As we reported, at night Ukrainian drones hit the Vkontakte data center in the Leningrad region. Later it became known that this was one of the company’s largest sites, which is located in Novosergiyevka (Vsevolozhsky district, close to the border of St. Petersburg). It is strategically located near the 330 kV substation "Vostochnaya".
As we reported, at night Ukrainian drones hit the Vkontakte data center in the Leningrad region. Later it became known that this was one of the company’s largest sites, which is located in Novosergiyevka (Vsevolozhsky district, close to the border of St. Petersburg). It is strategically located near the 330 kV substation "Vostochnaya".
The data center was built in 2011 on the site of the former high-voltage equipment testing center, so the site has a capacity of about 20 MW.
Firepoint later reported that the Defense Forces had struck the data center with long-range FP-1 drones.
“This is one of VKontakte’s key data centers, which is used to store and process data, including photos, videos, and other user content. According to previously released data, the complex had more than 20,000 servers and 640 server racks,” Firepoint writes.
According to the company, serious damage to the facility has been confirmed, and VKontakte users are reporting malfunctions in the social network.
Firepoint also published a photo of the destroyed wall of the Vkontakte data center and wrote in the following post: "Durov, return the wall!".
Later, Pavel Durov (founder of Telegram) wrote that he built the data center that was blown up 15 years ago and sold it to VK 12 years ago.
“In short, it is not known what exactly (in the data center — Ed.) was affected, but half of the network in St. Petersburg is down,” Internet expert Serhiy Petrenko tells dev.ua.
According to him, based on the pictures of the building, there could be two options as to what exactly was damaged.
"Either the affected area contains a computer room where the servers are located. This means that a certain number of servers are destroyed and the network is damaged. Or the engineering unit is located in this area, i.e. the switchboard, cooling pumps, pipelines. This can be even worse than damage to the servers, because a faulty cooling system or power supply forces the entire data center to be shut down," he emphasizes.
How difficult it is to overcome it, according to Petrenko, depends on the nature of the damage. “Well, it’s about like repairing something at a refinery,” he says.
As Serhiy Petrenko writes, Historically, the VK network consists of several segments.
Autonomous system AS 47541 is the network of Vkontakte itself, located in St. Petersburg, mainly vk.com and VK Video. Two more autonomous systems — AS47542 and AS28709 — are the Moscow and regional CDN (Content Delivery Network) of the social network, respectively.
VK Cloud is also located in Moscow in various data centers — the group rents large capacities from various players, in addition, there are two data centers in Domodedovo, where at least one cloud zone is located. VK Cloud was initially built separately, unlike the traditional approach for hyperscalers, when its own services are the first consumers of the cloud.
The attacked data center is the very first AS47541.
In this network, two uplinks in St. Petersburg (RETN and Telecom Italia Sparkle) disappeared and about half of the addresses of the autonomous system stopped responding. According to the statistics of BGP sessions, a sharp increase in the number of announcements is noticeable at the time of the attacks — this shows that some routes became unavailable. At the moment, these routes have not been restored, that is, these segments continue to lie.
Cloudflare traffic also shows this — the portion of requests (HTTP requests) from AS47541 dropped to almost zero and has not risen during Sunday. And in bytes, traffic has dropped to 40% of its maximum, while on the same day, but a week earlier, this figure exceeded 80%.
At the same time, there is an increase in traffic from the Moscow CDN AS, which hypothetically could indicate traffic being transferred from the network.
“Please note that this is not traffic from VK users, these are outgoing requests from the company’s networks,” Petrenko emphasizes.
