A collapsing traffic chart is not proof that a bot operation stopped. Marina Elmore and Lai Yi Ohlsen examine the Yandex outage through Cloudflare’s request data, separating ordinary search crawling from malicious automation. Their central finding: some bots changed hosting providers rather than disappearing.

What the analysis shows

  • Yandex’s search network mostly carried verified crawlers indexing pages and images. Less traffic from that network primarily meant less search indexing, not demonstrated suppression of social-media manipulation.
  • The cloud-hosting network carried a different mix, including legitimate applications and attack-like requests. Scanning and WordPress plugin probing declined sharply during the disruption.
  • For one gambling customer, requests from Yandex.Cloud stopped while matching requests appeared at other providers. The matches included the same connection fingerprint, unusual paths, headers, and program-identifying strings.
  • Cloudflare found no evidence in its own observations that social-media manipulation had been knocked offline. The authors explicitly stop short of a definitive conclusion without data beyond Cloudflare.

The useful distinction is between an address going quiet and an operation stopping. For website operators, the authors recommend following patterns in requests rather than treating a hosting network as a reliable identity. A blocklist can lose its target as soon as the scripts move.

The 70-comment thread on Hacker News adds a practical objection to network blocking and a dispute about what this dataset can establish.

What the thread adds

  • gruez — on collateral damage from blocking entire hosting networks: “At the very least it’s hard to block purely on ASN without inflicting massive collateral damage on privacy conscious users (ie. using VPN), because baddies can (and do) use the same commercial VPNs.” An ASN identifies a network, not an individual operator.
  • onlyrealcuzzo — challenges the jump from request volume to influence: “You can make up a significant portion of comments and votes (especially on a topic) with a VERY small amount of the total viewing traffic.” This is the commenter’s argument about the measurement, not a finding of the article.
  • ratg13 — questions whether the originating network would be visible at all: “If it were a professional operation, the first thing you would do would be to not give away the source of where the traffic is coming from and route the traffic through an intermediary.” That is a hypothesis, not evidence about these particular bots.

The missing measurement

Two commenters ask for visibility the article does not establish: onlyrealcuzzo asks, “Does Cloudflare have much if anything to do with X/Twitter and Facebook/Instagram and TikTok, or even Reddit?” taeric asks, “Does anyone have the numbers on social media participation?” The article’s request-level observations and platform-level participation are different measurements; the thread does not supply a verified bridge between them.

Handles are pseudonymous. HN publishes no per-comment scores; ordering is HN’s own ranking. This is a slice of the discussion, not a consensus.