On August 18, 2026, a technical incident at M9, one of Moscow’s major telecommunications hubs, caused widespread disruptions across Russian internet infrastructure.
M9 has long been considered an important part of Russia’s internet infrastructure. But how significant is its role in practice? The outage gave us a rare opportunity to put a number on that dependency. Using BGP visibility data, we reconstructed the incident and measured how many autonomous systems were affected — and how severely.
RPKIViews discovers and stores all the world's RPKI data and makes it easily accessible in its original form to support a broad set of applications. Freshly signed RPKI material is collected globally from multiple topologically and geographically diverse vantage points using both rsync and RRDP synchronization and stored in compacted form in so-called rpkispools.
The rpkispool format is a modern approach for materialization of RPKI data in order to support a range of use cases such as auditing Certification Authorities and conducting analytical research. Rpkispools can be used for replication of raw RPKI data and associated validation states as efficiently compressed durable objects. The method relies on industry standard tooling (ustar, Zstandard, and CCR) and is designed to support long-term preservation of RPKI data in a cost-effective way.
In this article we’ll dive into some of the technical details of capturing the RPKI distributed database and approximating storage requirements.
We recently ran into an unusual issue: BGP sessions were resetting with no obvious explanation shortly after routers received new routes. To understand what was happening, we collected and analyzed the BGP UPDATE messages that consistently triggered the errors.
It quickly became clear that all problematic routes had one thing in common: they carried a malformed OTC attribute. The real root cause, however, was not just the presence of a bad attribute, but the way different routers reacted to it. Before looking at that behavior, it helps to recap what OTC is and how it is supposed to work.
Recent years have seen distributed denial-of-service (DDoS) attacks grow larger and happen more often than ever before. In just the first three months of 2025, the number of DDoS attacks worldwide increased by 110% compared to the same period the year before.
One late-March incident involved a botnet of 1.33 million compromised devices, almost six times larger than the biggest botnet observed the year prior. That botnet blitzed an online betting platform, and over half of the attacking devices originated from a single country (Brazil). In the following quarter, its size grew to 4.6 million devices, and by the next quarter, it reached 5.76 million.
On September 1, 2025, Qrator.AntiDDoS detected and mitigated another large-scale attack carried out by the largest L7 DDoS botnet observed to date. The target was an organization in the government sector. In total, 5.76 million IP addresses were blocked during the incident.
DDoS attacks are still one of the most dangerous types of cyber threats, and they are getting bigger and more complicated. In 2024, there were more than 15 million DDoS attacks reported around the world. Our most recent study estimates application-layer DDoS attacks are up 74% compared to last year. But many businesses still don't know how to keep themselves safe from these kinds of threats. In this article, we'll talk about seven of the most common myths about protecting against DDoS attacks
Qrator Labs' findings on DDoS attacks, BGP incidents and bot activity in the 1st quarter of 2025.