What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting out

The contested Internet border: Russia's Web in wartime

Since Russia's invasion of Ukraine in late February, the Internet has become part of the battlefield. Cloudflare has documented both an increase in cyber attacks in the region and growing efforts to protect Ukrainian government, media, financial, and nonprofit websites, including the .ua top-level domain. But the company has also been observing what is happening on Russian networks — where the state is tightening control and where ordinary users are increasingly reaching for tools to bypass it.

The state tightens its grip

Russia's moves to assert control over its domestic Internet are not new. Over the past five years, the government has passed laws requiring ISPs to install monitoring and blocking equipment, mandated a national DNS infrastructure outside ICANN's oversight, and created mechanisms that would allow it to sever connections to the global Internet. Since the invasion, Russian government agencies have been instructed to switch to Russian DNS servers, move public resources to domestic hosting, and reduce reliance on non-Russian providers.

Despite speculation that these measures presage a full disconnection, connections through non-Russian infrastructure are still being processed successfully in Russia. Instead, authorities have implemented targeted blocks against specific websites and operators — initially social media platforms like Facebook, Instagram, and Twitter, as well as Russian-language news outlets based abroad. The effect is visible in traffic data: many news sites saw exponential growth in access from Russian users in the days around February 24, followed by a sharp decline as blocking measures took hold.

However, the impact of these blocks has been uneven in the short term, with many sites remaining accessible through traditional channels for days or weeks after the initial action. Over time, though, the restrictions have largely succeeded in denying access through standard Internet pathways.

Russians route around the controls

As state controls tightened on traditional access channels, a different pattern emerged in how Russians use the Internet. The Apple App Store leaderboard in Russia for March tells the story: unlike most countries where social media and games dominate, Russia's top apps were nearly all private access tools and encrypted messaging services. The most downloaded app in Russia was Cloudflare's own WARP / 1.1.1.1 privacy resolver.

Cloudflare's data from WARP usage shows this adoption was sudden and dramatic. Use of the tool in Russia was minimal at the beginning of February, took off in the first weekend of the war, and peaked two weeks later. Though usage has receded from that peak, it remains at massively higher levels than pre-war. Attempts to block these secure access tools emerged only after the migration became apparent.

At the same time, DNS request data shows a clear shift in what Russian users are trying to reach. Request volumes for major non-Russian news outlets — a well known US newspaper, a large French news source, and a British newspaper — have grown enormously compared to pre-war levels. Russians are not only willing to adopt privacy tools; they are actively seeking out foreign news sources.

Blocking attacks at the source

Cloudflare's presence inside Russia has another effect: it allows attacks originating there to be detected and blocked locally, before they cross national borders. This is a core design principle of the company's distributed network — DDoS attacks are mitigated at the edge, close to where they are launched.

DDoS activity originating from Russian networks and blocked by Cloudflare's in-country servers was relatively low through February but grew massively in the middle of March. The company cautions that identifying the origin of attack traffic is not the same as attributing the attacker. Cyber attackers commonly launch strikes from hijacked devices in other countries, and attribution remains difficult — particularly at such a sensitive time.

Why disconnecting Russia would backfire

Cloudflare acknowledges the calls for foreign companies to withdraw from Russia entirely, including demands to disconnect the country from the Internet. The company notes it has minimal sales and commercial activity in Russia — it has never had a corporate entity, office, or employees there — and has taken steps to avoid paying taxes or fees to the Russian government.

Still, removing services entirely would do more harm than good, the company argues. Withdrawal by Internet providers would advance the Russian government's effort to consolidate control over its domestic Internet. Moves to cut Russia off through ICANN or RIPE would only isolate the Russian people from information about the war. When US-based certificate authorities stopped issuing SSL certificates for Russian websites, Russia responded by encouraging citizens to install a state-controlled root certificate authority — which, as the EFF observed, would also enable surveillance of Russian users now and in the future.

There is near-universal agreement among experts that keeping Russia connected is imperative. Civil society groups have urged governments not to reinforce Moscow's information control through well-intentioned sanctions. Russian digital rights activists have pleaded with service providers to offer free VPN access. Even the US State Department has said it is critical to maintain the flow of information to the people of Russia to the fullest extent possible.

For Cloudflare, this means continuing to defend Ukrainian web properties while keeping ordinary Russians connected to the global Internet. The company describes the past six weeks as a period of intense activity focused on both goals.