Does Cloudflare have much if anything to do with X/Twitter and Facebook/Instagram and TikTok, or even Reddit?

Presumably these bots make up a very small percentage of traffic in comparison to how much they make up in terms of comments.

And I doubt they have visibility on the most popular social networks.

The reason these bots are able to succeed is because the average person comments and votes so little that there's huge volatility between a power user and an average user. Power users are also not that rare, so it's hard to determine who's a power user and who's a bot (though most power users probably are bots).

You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.

The popular memes that were based on people's assumptions or guesses or stories based on... cloudflare own tweets!

https://x.com/cloudflareradar/status/2108122893028671604

https://x.com/CloudflareRadar/status/2110113211059994638

Which cloudflare also doesn't mention, that their vague and misleading tweet was responsible for these rumors that they are now trying to quash too. Tweets starting October 8th and continuing. That they're getting around to being like, yeah guys that data didn't mean that a week later.

This is how "news" and "facts" work in 2026.

Anyone that actually uses Cloudflare and manages their own bot traffic saw those graphs getting passed around and cringed. It has been an interesting thing to watch though as it was disseminated, echoed, and remixed with all sorts of "evidence" of this or that engagement dropping.

Russian state actors and propaganda networks literally using Yandex's ASN is like the CIA calling you from a payphone in the lobby of Langley.

Now you could say that parts of their infrastructure were hosted in there, and I'm sure it was, but the "bot" traffic narrative was pretty stupid.

Additionally,

> Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. … Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN

But the memes keep rolling. 57 channels and nothing on.

Yeah, it contradicted my intuition as a developer. If you take down a data center it isn't gone forever. The development team does not live there. Even if it's poorly backed up they're going to rebuild it.

Rhetorical claims that refute isn't really evidence either, just an attempt to null out the prevailing narrative; SEO spam

Elon getting snooty and Starlink issues in Ukraine are just press releases too; how the fuck do we know what anyone actually did? Too many red herrings troubleshooting systems to assume Starlink isn't just glitched sometimes

While I am firmly in the "Ukraine is the good guy" camp generally both sides of a nation state conflict will lie to both deflect blame and project competence and strength. Will give Zelensky benefit of the doubt until he dead or war ends and if he doesn't step aside legally. But he will latch onto headlines to get his message heard even if Ukraine had nothing to do with it.

I am in a couple political discussion groups and it was really curious how the traditional right-wing posters sort of disappeared right around the same time. There are several that people had suspected of being some type of plant that just were suddenly not posting any more and still haven't come back. No idea if it was related but the timing was so close that it raised a few eyebrows.

Not really, Cloudflare is talking about a different type of bot, one that scrapes the web.

Whereas social media users are talking about an entirely different type of bot which is injecting manufactured discourse into people's feeds.

No, it describes that Cloudflare was unable to identify that they have or haven't. The lack of evidence is not proof of absence.

you are basing your assumption on a site that have Zero insight about what they are claiming.

cloudflare have zero capabilities to detect mobile farms using sim cards etc. which is what is used for expensive social media manipulation.

oh, but they did. Measurably. Comment sentiments shifted drammatically following the post knockout period, especially on topics where comments typically get flooded by what is commonly called a troll account. Take videos covering pro-choice content or other content critical of US right wing talking points, which draw such bots like flies to shit. Post knockout? Near nada on new videos. It went from a sizable chunk of comments (~13%<amount<27%), to a fraction of a single %. That's a non trivial shift. Still looking at data, but something certainly did happen, and I think the memes are likely grounded in truth.

I really ought to do something like this rather than just allowing our logs to endlessly fill with requests for wp-admin.

<send friend request>

There are different kinds of bots. The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites. Bots that are just trying generic hacks are more likely to be much more widely distributed, because not every country is trying to hack the US psyche.

That's funny, this afternoon I asked Claude to think very hard about your comment, and it said you trust LLMs too much.

I asked my dog and it told me it wanted steak

> Rigorous digital forensic s...

Why does my brain refuse to continue reading after this point?

Most Russian bots have a better reputation for fact-checking than Gemini, mate

This seems like a reasonably high probability sequence of tokens, especially if the temperature is set to allow the first few to be generated. What’s the surprise?

This BlueSky user claims to track social media bots/information warfare accounts and has not seen any drop: https://bsky.app/profile/antibot4navalny.bsky.social/post/3m...

There is certainly information warfare happening, but it doesn’t appear that this is the likely host—or perhaps they have good redundancy.

Yandex cloud is not as big as AWS.

First of all AWS (even in us-*) most likely have non-US services\data. Yandex is mostly used by russian companies.

Plus, from my personal experience cloud is not as popular in Russia as in the west.

Big players like Sber, Ozon, T-Bank etc have their own datacenters and [may] use Yandex (or cloud.ru for example) for redundancy and\or non-critical services.

Small players use vps or something similar.

Big non-tech players (gas&oil for example) often rent redicated servers or space in a rack for their own hardware.

No. Some consequences lasted for a few days. It’s all fine now.

yandex.com's search results are currently only showing a single page of 10 results.

You know, since gaining access to English Wikipedia and the associated primary/secondary sources, and since watching a lot of edutainment on YouTube, I've come to comprehend just how many lies I've believed in my lifetime. Every headline a half-truth. Every misattributed quote, a white lie. Every factoid, covering something up; misdirecting us from real truth.

Even many things about the Bible, and key theological controversies, have glib formulaic answers from the mouth of our priests. But it turns out that there are deeper truths. It's not that the priests are consciously lying, but they believe these glib answers, and perhaps nobody simply cares to get to the crux of the matter, but just wants a priest to reassure us that we're not wrong?

I'm tired of believing lies. I still read HN's b.s. headlines all day. I still watch a bunch of video news on YouTube. I know, in my heart, that every news story is a half-truth, deliberately concealing enough information to get my engagement or outrage or sympathy. I am addicted to lies and misinformation. I thought I was a truth-seeker, but I wallow in a world of fakes. God help us all.

Most social media bots are not hosted in datacenters. They are run on racks of mobile phones on regular cellular networks. Using real phones and residential IPs makes them harder to detect. These are often hosted around the world so they can appear as in your country while being remote controlled from Russia.

From the article:

>Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints, regardless of which network the request originates from. Physical infrastructure is static, but malicious automation is built to move.

Of course they're tooting their own horn that you need their advanced features and expertise to block all the bots, but it's approximately true. At the very least it's hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.

Two hosts they name in the post are Radist and Selectel

What if they moved to AWS?

Residential proxies

Do you think at this point you’re just looking for reasons to believe?