27 comments

  • londons_explore 1 hour ago
    Yandex is Russian Google.

    Of course they have bots... That's how you index the web.

    If we took Google offline I bet there would also be a reduction in bot traffic from them too!

    Indexing is also probably a low priority task, so if half their datacenter capacity is taken offline, their bot traffic probably reduces by more than 50%.

    • walrus01 23 minutes ago
      The other Yandex AS which is their hosting/hypervisor platform, broadly similar to AWS, Azure, whatever also shows a major drop in bot traffic:

      https://radar.cloudflare.com/bots/as200350?dateRange=7d

      https://www.peeringdb.com/net/20950

    • cromka 1 hour ago
      I don't think these are the boys they refer to?

      EDIT: I was wrong, they're just generic bot vs human traffic numbers and you're right.

    • asdfsa32 46 minutes ago
      Don't let logic get in the way of a good propaganda.
      • lukan 30 minutes ago
        Logic says google bots do not come disguised, but as google agents.

        Or is there other information?

        Now there is probably also AI agent spam from google, but not at this level I believe. Also I am not fully clear what they count as spam, I doubt they would include google in this list, so do they include yandex bots here, if they come officially?

        • asdfsa32 16 minutes ago
          I am unsure what you're trying to say. But it seems like you don't understand what Bot means in general and how is it specifically defined for the metric provided in that page.

          From that pages point of view, a Google bot, Yandex bot, or your uncle Tom's AI agent spam is the same, a bot.

        • konart 26 minutes ago
          Neither do Yandex bots. What's your point?
          • lukan 18 minutes ago
            If official yandex bots ain't included in this data here - then it means spam/scam bots come indeed from yandex servers. As they stopped working, when the yandex data center was hit.
      • wewxjfq 15 minutes ago
        From submission title down this comment chain, I'd say the logic stops and propaganda starts with your comment.
        • asdfsa32 12 minutes ago
          Thanks for making it clear that you didn't look past the submission title.
      • notwatching 17 minutes ago
        [flagged]
      • caaqil 28 minutes ago
        It's a nice reminder that HN is just filled with the same primitive tribal normies and is always getting oneshotted by the same transparent xenophobic hysteria that plagues the rest of the internet.
        • loeg 13 minutes ago
          > HN is just filled with the same primitive tribal normies

          Yes, but it's mostly the opposite tribe of the one you're complaining about.

        • Citizen_Lame 15 minutes ago
          Will someone think of the Russkies.
        • GlacierFox 6 minutes ago
          Yeah for real, enlightened one. Russia is great by every metric /s.
    • dgellow 51 minutes ago
      Yandex has cloud offering, their servers are used for actual bot traffic, not just crawlers. Yandex hasn’t been only a search company for a very long time.
      • nik282000 4 minutes ago
        Google hosts a significant number of bots. About half of my fail2ban list is google cloud IPs.
    • AlienRobot 54 minutes ago
      I wonder how this will affect the Yandex search engine. I think I've read they split the Russian one and .com, but I'm not sure.
    • DonHopkins 46 minutes ago
      [flagged]
      • CoastalCoder 38 minutes ago
        Can you point to a few comments that you consider examples?

        I've never noticed occurrences of such stuff, so I'm curious what I'm failing to key in on.

        Edit: and would someone mind explaining the downvotes? If they're meant to communicate something to me, I'm genuinely not understanding.

        • rpdillon 16 minutes ago
          I like to study rhetoric, and appreciate folks asking for specifics. There's a lot of generalities thrown around on this forum that are highly questionable, and the only antidote I have is to request details. It's surprising how often folks resist.

          A sibling comment replying to you is using a familiar tactic, which is to try to shame you for asking for specifics, while simultaneously providing none and telling you that it's obvious.

          Occasionally people do provide details and I learn something, but that's not the common case, sadly.

        • BlackRabbit1 36 minutes ago
          Post a controversial political statement and grab a beer.
          • p-e-w 14 minutes ago
            Obviously. Because anyone who disagrees with the Western online consensus must be a bot, essentially by definition.
          • braiamp 31 minutes ago
            Ehh, there are enough humans that would do that. Don't delude yourself thinking that there are no people that hold such views.
            • rokkamokka 20 minutes ago
              That's half the point of the bots though, to spread the propaganda to other people so they spread it as well
              • p-e-w 10 minutes ago
                Having multiple genuinely different viewpoints in a discussion isn’t evidence of “bots”, it’s the default in any community that isn’t heavily censored to silence dissent. And individuals voicing their different viewpoints isn’t “propaganda”, it’s the definition of discourse.
        • asanineassasin 34 minutes ago
          The russian bots are better.. usually its conspiracy fog, attached to a valid russia opposing point that reveals them. Chinese bots are just this months CCP talking points, so can be quite easily visible if they cram some topic only china cares about into every reply.
        • MomsAVoxell 23 minutes ago
          Nobody wants honesty, everyone just wants to fit in with the collective. The downvotes are the collective, reactive mindset, showing itself.
        • gilrain 24 minutes ago
          The downvotes are because you're resisting easily-observed reality with the seemingly-rational response "Where is this 'air'? If I'm breathing it, it should be easy to point to, no?"

          No. If you can't see it, and don't understand it's there, you cannot be explained to. You're someone with no palate asking how anyone else can know if a wine tastes good.

          • CoastalCoder 20 minutes ago
            I appreciate that response. I don't know if/how to convince you that I'm asking the question in good faith, but (FWIW) I am.

            Regardless, wouldn't it be easy to point me to even one example if it's as prevalent as (I think) you're saying?

            Or am I missing your main point, i.e. that what's being described can't be demonstrated via example?

            • gilrain 13 minutes ago
              > wouldn't it be easy to point me to even one example

              Read and think about my wine analogy, if you care.

              • CoastalCoder 6 minutes ago
                I think you're saying that it's hard to articulate why some particular comment should be judged as having come from a bot. I.e., similar to the SCOTUS opinion regarding pornography: "I know it if I see it".

                Is that correct?

                If so, wouldn't that still admit someone providing a specific example? The whole point of my original comment was that I knew I wasn't judging these things the same as others were.

          • MomsAVoxell 22 minutes ago
            Nonsense. They’re trying to breathe and the downvotes won’t allow it.
            • gilrain 17 minutes ago
              Point out any wine that doesn't taste the same as any other, to me who has said he cannot taste wine.

              Only then, I'll believe you that wine can taste good or bad.

              Is my mind open? Is this not a waste of your time?

  • timr 43 minutes ago
    Isn't this showing the percentage of bot traffic from the Yandex IP range?

    If so, it isn't particularly surprising that the line would go down.

    EDIT: yes, it is. Looking at the same graph for all of Russia, and there's no discernible pattern:

    https://radar.cloudflare.com/bots/ru?dateRange=7d

    same for the 48h view:

    https://radar.cloudflare.com/bots/ru?dateRange=2d

  • f311a 30 minutes ago
    I can’t believe there are so many dumb comments in this thread. All it shows is that crawling from Yandex search engine stopped from one Yandex data center ASN.

    No one runs opinion/malicious bots from data center IPs that people mention here.

    Did people actually stop thinking?

    • monday_ 0 minutes ago
      You are replying to a war propaganda post with a heavily editorialized title. Of course it's swimming in bad faith engagement, that's how these things work.
    • walrus01 29 minutes ago
      On the other hand there are plenty of datacenter located command/control systems that puppeteer vast fleets of residential proxies (and Russia is by no means the only one doing so), so it will be very telling to see what social media accounts go silent over the coming days and weeks.

      > from one Yandex data center ASN

      This is only one of two extant Yandex ASN, not an ASN specific to one geographic region/datacenter.

      https://www.peeringdb.com/net/1751

      The other one is this: https://www.peeringdb.com/net/20950

      And the 200350 also shows a near complete drop off in bot activity:

      https://radar.cloudflare.com/bots/as200350?dateRange=7d

  • throwaw12 34 minutes ago
    Someone needs to learn how to read the Bot Traffic page.

    That is a drop in traffic specifically from Yandex bots (which includes their crawlers and other apps hosted in their DC)

    Now compare it with Bot Traffic in:

    * Russia: https://radar.cloudflare.com/bots/ru?dateRange=7d

    * Europe: https://radar.cloudflare.com/bots/europe?dateRange=7d

    * Worldwide: https://radar.cloudflare.com/bots?dateRange=7d

    Dip is barely noticeable even in Russia.

    Its like saying, "API requests are completely down" (and small disclaimer: only from your server, because your server is down)

  • schleck8 1 hour ago
    The HTTP traffic from Yandex is down to ~ 0 % after the third strike, after the first two strikes already degraded it. I wonder how this looks like at the network level because their search page still serves, but presumably their crawler is inactive now

    Edit: Here is some more info, they do have availability issues as is to be expected

    > Because three of its primary facilities were knocked offline within four days, Yandex’s failover mechanisms broke down[1][8].

    > Outages have cascaded across Yandex Go (taxis), Yandex Pay, food delivery, smart home platforms, internal logistics, and third-party corporate services hosted on Yandex Cloud[2][7]. Problems have spilled into neighboring countries using these systems (Belarus, Kazakhstan, Armenia, Serbia)[2][7].

    Edit 2: Here is the Yandex Cloud status page, their GCP/AWS equivalent. The entire compute core is offline, and even worse, Cloud Backup

    https://status.yandex.cloud/ru/dashboard

    > ru Compute Cloud, ru Kubernetes, ru PostgreSQL, ru ClickHouse, ru MySQL, ru YDB, ru Kafka, ru Application Load Balancer

    Interestingly, Yandex tells its users on the status page to switch to competitors Selectel, K2Cloud, and VK Cloud. Which will probably be hit next

    • Bluestein 1 hour ago
      This will be a case study in catastrophic events for HA and Ops folks.-
      • walrus01 10 minutes ago
        I don't know how useful it will be as a case study since an HA/Ops person in (let's say, the US, Canada, AU, western european countries) has access to do things like buy hypervisor capacity or colocation in just about any location. I could go buy colo in Brussels or Panama City or San Diego or Edmonton or Melbourne tomorrow by contacting the right people.

        The Russians are much more restricted from doing anything geographically outside of their own borders (for very well justified sanctions reasons), so their limitations are not the same as an HA person in almost any other country. Maybe some Iranian HA/Ops people will be comparing notes with them.

      • AlienRobot 46 minutes ago
        I don't think there is much you can do about being targeted by a military, simply because of how unique the attack vector is.

        Hacking is smart but happens through software, so if you have hardware (i.e. physical) barriers, that stops the hacking.

        Natural disasters happen physically but they are dumb, so if you have software redundancy (i.e. by copying the data to multiple locations), that stops them from destroying everything.

        A military is both physical AND smart. They can target multiple locations at once and destroy whole buildings.

        • simondotau 29 minutes ago
          You can learn to quickly diversify availability (or at least data safety) beyond the region of conflict when a kinetic war breaks out. The moment “kinetic sanctions” became the strategy, the risk to data centres should have been self-evident. And if it wasn’t immediately obvious, it should have been blindingly so when targeting expanded from oil refineries to Wildberries warehouses.
        • jacquesm 25 minutes ago
          > I don't think there is much you can do about being targeted by a military, simply because of how unique the attack vector is.

          You could choose not to invade other countries.

          • loeg 11 minutes ago
            This (as with defense) is kind of outside Google or Yandex's purview.
          • whatdouthink 9 minutes ago
            But apparently this does not apply to you.
          • AlienRobot 19 minutes ago
            I guess, but that doesn't sound like something in the control of a single individual company.
      • Hamuko 31 minutes ago
        I feel like this isn't even a particularly new thing. I worked at a medium-sized SaaS company and we did disaster recovery drills for moving our stack from eu-west-1 to eu-central-1 in case something catastrophic happened in Ireland. If you want HA, you kinda have to assume that any single country in the world can have some kind of a crippling disaster. Unfortunately for Yandex's clients, Yandex only has regions in two countries, and not that many regions either.
    • bamboozled 53 minutes ago
      I just searched "blyat" and it worked, so?
      • eptcyka 47 minutes ago
        Given that blyad is just punctuation at this point, I am not surprised.
        • walrus01 32 minutes ago
          I predict a great many more videos coming out of Russia of Firepoint UAVs flying into refineries and such, punctuated by background audio commentary that can be summed up as "cyka blyat"
        • throw-the-towel 36 minutes ago
          The username checks out!

          ("Ept" and "suka" are two other swearwords, that are also used much like punctuation.)

  • r721 2 hours ago
    *Sudden drop in Cloudflare bot traffic from AS13238 YANDEX — Yandex LLC

    UPD Definition of bot traffic from Cloudflare's glossary:

    >Bot vs. human traffic

    >The percentage of HTTP requests classified as bot versus human, based on bot scores. Requests with a bot score between 1 and 29 are classified as likely automated (bot), while requests with a score of 30 or above are classified as likely human. For more information, refer to Bot classes.

    >By default, Radar shows bot vs. human traffic for requests to HTML content. This filter is meant to represent traditional web traffic by excluding API calls, asset requests (images, scripts, fonts), and other machine-to-machine requests.

    https://developers.cloudflare.com/radar/glossary/#bot-vs-hum...

    https://developers.cloudflare.com/bots/concepts/bot-score/

    • walrus01 1 hour ago
      Correct, I probably didn't didn't write that in the clearest possible way, I meant "detected bot traffic hitting cloudflare originating from Yandex".
  • LiamPowell 31 minutes ago
    Everyone is mentioning crawlers, but wouldn't most traffic from a datacenter's ASN usually be bots just in general given that there's not many humans there to generate human traffic?
  • pluc 1 hour ago
    That's some intense mitigation from Cloudflare
    • Alifatisk 53 minutes ago
      You gave me a good laugh, cheers!
  • ericpauley 45 minutes ago
    Interestingly most traffic coming out of this AS was actually UDP: https://dashboard.terracenetworks.com/sources/asns/13238

    Pretty benign AS as far as actual exploit or malicious crawling is concerned.

    • cowlevel 39 minutes ago
      Probably QUIC if true, but you should also ask how these people get their data, because this isn't something you can just see or look up.
  • bhouston 21 minutes ago
    The US is still responsible for almost 50% of traffic of which the top are Amazon, Google, Microsoft, Cloudlare.

    https://radar.cloudflare.com/bots

  • beaker52 21 minutes ago
    It’s not really surprising that bot traffic originating from a network went away when _all_ traffic originating from that network stopped.
  • bearjaws 44 minutes ago
    Someone needs to inventory all the accounts that go dark on social media so we can flag them going forward.
  • salvuccio 8 minutes ago
    Low-IQ Americans will think these bots are X accounts posting memes against Democrats, which is why the media is astroturfing this news to target American liberals. In reality, most of these bots are just scripts performing normal enterprise jobs, but most people know nothing about how the world works.
  • speckx 52 minutes ago
    I have to wonder what will happen when the remaining 6 data centers get hit as well. It's bound to happen.
    • afdbcreid 42 minutes ago
      If there will be an world-wide war, sure. But at that point, the Internet as we know it will probably collapse anyway.
      • cowlevel 38 minutes ago
        There is one, but it's taking place mostly by information means, not physical.
    • walrus01 31 minutes ago
    • Hamuko 30 minutes ago
      Are there even six remaining?
  • accountrequired 18 minutes ago
    When Brazil and Afrinet? :P
  • pKropotkin 37 minutes ago
    Could be just crawlers
  • bamboozled 54 minutes ago
    I'm going to be really interested how much this cleans up the internet, I mean the damage is done if you read comment sections on youtube etc, but let's see how long the BS persists.
    • cowlevel 38 minutes ago
      It's only counting Yandex search crawler traffic, not any actually bad bots.
  • surfingdino 48 minutes ago
    So, is sending hot hate towards a bot farm going to be a paid service on Cloudflare now?
  • toomuchtodo 2 hours ago
    Cloudflare should consider donating to the Ukrainian military for the public service they are performing.
    • exe34 56 minutes ago
      I was thinking, we should all contribute to a Yandex fund for the Ukrainian mil to help keep the level of bot activity on the rest of the internet under control!
  • WiSaGaN 2 hours ago
    isn't this only counting russian origin already?
    • walrus01 1 hour ago
      The URL is CF's public metrics for bot traffic from a single specific Russian ASN, Yandex.

      https://www.peeringdb.com/net/1751

      • cowlevel 1 hour ago
        oh well of course if you blow up Yandex then Yandex stops sending you traffic, because they got blown up.
        • walrus01 34 minutes ago
          And nothing of value was lost.
          • cowlevel 27 minutes ago
            Yandex is the best search engine that doesn't follow American censorship norms. For this reason Kagi uses them as one source of several.
  • dintech 48 minutes ago
    Oh no, how is Trump going to win the midterms now?
  • andrepd 17 minutes ago
    Now do OpenAI's dc...
  • rvz 2 hours ago
    “AI agents” is just a fancy rebranding of “bots” with some “intelligence”.
  • TacticalCoder 22 minutes ago
    [flagged]
    • thenthenthen 18 minutes ago
      Thanks! So thats why I cant reach my bank, health insurance, municipality, tax office and government services from where I live, super!
    • walrus01 17 minutes ago
      Modern day Russia is about the furthest possible thing from "commies". Kleptocracy? Fascism? Dictatorship? Oligarchy? Sure, some bizarro world combination of all of those. But if you want people to take your opinion seriously, try not to sound like somebody's demented grandpa by tossing around "commie" like it's 1959.

      I am pretty damn sure that whatever Putin is doing these days is in no way motivated by an adherence to the Marxist-Leninist way of life.

  • blingo2665 25 minutes ago
    An eye for an eye for the Russians. I love western imperial propaganda though, and how HN so eagerly amplifies it. There’s something self-fulfilling about willingly becoming a foot soldier of the Empire.

    Here's to a world where the West is monolithic, and may Iran, Iraq, Yugoslavia, Syria, Libya, Lebanon, Palestine be only be the beginning. And may every new crusade for freedom and democracy leave behind another Gaza, in pursuit of upholding human rights and civilizing the world.