Yandex outage: data suggests malicious bots moved rather than went dark

When reported strikes hit Yandex data centers in October, charts showing a steep drop in Russian traffic led many to assume the country's bot farms and influence operations had been knocked offline. According to a new analysis from Cloudflare, that reading is misleading: the traffic that fell was mostly search crawling, while malicious automation reportedly migrated to other networks.

What's happening

Cloudflare says that between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. The company's Radar data shows a near-total collapse on October 11, when traffic fell to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Both networks remained disrupted through October 13, settling at roughly 86–90% below normal; as of October 14, traffic was reportedly back at about 85% of normal.

The key point, according to Cloudflare, is that a drop in total traffic only proves a network went down — it does not tell you whether malicious bots were actually disrupted. The two Yandex networks behaved very differently. On the Yandex Search ASN, Cloudflare classified 99.5% of requests as automated, and 93.6% of those bot requests as "Verified"; the drop there was almost entirely search crawlers indexing pages, images and site resources. The Yandex.Cloud ASN carried a different mix: about 95% of its scored requests were bots, none of them verified, and those bots behaved more like software applications, with some identifying themselves as JavaScript, Python or Go programs.

On Yandex.Cloud, some attack-like activity did dip: bot traffic fell about 40%, scanner-identified requests fell 93% and WordPress plugin probing fell 90%. But Cloudflare says the sharpest illustration came from a single gambling sector: nearly all of Yandex.Cloud's bot requests were aimed at one gambling customer account, and immediately after the October 8 disruption, requests from Yandex.Cloud to that account dropped to zero. At the same time, identical requests reportedly began arriving from other Russian hosting networks, including Radist and Selectel, carrying the same JA4 TLS fingerprint, the same unusual request paths and headers, and the same custom User-Agent strings. Overall Russian bot traffic targeting gambling accounts was essentially flat over the week, moving from 167.7 million to 170.1 million requests — a rise of about 1.4%.

Cloudflare also says it found no unexpected change in social media traffic, concluding that its data "does not appear to support" the claims that the strikes crippled social media manipulation — though it notes it cannot be conclusive without data from outside its own network.

Who's affected

Website owners and security teams, who may wrongly discount a bot threat because a source network appears to have gone quiet.
Newspapers and publishers, which Cloudflare says saw the steepest drop in Yandex traffic — mostly a loss of search indexing rather than anything malicious.
Analysts, journalists and researchers reading public traffic charts, since aggregate numbers can easily mislead about bot behaviour.
Targets of automated abuse, such as gambling sites and other high-volume endpoints, which reportedly kept receiving the same traffic from new hosts.

What to do

Do not treat ASN traffic volume as a proxy for threat. Cloudflare's conclusion is that client-network traffic is an unreliable way to judge whether bots are gone.
Inspect request behaviour, not just origin. Look for shared fingerprints such as identical JA4 TLS values, unusual request paths and headers, and repeated custom User-Agent strings.
Watch rates and endpoints. Monitor anomalous request rates and apply WAF rules to sensitive endpoints, regardless of which network a request comes from.
Assume portability. Because cloud workloads can be moved to another provider within hours, a data-center outage does not mean an automated campaign has stopped.

Sources

Cloudflare — the primary analysis, using Radar and Bot Management data, on how traffic from Yandex Search and Yandex.Cloud changed and how malicious bots migrated.
Tom's Hardware — reports that Cloudflare tracked roughly 170 million automated attacks shifting to alternate cloud hosts after the strikes.