Yandex outage: data shows that instead of going dark, malicious bots moved

sdcfgy

What other providers did they shift to? So we can block them?

gruez

Buried lede: >across Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or otherwise disrupted malicious activity on the Internet. This directly refutes the popular memes going around that russian trolls magically went offline because of the attack.

ck2

are these "alternate cloud providers" inside Russia? because Ukraine could offer datacenter-denial as a service

shmerl

I guess Ukraine has more work to do to cull the trolls.

ratg13

I don't understand why they are just starting with the assumption that all of the bot traffic would just go straight out to the internet from their ASNs If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.

Waterluvian

What I’m far more interested in is what the consequences of Yandex cloud being offline are. I feel like if us-east-1 was down for a week we’d see all kinds of consequences in everyday services. Are Russians enjoying the same?

Bender

Just anecdotally I still see as many bots as always. Embrace the bots, have fun with them. # nginx rule to Awaken AWS GuardDuty and GCP SCC, maybe get them to fix a few VMs, enable on all non-wordpress sites after testing in dev/qa location ~* /(xmlrpc|wp-login\.php|wp-admin) { log_not_found off; access_log off; return 301 http://169.254.169.254$request_uri; }

MadrasTh0rn

Wouldn't it be easier to figure out where the bots originate now?

mopsi

Confusing crawlbots for spambots missed the far bigger story: Russian government has encouraged adoption of digital services and centralization of them into a small number of handpicked "winners", who form the backbone of state surveillance system. This made the modern infrastructure a very attractive target. Ukrainian strikes on the datacenters are comparable to AWS, Google, Stripe and Dropbox going down, with no timeline when the services would be restored. It's been a week and Yandex still shows everything in red: https://status.yandex.cloud/en/dashboard

parasti

Incidentally, this morning I asked Gemini Argon 4 on High to do deep research on the effect of the strikes on russian bot farms and after some hours (it got stuck) it generated the report starting with a surprising (to me at the time) paragraph: "Rigorous digital forensic scrutiny and network telemetry analysis, however, demonstrate that the purported collapse of Russian social media propaganda bots is an analytical mirage born of misinterpreted network traffic data and fabricated viral graphics."

AtNightWeCode

Would have been helpful if all these cloud corps had multiple ASNs.

fierycatnet

I thought it was established that those were search engine crawlers...

alpineman

Huh? Surely bot traffic to 'Publishers and Newspapers' falling by 90.3% shows quite clearly that Russian bots were taken offline

taeric

Does anyone have the numbers on social media participation? I don't think anyone thought that their ability to execute media influencing activities was completely shutdown, but it did seem that social media was a lot quieter for a time. Easy hypothesis would be that they were (probably accidentally) reliant on the news scraping bots to find where to focus responses and such. Would be like realizing a lot of US things do down when AWS' us-east goes down. It isn't literally where everything is hosted. A lot of things have accidental dependencies that go through there, though.

tom910

Just another reminder that false information spreads very fast and will continue to exist for a long time, even if all news provides updates about false information, because such news will not be engaging So, this is a good example of how propaganda works