Russian bot traffic showed signs of slowing down after Ukraine bombed some of Yandex’s biggest data centers. Unfortunately, while the attacks have slowed down overall bot traffic from Russia, Cloudflare reports that malicious bots appeared to have simply transferred to other hosting ASNs like Radist and Selectel. Overall traffic on Yandex Search and Yandex.Cloud continues to stay at 10% to 15% of normal traffic levels, meaning the network remains disrupted. Cloudflare noted that traffic from the former is composed mostly of verified search crawlers indexing websites, meaning traffic from this service is mostly legitimate. On the other hand, the latter experienced a drop in malicious activities such as vulnerability scanning and probing after the data center bombings, but Cloudflare says that “high-volume automation did not vanish — it simply migrated to other hosting providers.”

This was evident with one Cloudflare customer in the gambling sector: it saw malicious bot requests from Yandex.Cloud drop to zero but started seeing the same activity being routed through other networks. “Overall, Russian bot traffic targeting gambling accounts remained essentially flat over the week, moving from 167.7 million to 170.1 million requests (+1.4%),” the company wrote in its analysis. “The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable.”

7%. Because of this, Cloudflare debunked the theory that Ukrainian strikes have caused a drop in social media manipulation, although it also noted that the scope of its analysis is limited to traffic that passed through Cloudflare services.

Source link