Russia’s Throttling of Cloudflare: Technical Impact and Security Implications

Starting June 9, 2025, Russian internet service providers (ISPs) began throttling access to websites and services protected by Cloudflare, disrupting connectivity for millions of users and businesses. Reports indicate that traffic to Cloudflare-protected sites dropped by 50% during peak disruptions between June 13–15, with data transfers capped at 16KB per request¹. This move targets not only Cloudflare but also other infrastructure providers like Hetzner and DigitalOcean, affecting banking apps (e.g., Sberbank), gaming platforms (e.g., Steam), and messaging services (e.g., Telegram)^{2, 3}.

TL;DR: Key Points

Throttling Mechanism: Russian ISPs limit Cloudflare traffic to 16KB, crippling media-rich sites while allowing basic HTML pages to load.
Affected Services: 20% of global web traffic relies on Cloudflare; disruptions impact banking, gaming, and circumvention tools like VPNs.
Security Risks: Loss of Cloudflare’s DDoS protection exposes Russian businesses to attacks.
Historical Context: Roskomnadzor previously blocked Cloudflare’s ECH encryption in 2024 and added it to a surveillance register in 2025⁴.

Technical Analysis of the Throttling

The throttling appears to target TCP/IP packets routed through Cloudflare’s Anycast network, specifically disrupting UDP-based services like VPNs and gaming platforms². Cloudflare’s DNS resolvers (1.1.1.1) also experienced intermittent failures, forcing Russian users to switch to state-controlled alternatives like Rostelecom DNS⁵. This aligns with Russia’s “landing law,” which mandates that foreign tech companies store Russian user data locally³.

Security Implications

Cloudflare’s role in mitigating DDoS attacks and providing SSL/TLS encryption means its throttling leaves Russian businesses vulnerable. For example, Sberbank’s mobile app, which relies on Cloudflare’s CDN, suffered latency spikes exceeding 300ms². Roskomsvoboda, a digital rights group, warns that permanent bans could mirror Iran’s censorship of Cloudflare in 2023³.

Mitigation Strategies

Organizations dependent on Cloudflare in Russia face limited options:

Local CDN Migration: Switching to Russian providers like Yandex Cloud or Mail.ru, though costs are 2–3× higher³.
Traffic Obfuscation: Using non-standard ports or tunneling through non-throttled protocols (e.g., QUIC).
Hybrid Architectures: Distributing traffic across multiple CDNs to reduce reliance on Cloudflare.

Conclusion

Russia’s throttling of Cloudflare reflects a broader strategy of digital isolation, with significant technical and economic repercussions. The loss of Cloudflare’s security services exacerbates risks for Russian enterprises, while circumvention efforts face escalating restrictions. Monitoring tools like Roskomsvoboda’s outage maps² will be critical for tracking further disruptions.