138 comments

[ 0.26 ms ] story [ 16.2 ms ] thread
(comment deleted)
Cloudflare should consider donating to the Ukrainian military for the public service they are performing.
I was thinking, we should all contribute to a Yandex fund for the Ukrainian mil to help keep the level of bot activity on the rest of the internet under control!
“AI agents” is just a fancy rebranding of “bots” with some “intelligence”.
isn't this only counting russian origin already?
The URL is CF's public metrics for bot traffic from a single specific Russian ASN, Yandex.

https://www.peeringdb.com/net/1751

oh well of course if you blow up Yandex then Yandex stops sending you traffic, because they got blown up.
And nothing of value was lost.
Yandex is the best search engine that doesn't follow American censorship norms. For this reason Kagi uses them as one source of several.
*Sudden drop in Cloudflare bot traffic from AS13238 YANDEX — Yandex LLC
Correct, I probably didn't didn't write that in the clearest possible way, I meant "detected bot traffic hitting cloudflare originating from Yandex".
Yandex is Russian Google.

Of course they have bots... That's how you index the web.

If we took Google offline I bet there would also be a reduction in bot traffic from them too!

Indexing is also probably a low priority task, so if half their datacenter capacity is taken offline, their bot traffic probably reduces by more than 50%.

I wonder how this will affect the Yandex search engine. I think I've read they split the Russian one and .com, but I'm not sure.
Yandex has cloud offering, their servers are used for actual bot traffic, not just crawlers. Yandex hasn’t been only a search company for a very long time.
Google hosts a significant number of bots. About half of my fail2ban list is google cloud IPs.
Of course they do, but they are quick with account bans when notified because of the liability issue unlike Yandex.
I've reported high-volume exploit scanners multiple times, and when expiring blocks a week later, they typically would show up & resumt with the same IP at some point.

Maybe they'd care if the account was using a stolen credit card and there was a chance they wouldn't get their money, but they definitely do not care otherwise for normal people like me. I'm sure that'd be different if it's a multinational or a country-level government body is reporting something, but I can't get those to do my bidding.

That must be why Google has such a stelly reputation for the quality of their support operations
Right, because I've had such outstanding results getting in touch with actual humans from Google when reporting abusive traffic directed towards my IP ranges. Top tier attention from people who really care.

/s

> liability issue

Continue drinking the Google kool-aid

Ukraine should take the rest of Yandex permanently offline so we can get a clean measurment, and fewer Russian shills on Hacker News.
Can you point to a few comments that you consider examples?

I've never noticed occurrences of such stuff, so I'm curious what I'm failing to key in on.

The downvotes are because you're resisting easily-observed reality with the seemingly-rational response "Where is this 'air'? If I'm breathing it, it should be easy to point to, no?"

No. If you can't see it, and don't understand it's there, you cannot be explained to. You're someone with no palate asking how anyone else can know if a wine tastes good.

Nobody wants honesty, everyone just wants to fit in with the collective. The downvotes are the collective, reactive mindset, showing itself.
I like to study rhetoric, and appreciate folks asking for specifics. There's a lot of generalities thrown around on this forum that are highly questionable, and the only antidote I have is to request details. It's surprising how often folks resist.

A sibling comment replying to you is using a familiar tactic, which is to try to shame you for asking for specifics, while simultaneously providing none and telling you that it's obvious.

Occasionally people do provide details and I learn something, but that's not the common case, sadly.

> Can you point to a few comments that you consider examples?

Just search for “Russia” on HN and follow threads. You’ll find lots of “what about West/Jews”, “Russia is fighting against NATO”, etc. Then open any western news outlet on YouTube and follow comments too.

Don't let logic get in the way of a good propaganda.
Logic says google bots do not come disguised, but as google agents.

Or is there other information?

Now there is probably also AI agent spam from google, but not at this level I believe. Also I am not fully clear what they count as spam, I doubt they would include google in this list, so do they include yandex bots here, if they come officially?

Google bots definitely come disguised, to check whether the web site serves different content to non-Google user agents.
There's also the very well known inverse phenomenon of absolutely non-google people trying to disguise their crawler as a googlebot useragent, which has been a thing since at least... 15 years now?
Yeah I see a lot of what looks like non google bots pretending to be google bots, and then the next time some other bot and so on.
How do you know they are not google? Their IP address or behavior?
Behavior mostly. I don’t expect Google to be trying to hit known exploits for that given server and similar behavior.
It's a nice reminder that HN is just filled with the same primitive tribal normies and is always getting oneshotted by the same transparent xenophobic hysteria that plagues the rest of the internet.
Will someone think of the Russkies.
I keep thinking about them often, what a definition of cancer on modern humanity that country is. Not all people inside, far from it, but that country - absolutely, definitely and consistently.

And most of those inside allowed this to happen over decades since even harsh dictatorships represent underlying population in many ways, many even cheered / still cheer on direction their country has taken, and non-trivial amount also like raiding neighbors for the kill, loot and money in general.

A stark warning to US if you keep letting things slide to evil direction, this is roughly how you end up over time.

Oh, you sweet summer child. The US is already evil, after its own fashion.
What an interesting way to phrase things when the US is responsible for much more suffering and unrest outside of it's own borders. Including the current situation in Russia, come to think of it.
> HN is just filled with the same primitive tribal normies

Yes, but it's mostly the opposite tribe of the one you're complaining about.

Yeah for real, enlightened one. Russia is great by every metric /s.
Since you said "a good propaganda" and not "good propaganda", I can only assume you must be from the Russian Federation.
From submission title down this comment chain, I'd say the logic stops and propaganda starts with your comment.
All bot lives matter! Bots have no ethnicity! Bot Russophobia! Hypocritical West attacks Russian bots only, what about US/European bots!
I wonder how bot traffic on propaganda platforms like Twitter changed, but they probably won't give out any information anyway.
I always wondered why every single western country is subjected to a constant stream of the same simplistic and generic anti immigration comments, regardless of the country. It's as if suddenly everyone from Poland to Portugal had the same moron racist uncle flooding their social media service of choice. There is also and always a russian-backed populist far-right emergent political party posting PG-13 versions of the same posts pushed by these bots.

I wonder what kind of fluctuation we will see in these bots traffic.

"If we took Google offline I bet there would also be a reduction in bot traffic from them too!"

That would be awesome.

Still, at least Polish Facebook seem to be far quieter with anti-UA/pro russia comments. So not only search bots
Its a deliberate attack being done by actors such as Elon musk. How you say? They are making the world think bots and AI automation are ok by supplying basic tools to help everybody scrape while they use technology 100x far more advanced to make everybody else's scraping pointless. They are making all Americans fight with each other and then using their huge data centers to harvest all of the data and keep users on their social media platforms. They basically use a fake Twitter account to "retweet" everybody's news or information and take it off their website into the social realm. They are delibertly sending more and more bots into the world so that they aren't noticed as much. If they didnt.. everybody would be pissed at their AI slop. People like ai meta have far advanced residential ips setup almost undetectable while all the new scraper people are easily detected but their ego and greed will not let them stop.. They are being trained to think it's ok to bot another person and steal their stuff because it's "seo" and "not illegal" "if I don't. Somebody else will" the bad actors here are Elon musk and Meta AI. There is no doubt about it. Don't be fooled by this fraud. Their setups to run their bots is easily 100000 a month... And nobody will be able to compete at that scale and expertise without just getting blocked.
They say it's 60% percent but that's not even close to the truth. In my niche the bots are now about 100 to 1. Yes. For every 1 visitor I get it's 100 automated bots using different ips.. after tracing most of them with fingerprint analysis.. the main culprits are Facebook and Elon musk. Meta is using something called "muse ai" to feed all the data from these bots and Elon musk appears to be channeling everything to x. I think that's what the X logo stands for.. the stocks and market.. everybody going down while he goes up.. the X is their plan on the economy and I just told you for fact how they are doing it.. yet all the morons who have been doing Internet work for 3 years are incapable of understanding. They just hire an Indian worker to fuel the fire
The HTTP traffic from Yandex is down to ~ 0 % after the third strike, after the first two strikes already degraded it. I wonder how this looks like at the network level because their search page still serves, but presumably their crawler is inactive now

Edit: Here is some more info, they do have availability issues as is to be expected

> Because three of its primary facilities were knocked offline within four days, Yandex’s failover mechanisms broke down[1][8].

> Outages have cascaded across Yandex Go (taxis), Yandex Pay, food delivery, smart home platforms, internal logistics, and third-party corporate services hosted on Yandex Cloud[2][7]. Problems have spilled into neighboring countries using these systems (Belarus, Kazakhstan, Armenia, Serbia)[2][7].

I just searched "blyat" and it worked, so?
> The entire compute core is offline, and even worse, Cloud Backup

Their Kazakh regions are available according to the dashboard, so it isn't as catastrophic.

Their managed DBs and data processing services are heavily affected though with no Kazakh redundancies from the looks of it.

The KZ region wasn't intended for Russia's entire workload, that's a secondary region with better Central Asian access.

If what you deduct were correct, Yandex would not be telling its customers to switch to competitora like VK Cloud. They even have a "priority onboarding code" called "CloudBro" for three competitors.

(comment deleted)
That's some intense mitigation from Cloudflare
You gave me a good laugh, cheers!
Their latest consumer plan includes "Super Duper Bot Fight Mode", which lets you drone strike one data center in a sanctioned country of your choosing.

For additional strikes or to upgrade to ICBM-based payloads, you'll have to contact them to set up an enterprise plan.

I'm going to be really interested how much this cleans up the internet, I mean the damage is done if you read comment sections on youtube etc, but let's see how long the BS persists.
It's only counting Yandex search crawler traffic, not any actually bad bots.
I have to wonder what will happen when the remaining 6 data centers get hit as well. It's bound to happen.
If there will be an world-wide war, sure. But at that point, the Internet as we know it will probably collapse anyway.
Are there even six remaining?
I think this really highlights the changing face of war.

It's hard to go to war now when your enemy can just use a few small drones to take out everything your citizens care about in a single day (social media, online deliveries etc).

And these things are practically irreplaceable in a war when you're sanctioned up the wazoo. Where are you buying racks of Xeons and DDR5 RAM and Nvidia GPUs?

Oh no, how is Trump going to win the midterms now?
Interestingly most traffic coming out of this AS was actually UDP: https://dashboard.terracenetworks.com/sources/asns/13238

Pretty benign AS as far as actual exploit or malicious crawling is concerned.

Probably QUIC if true, but you should also ask how these people get their data, because this isn't something you can just see or look up.
Someone needs to inventory all the accounts that go dark on social media so we can flag them going forward.
Someone needs to learn how to read the Bot Traffic page.

That is a drop in traffic specifically from Yandex bots (which includes their crawlers and other apps hosted in their DC)

Now compare it with Bot Traffic in:

* Russia: https://radar.cloudflare.com/bots/ru?dateRange=7d

* Europe: https://radar.cloudflare.com/bots/europe?dateRange=7d

* Worldwide: https://radar.cloudflare.com/bots?dateRange=7d

Dip is barely noticeable even in Russia.

Its like saying, "API requests are completely down" (and small disclaimer: only from your server, because your server is down)

Absence of bot traffic is secondary to the absence of nearly all Yandex traffic in general, bot or not, as a result of the datacenter being down. Which is certainly newsworthy.
Your initial submission title sounded as if Yandex DC was used as a bot attack and because they were down, bot traffic in the whole internet was substantially down.
(comment deleted)
Don't worry, now that Trump started protecting the refineries, the other data centers will be hit sooner rather than later. All those fresh fp2 drones can't go to waste. The only question is whats next - power plants? Water treatments? Heating somewhere up north?
(comment deleted)
Everyone is mentioning crawlers, but wouldn't most traffic from a datacenter's ASN usually be bots just in general given that there's not many humans there to generate human traffic?
Here's an example French hosting company which has something like 14.8% "human" traffic, (the Yandex is under 5% human) though how much of that is actual humans and not advanced things puppeteering headless browsers is another question.

https://radar.cloudflare.com/traffic/as12876

Maybe it shows that France is a better place for your VPN exit node than Russia? :)
I can’t believe there are so many dumb comments in this thread. All it shows is that crawling from Yandex search engine stopped from one Yandex data center ASN. No one runs opinion bots from data center IPs that people mention here.
On the other hand there are plenty of datacenter located command/control systems that puppeteer vast fleets of residential proxies (and Russia is by no means the only one doing so), so it will be very telling to see what social media accounts go silent over the coming days and weeks.

> from one Yandex data center ASN

This is only one of two extant Yandex ASN, not an ASN specific to one geographic region/datacenter.

https://www.peeringdb.com/net/1751

The other one is this: https://www.peeringdb.com/net/20950

And the 200350 also shows a near complete drop off in bot activity:

https://radar.cloudflare.com/bots/as200350?dateRange=7d

> command/control systems

There is Hetzner for that.

You are replying to a war propaganda post with a heavily editorialized title. Of course it's swimming in bad faith engagement, that's how these things work.
The funny thing is that apparently I'm the only one that flagged it... I don't know why people comment instead of using the tools?
The bots might be run in the datacenter and proxied through residential IPs as the exit point.
You won't see this kind of stats on the CF page.

All it shows is direct traffic against CF infrastructure.

If they are, then that wouldn't be YANDEX AS13238. So the linked graph wouldn't show these changes.
And yet overnight the pro UA comments in Polish internet dropped by order of magnitude, must be coincidence....

...it's fucking datacenter, obviously it runs more than just "crawler bots"

An eye for an eye for the Russians. I love western imperial propaganda though, and how HN so eagerly amplifies it. There’s something self-fulfilling about willingly becoming a foot soldier of the Empire.

Here's to a world where the West is monolithic, and may Iran, Iraq, Yugoslavia, Syria, Libya, Lebanon, Palestine be only be the beginning. And may every new crusade for freedom and democracy leave behind another Gaza, in pursuit of upholding human rights and civilizing the world.

Evil, imperialistic, warmongering West that checks notes condemns Israel’s actions, and generally condemned attack on Iran.
The arms are sold(and often directly supplied) to Israel by the West. Israeli warplanes are fueled during attacks on Iran by German and NATO tankers. Israel's enemies have suffered decades of sanctions, economic strangulation, and demonization, with the intention of destroying those countries and nations - a crime beyond comprehension for the imperial foot soldiers. A foot soldier of the empire might still have a conscience, and that conscience needs soothing from time to time. So, the imperial machine declares "We condemn the cruelty" while continuing to expand its reach and devour everything in its path. The whole ME (and not only) is essentially a forward deployed ever expanding military base.

The point is that condemning a war in the ME is meaningless, because these powers do not want the war to stop, they just don't want it to be so blunt. They prefer economic strangulation, sanctions and demonization, they want it to be slower and less visible, obscured behind bureaucratic language, with its victims dispersed across societies, consequences unfolding over years and decades, violence concealed, and architects decentralized because it is not a crime of a man, be it Putin or Trump, but a crime of a system where no true accountability can take place. They do not need to bomb every school themselves, but rather enable minor military operations, undermine political and economic stability, and support policies that destroy a society's ability to survive. And the dozens of millions of excess and direct deaths due to these policies are meaningless, right? After all it's the school that counts - those girls had names, faces, futures, and we are rightly appalled. But the millions who die through sanctions, deprivation, and the systemic destruction of their livelihoods, they remain statistics. I mean, can you imagine the public appalled over sanctions against Cuba - what a waste of time. That's not prime time news, and it will never be. Because they work.

People like you are so dicusting.
The deranged Orange Idiot and the bloodthirsty War Criminal are the ones carrying out what you describe. The rest of "the West" wants nothing more to do with them, and is currently attempting to avoid all the knives heading for their backs.

Monolithic indeed.

The war crimes I alluded to were carried out for decades under the guise of democracy and human rights. And those same knives were pulled out from the backs of the countries that I listed above. "The West" just wants to continue using the knives quietly, expand their military presence, and sanction the opponents to submission and destruction. The destruction and crimes against humanity in Gaza did not start with Trump, they have been going on for decades. You just dislike that now it's so blunt, you'd rather have their water poisoned so that they die out slowly and "without all the drama".
I take the entire russian, chinese, north korea AS blocks (and also other from tiny irrelevant countries) and drop them at the firewall level.

I do that since years and the Internet keeps working just perfectly fine.

If you've got servers and serve "the west": just drop all these commie cunts countries entirely. Simply pretend they don't exist.

And nothing shall be lost.

It’s not really surprising that bot traffic originating from a network went away when _all_ traffic originating from that network stopped.
The US is still responsible for almost 50% of traffic of which the top are Amazon, Google, Microsoft, Cloudlare.

https://radar.cloudflare.com/bots

It's interesting (but not surprising) that so much traffic comes from the Netherlands and Singapore despite their sizes compared to the countries at the top of this list.
100%. It will roughly translate to GDP. It is no different than industrialization/mechanization/computerization transitions.
Indeed, most of my server's 'Chinese' and 'Russian' bot traffic is originating from US IP addresses.