy colo in Brussels or Panama City or San Diego or Edmonton or Melbourne tomorrow by contacting the right people. The Russians are much more restricted from doing anything geographically outside of their own borders (for very well justified sanctions reasons), so their limitations are not the same as an HA person in almost any other country. Maybe some Iranian HA/Ops people will be comparing notes with them. | | |
| ▲ | ivan_gammel an hour ago | parent | next [-] | | Sometimes there exist data or processing residence requirements that bind you to a specific region (e.g. EU-only). Also, „all AZs in this region no longer exist“ is not on everyone‘s bingo card, this is a good reminder why multi-AZ deployment in the same region may be not enough. For data center guys this is definitely a case study, because drone attacks are probably on the threat list for everyone now, for various reasons, including domestic terrorism and hybrid warfare. If you want to defend your investment, time to think what covers you from the air. | | |
| ▲ | walrus01 42 minutes ago | parent [-] | | It's an open question at what point we'll start seeing small fiesty startups that want to sell you a privately owned air defense system for your datacenter roof. The tech to do it is probably far ahead of the regulatory regime to own and operate autonomous small radar+SAM batteries. |
| |
| ▲ | themgt 3 minutes ago | parent | prev [-] | | The DR plan for pros, "I could go buy colo tomorrow by contacting the right people" |
| |
| ▲ | AlienRobot 2 hours ago | parent | prev | next [-] | | I don't think there is much you can do about being targeted by a military, simply because of how unique the attack vector is. Hacking is smart but happens through software, so if you have hardware (i.e. physical) barriers, that stops the hacking. Natural disasters happen physically but they are dumb, so if you have software redundancy (i.e. by copying the data to multiple locations), that stops them from destroying everything. A military is both physical AND smart. They can target multiple locations at once and destroy whole buildings. | | |
| ▲ | jacquesm an hour ago | parent | next [-] | | > I don't think there is much you can do about being targeted by a military, simply because of how unique the attack vector is. You could choose not to invade other countries. | | |
| ▲ | loeg an hour ago | parent | next [-] | | This (as with defense) is kind of outside Google or Yandex's purview. | | |
| ▲ | jacquesm 43 minutes ago | parent [-] | | Said every company serving fascists ever. No, you can choose to collaborate or you can shut it down. Collaborators don't get to point back in time and say 'oh we had no choice', even if the choice was a painful one. Sorry it does not work that way. |
| |
| ▲ | whatdouthink an hour ago | parent | prev | next [-] | | But apparently this does not apply to you. | | |
| ▲ | jacquesm 41 minutes ago | parent [-] | | At least one russian shill that isn't affected by the Yandex strikes. Let's see how the rest of them fares, HN has its fair share of these characters. |
| |
| ▲ | AlienRobot an hour ago | parent | prev [-] | | I guess, but that doesn't sound like something in the control of a single individual company. |
| |
| ▲ | simondotau an hour ago | parent | prev [-] | | You can learn to quickly diversify availability (or at least data safety) beyond the region of conflict when a kinetic war breaks out. The moment “kinetic sanctions” became the strategy, the risk to data centres should have been self-evident. And if it wasn’t immediately obvious, it should have been blindingly so when targeting expanded from oil refineries to Wildberries warehouses. | | |
| ▲ | ivan_gammel 44 minutes ago | parent [-] | | I don‘t think you can build a new data center in such a short time frame that passed since attacks on WB, definitely not when you can source hardware only from the black market. | | |
| ▲ | simondotau 28 minutes ago | parent [-] | | I’m not describing what Yandex should do, but rather what their customers should do. Whether that means diversifying to eastern Russia, or China, or Belarus, I don’t know what options exist. |
|
|
| |
| ▲ | Hamuko an hour ago | parent | prev [-] | | I feel like this isn't even a particularly new thing. I worked at a medium-sized SaaS company and we did disaster recovery drills for moving our stack from eu-west-1 to eu-central-1 in case something catastrophic happened in Ireland. If you want HA, you kinda have to assume that any single country in the world can have some kind of a crippling disaster. Unfortunately for Yandex's clients, Yandex only has regions in two countries, and not that many regions either. |
| |
| ▲ | alephnerd 37 minutes ago | parent | prev | next [-] | | > The entire compute core is offline, and even worse, Cloud Backup Their Kazakh regions are available according to the dashboard, so it isn't as catastrophic. Their managed DBs and data processing services are heavily affected though with no Kazakh redundancies from the looks of it. | |
| ▲ | bamboozled 2 hours ago | parent | prev [-] | | I just searched "blyat" and it worked, so? | | |
| ▲ | eptcyka 2 hours ago | parent [-] | | Given that blyad is just punctuation at this point, I am not surprised. | | |
| ▲ | walrus01 an hour ago | parent | next [-] | | I predict a great many more videos coming out of Russia of Firepoint UAVs flying into refineries and such, punctuated by background audio commentary that can be summed up as "cyka blyat" | |
| ▲ | throw-the-towel an hour ago | parent | prev [-] | | The username checks out! ("Ept" and "suka" are two other swearwords, that are also used much like punctuation.) |
|
|
|
|
| ▲ | f311a an hour ago | parent | prev | next [-] |
| I can’t believe there are so many dumb comments in this thread.
All it shows is that crawling from Yandex search engine stopped from one Yandex data center ASN. No one runs opinion/malicious bots from data center IPs that people mention here. Did people actually stop thinking? |
| |
| ▲ | monday_ an hour ago | parent | next [-] | | You are replying to a war propaganda post with a heavily editorialized title. Of course it's swimming in bad faith engagement, that's how these things work. | | |
| ▲ | walrus01 39 minutes ago | parent [-] | | I'd expect nothing less than a comment such as this, from an account that hasn't posted even once for the last 7 months and has in its post history a claim of being located in Moscow. But hey, thanks for showing up to remind us of how terrible the imperialist war-mongering west is. Very refreshing. | | |
| ▲ | mattstir 11 minutes ago | parent [-] | | Not to get sidetracked, and not to argue against anything you've said, but how do you figure that out? For people you disagree with, do you open their profile's comments and start keyword-searching "russia" "china" "moscow" etc in hopes of finding a hit? They mentioned that city once in Jan 2024, halfway down the page and in passing. I'm just curious about how others use this site. | | |
| ▲ | walrus01 9 minutes ago | parent [-] | | Different people read at different speeds, it took me about 5 seconds when skimming it. If you engage in enough discussion related to Russia online you will quickly learn to identify when inauthentic commenters suddenly show up from a previously idle account to add their 2 cents. The person in question doesn't exhibit much of it, but one will also learn when skimming to identify certain grammar and sentence structure characteristics that can point to what is the first language of a person, even if they're writing in fluent English. |
|
|
| |
| ▲ | walrus01 an hour ago | parent | prev | next [-] | | On the other hand there are plenty of datacenter located command/control systems that puppeteer vast fleets of residential proxies (and Russia is by no means the only one doing so), so it will be very telling to see what social media accounts go silent over the coming days and weeks. > from one Yandex data center ASN This is only one of two extant Yandex ASN, not an ASN specific to one geographic region/datacenter. https://www.peeringdb.com/net/1751 The other one is this: https://www.peeringdb.com/net/20950 And the 200350 also shows a near complete drop off in bot activity: https://radar.cloudflare.com/bots/as200350?dateRange=7d | | | |
| ▲ | braiamp 35 minutes ago | parent | prev [-] | | The funny thing is that apparently I'm the only one that flagged it... I don't know why people comment instead of using the tools? |
|
|
| ▲ | karol 4 minutes ago | parent | prev | next [-] |
| Yandex is reporting an outage for some services. https://dzen.ru/news/story/75e4b917-952d-5304-a9b4-70e5dc1fb... |
|
| ▲ | r721 3 hours ago | parent | prev | next [-] |
| *Sudden drop in Cloudflare bot traffic from AS13238 YANDEX — Yandex LLC UPD Definition of bot traffic from Cloudflare's glossary: >Bot vs. human traffic >The percentage of HTTP requests classified as bot versus human, based on bot scores. Requests with a bot score between 1 and 29 are classified as likely automated (bot), while requests with a score of 30 or above are classified as likely human. For more information, refer to Bot classes. >By default, Radar shows bot vs. human traffic for requests to HTML content. This filter is meant to represent traditional web traffic by excluding API calls, asset requests (images, scripts, fonts), and other machine-to-machine requests. https://developers.cloudflare.com/radar/glossary/#bot-vs-hum... https://developers.cloudflare.com/bots/concepts/bot-score/ |
| |
| ▲ | walrus01 3 hours ago | parent [-] | | Correct, I probably didn't didn't write that in the clearest possible way, I meant "detected bot traffic hitting cloudflare originating from Yandex". |
|
|
| ▲ | LiamPowell an hour ago | parent | prev | next [-] |
| Everyone is mentioning crawlers, but wouldn't most traffic from a datacenter's ASN usually be bots just in general given that there's not many humans there to generate human traffic? |
| |
|
| ▲ | pluc 2 hours ago | parent | prev | next [-] |
| That's some intense mitigation from Cloudflare |
| |
|
| ▲ | tkrl-pskl 26 minutes ago | parent | prev | next [-] |
| Apart from the correct argument that a search engine like Yandex will have crawlers, I would not be surprised if Western AI companies also used Yandex to scrape covertly. Nvidia tried to pay off the Russian Anna's Archive for stolen data: https://www.tomshardware.com/tech-industry/artificial-intell... It would not be a surprise if similar deals have been reached with Yandex. But this is a nice demonstration by Ukraine that all our internet problems are caused by large data centers, wherever they may be located. |
|
| ▲ | bhouston an hour ago | parent | prev | next [-] |
| The US is still responsible for almost 50% of traffic of which the top are Amazon, Google, Microsoft, Cloudlare. https://radar.cloudflare.com/bots |
| |
| ▲ | rpozarickij 38 minutes ago | parent [-] | | It's interesting (but not surprising) that so much traffic comes from the Netherlands and Singapore despite their sizes compared to the countries at the top of this list. While not necessarily related to bot traffic, but I was thinking that in the age of AI perhaps we'll be comparing technological development of countries based on their usage of AI per capita (similar to what we have with electricity usage per capita). |
|
|
| ▲ | ericpauley 2 hours ago | parent | prev | next [-] |
| Interestingly most traffic coming out of this AS was actually UDP: https://dashboard.terracenetworks.com/sources/asns/13238 Pretty benign AS as far as actual exploit or malicious crawling is concerned. |
| |
| ▲ | cowlevel an hour ago | parent [-] | | Probably QUIC if true, but you should also ask how these people get their data, because this isn't something you can just see or look up. |
|
|
| ▲ | speckx 2 hours ago | parent | prev | next [-] |
| I have to wonder what will happen when the remaining 6 data centers get hit as well. It's bound to happen. |
| |
|
| ▲ | beaker52 an hour ago | parent | prev | next [-] |
| It’s not really surprising that bot traffic originating from a network went away when _all_ traffic originating from that network stopped. |
|
| ▲ | blingo2665 an hour ago | parent | prev | next [-] |
| An eye for an eye for the Russians.
I love western imperial propaganda though, and how HN so eagerly amplifies it. There’s something self-fulfilling about willingly becoming a foot soldier of the Empire. Here's to a world where the West is monolithic, and may Iran, Iraq, Yugoslavia, Syria, Libya, Lebanon, Palestine be only be the beginning. And may every new crusade for freedom and democracy leave behind another Gaza, in pursuit of upholding human rights and civilizing the world. |
| |
| ▲ | wiseowise 20 minutes ago | parent [-] | | Evil, imperialistic, warmongering West that checks notes condemns Israel’s actions, and generally condemned attack on Iran. |
|
|
| ▲ | dzink 12 minutes ago | parent | prev | next [-] |
| Now check how many open models search Yandex when asked for something. |
|
| ▲ | pKropotkin an hour ago | parent | prev | next [-] |
| Could be just crawlers |
|
| ▲ | accountrequired an hour ago | parent | prev | next [-] |
| When Brazil and Afrinet? :P |
|
| ▲ | salvuccio an hour ago | parent | prev | next [-] |
| Low-IQ Americans will think these bots are X accounts posting memes against Democrats, which is why the media is astroturfing this news to target American liberals. In reality, most of these bots are just scripts performing normal enterprise jobs, but most people know nothing about how the world works. |
|
| ▲ | bamboozled 2 hours ago | parent | prev | next [-] |
| I'm going to be really interested how much this cleans up the internet, I mean the damage is done if you read comment sections on youtube etc, but let's see how long the BS persists. |
| |
| ▲ | cowlevel an hour ago | parent [-] | | It's only counting Yandex search crawler traffic, not any actually bad bots. |
|
|
| ▲ | dintech 2 hours ago | parent | prev | next [-] |
| Oh no, how is Trump going to win the midterms now? |
|
| ▲ | surfingdino 2 hours ago | parent | prev | next [-] |
| So, is sending hot hate towards a bot farm going to be a paid service on Cloudflare now? |
| |
|
| ▲ | WiSaGaN 3 hours ago | parent | prev | next [-] |
| isn't this only counting russian origin already? |
| |
|
| ▲ | toomuchtodo 3 hours ago | parent | prev | next [-] |
| Cloudflare should consider donating to the Ukrainian military for the public service they are performing. |
| |
| ▲ | exe34 2 hours ago | parent [-] | | I was thinking, we should all contribute to a Yandex fund for the Ukrainian mil to help keep the level of bot activity on the rest of the internet under control! | | |
|
|
| ▲ | andrepd an hour ago | parent | prev | next [-] |
| Now do OpenAI's dc... |
|
| ▲ | rvz 3 hours ago | parent | prev | next [-] |
| “AI agents” is just a fancy rebranding of “bots” with some “intelligence”. |
|
| ▲ | bearjaws 2 hours ago | parent | prev | next [-] |
| Someone needs to inventory all the accounts that go dark on social media so we can flag them going forward. |
|
| ▲ | k__ 38 minutes ago | parent | prev [-] |
| Yeah, I noticed the overtone window sliding back from the right. |
