Cloudflare: Yandex outage pushed malicious bots to other hosts, not offline

What happened

Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia — Sasovo, Kaluga and Vladimir — progressively taking data centers and network capacity offline. According to a Cloudflare blog post, the disruption culminated on October 11, when traffic on Cloudflare Radar fell 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Both networks remained 86–90% below normal through October 13.

The steep traffic drops fueled claims online that Russian bot farms and influence operations had been knocked offline. Cloudflare's analysis of its Radar and Bot Management data reaches a different conclusion: malicious automation largely relocated to other hosting providers rather than disappearing.

Two networks, two different stories

Cloudflare splits the impact by autonomous system, because the two Yandex networks serve very different roles.

Yandex Search (AS13238) is a crawling network. Cloudflare classified 99.5% of its requests as automated, and 93.6% of its bot requests as Verified. Sampled traffic was dominated by YandexBot (78.1%), YandexRenderResourcesBot (11.5%) and YandexImages (1.9%) — behavior consistent with a search indexer. The steepest decline among customer verticals hit Publishing and Newspapers, where traffic from Yandex networks fell 44%; about 90% of this ASN's pre-event traffic to news sites was YandexBot indexing articles, and 40.5% of Cloudflare customers answered with HTTP 403 because site owners had blocked the crawler. The practical effect for websites was simply less indexing by Yandex.

Yandex.Cloud (AS200350) is a hosting network with a very different mix. About 95% of its scored requests were bots, and none were verified by Cloudflare. These bots behaved like software applications: nearly two-thirds of their requests sent data to websites, and some identified themselves as JavaScript, Python or Go programs. After the strikes, bot traffic from this ASN fell roughly 40%, with WordPress plugin probing down 90%, scanner-flagged requests down 93%, and Cloudflare customer blocks on its traffic down 70% — proportionately less malicious traffic was even reaching the WAF.

Most of the cloud ASN's bot traffic targeted two verticals. Computer software traffic, which included calls to api.cloudflare.com and mostly returned 200s, points to legitimate use. Gambling is where the story turns.

The fingerprints that show migration

Nearly all of Yandex.Cloud's bot requests went to a single gambling customer account, shifting among its hostnames. Immediately after the October 8 disruption, bot requests from Yandex.Cloud to that account dropped to zero — and simultaneously, identical requests began arriving from other Russian hosting ASNs, including Radist and Selectel. The requests matched across providers on every signal Cloudflare checked: the same JA4 TLS client fingerprint, the same uncommon request paths and HTTP headers, and the same custom User-Agent strings.

Over the week, Russian bot traffic aimed at gambling accounts stayed essentially flat, moving from 167.7 million to 170.1 million requests (+1.4%). The automation never stopped running; the operators moved it.

Global bot traffic barely moved

Cloudflare's figures put the global share of bot requests at 39.4% of all HTTP requests in the October 1–6 baseline, wobbling only between 39.2% and 39.6% through October 13. The bot share of Russia-origin requests fell from 50.4% to roughly 42%, but Cloudflare attributes that mostly to the loss of Yandex's own automated traffic, since nearly all requests from those networks were bots. Cloudflare found no evidence linking a global disruption in malicious traffic to the Yandex drop. The two ASNs were also small contributors to begin with: about 7% and 2% of Russia-origin bot requests respectively, and just 0.05% and 0.01% of the global total.

Cloudflare adds a caveat that cuts both ways: traffic originating from a particular provider does not tell you who is responsible for it.

Why it matters

• Aggregate HTTP traffic charts cannot distinguish a search crawler from an attack tool. Only request-level behavioral analysis — fingerprints, paths, headers — reveals who was actually disrupted.
• Malicious operators treat hosting as interchangeable. Knocking one provider offline displaces workloads rather than destroying them; Radist and Selectel absorbed the gambling automation almost immediately.
• IP- and ASN-based blocking therefore has structural limits. Signals like JA4 fingerprints and custom User-Agents travel with the operator and remain detectable after a migration, which is what surfaced this story at all.
• The main measurable casualty of the outage was benign: reduced Yandex search indexing, felt hardest by news and publishing sites.