AI NewsInfrastructureAnnouncement
Cloudflare: Russian bots moved to other networks when Yandex went down
Cloudflare says traffic from Yandex's search crawler fell by 99 percent during the Russian outage, but malicious bots that had been running from Yandex.Cloud kept running from other Russian networks within hours.
Image: Cloudflare
Why it mattersBlocking an attacker's network range stops them only until they point the same scripts at a different cloud, so a security team gets more from matching request behaviour than from matching network origin.
A security team that blocks a network full of bots can usually watch the attack move to another network within a day. Cloudflare has now published the numbers from a real example.
Cloudflare's blog post describes what its network saw during the Ukrainian drone strikes on three Yandex data centres between 7 and 11 October. Traffic from Yandex Search's own autonomous system, AS13238, fell to 99 percent below baseline on 11 October. Traffic from Yandex.Cloud, AS200350, fell to 90 percent below baseline on the same day. Both numbers held between 85 and 90 percent below baseline through 13 October.
Two different kinds of bot, two different outcomes
The two systems carry different traffic. Cloudflare says 93.6 percent of bot requests from the Yandex Search ASN are verified crawlers, which is the search index collecting pages. When those machines stopped, publishers and news sites hosted on Cloudflare saw traffic from Yandex Search drop by 44 percent.
Yandex.Cloud carries unverified automation. Zero percent of its bot traffic was verified, in Cloudflare's measurement. WordPress plugin probing from that network fell by 90 percent during the outage, and requests Cloudflare's own scanner tagged fell by 93 percent. Cloudflare reports the total bot traffic drop from the ASN as "~40%", with the tilde in the original.
The same fingerprints showed up on other networks
What Cloudflare says it saw next is the useful part. On a customer in the gambling sector, bot traffic volume stayed almost flat through the outage, moving from 167.7 million to 170.1 million requests, a 1.4 percent rise. The identifying features of those requests, the JA4 TLS fingerprints, the paths, the headers and the user-agent strings, matched across providers. The operators kept the workload running by pointing it at Russian ASNs Radist and Selectel inside hours.
What Cloudflare says a defender should take from this
Cloudflare's post ends on the practical point: "Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from." The infrastructure a bot runs on is the easiest thing to change, so a rule that catches the bot by the way it talks will survive the operator moving it.
For a team running a WAF or a bot management product, this is an argument for recording the JA4 fingerprint and the request shape of every attack and keeping the rule portable across ASN changes. For a smaller site owner relying on reputation lists of bad networks, it is a reminder that those lists go stale fast when the people on them care about staying online. The reach of this one example is modest, since Cloudflare measured it on its own customers rather than publishing a wider dataset, but the pattern is familiar: the bot moved, the behaviour did not.
Source
Yandex outage: data shows that instead of going dark, malicious bots went on the move, Cloudflare blog.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
