Following reported Ukrainian drone strikes on Yandex data centers in October, claims circulated that Russian bot farms had been knocked offline. However, analysis by Cloudflare revealed a more complex picture: while some malicious activity declined on Yandex’s networks, high-volume automation did not vanish—it migrated to other hosting providers.
Yandex operates two distinct autonomous systems: AS13238 for its search engine and AS200350 for cloud services. The strikes, which occurred on October 7-11, caused near-total network collapse by October 11, with traffic plummeting 99% below baseline for Yandex Search and 90% for Yandex.Cloud.
The impact on these two systems differed significantly. Yandex Search ASN traffic consisted almost entirely of verified search crawlers indexing web pages and images. According to Cloudflare, 99.5% of requests from this ASN were classified as automated, with 93.6% verified as legitimate bot activity. When the network went down, the primary effect was reduced search indexing—particularly for news and publishing sites, which saw a 44% traffic decline.
Yandex.Cloud told a different story. While bot traffic from this cloud-hosting ASN fell about 40%, malicious activity patterns suggest relocation rather than elimination. WordPress plugin probing fell 90% and scanner-identified requests dropped 93%, but identical bot requests with matching TLS fingerprints, uncommon request paths, and identical HTTP headers immediately appeared from other Russian hosting providers like Radist and Selectel.
The clearest evidence emerged in the gambling sector, where nearly all of Yandex.Cloud’s bot requests targeted a single customer account. When traffic from Yandex.Cloud dropped to zero following the October 8 disruption, identical attacks began appearing from alternative Russian ASNs within the same timeframe, maintaining the exact same technical fingerprint across providers.
Cloudflare’s analysis shows that while Russia-origin bot requests fell roughly in proportion to Yandex traffic going offline, global bot traffic remained relatively stable throughout the period, dropping only marginally from baseline percentages. This indicates that malicious actors quickly redistributed their operations rather than being permanently disrupted by the infrastructure damage. The findings demonstrate that aggregate traffic metrics alone can be misleading when assessing the true impact of network outages on coordinated malicious activity.
Key facts
- Yandex Search traffic decline consisted almost entirely of legitimate search crawlers, not malicious bots
- Malicious bots from Yandex.Cloud migrated to other Russian hosting providers like Radist and Selectel with identical technical fingerprints
- Global bot traffic remained stable during the outages, falling only marginally from baseline percentages
- Yandex Search ASN supplied about 7% of Russia-origin bot requests; Yandex.Cloud ASN supplied about 2%
- Publishing and newspapers sites saw the steepest decline at 44% from Yandex Search traffic