Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and power operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, total traffic metrics can effortlessly mislead. There are two autonomous scheme numbers (ASNs) connected alongside Yandex: AS13238 is used by Yandex’s hunt engine, during AS200350 runs its haze services.
Using Cloudflare Radar and Bot Management data, we analyzed how these two ASNs were affected — and during the two saw drops in traffic, they saw differing impact.
- Yandex Search (AS13238): The autumn in traffic consisted nearly entirely of verified hunt crawlers indexing web pages, images, and location resources.
- Yandex.Cloud (AS200350): There was a decrease in malicious activities akin exposure scanning and probing, but high-volume automation did not disappear — it merely migrated to another hosting providers.
While malicious traffic may arise from a particular provider, it does not necessarily inform us who is liable for the traffic. Understanding why the strikes had small enduring consequence on malicious traffic requires analyzing petition behavior, fairly than fair general traffic patterns.
What happened: the consequence of the strikes and pre-event baseline
Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex accommodation in Russia, increasingly knocking data centers and network capability offline. As seen on Cloudflare Radar, this culminated in a near-total downfall of the Yandex network on October 11 whenever traffic plummeted to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Despite a concise partial recovery, the two networks remained disrupted through October 13, settling at 86-90% below normal baselines. (As of October 14 at 18:00 UTC, traffic is at 85% of normal.)
A autumn in general HTTP traffic lone confirms that the network went down. It does not disclose whether malicious or evasive bots were disrupted. Looking at the pre-event automation baseline, we can see that before the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare's network, and 35.8% of traffic from Russian IP addresses.
The outage had distinct effects on automated action on the two affected ASNs since they served distinct roles.
Yandex Search ASN (AS13238) is used for hunt indicator crawling. Cloudflare classified 99.5% of its requests as automated, and 93.6% of its bot requests as Verified. Our inspection showed that traffic from this ASN indexed pages, rendered pages, and rendered images, which is accordant behavior for a hunt crawler. The Yandex Search ASN supplied concerning 7% of Russia-origin bot requests, and fair 0.05% of the earth total.
Yandex.Cloud ASN (AS200350) is a cloud-hosting network and carries a extremely distinct mix of automation. Approximately 95.0% of its scored requests were bots, but none of its observed bot requests were verified by Cloudflare. Yandex.Cloud’s bots looked additional akin application apps: nearly two-thirds of their requests sent data to websites, several identified themselves as JavaScript, Python, or Go programs, and a larger portion went to application companies than Yandex’s hunt bots. The Yandex.Cloud ASN supplied concerning 2% of Russia-origin bot requests, and fair 0.01% of the earth total.
Impact of the event on general bot traffic
"Bot traffic" refers to automated requests to websites on Cloudflare's network, specified as crawlers and scripts, not necessarily action on social media platforms. As Yandex’s networks misplaced capacity, their bot requests cut too. That was expected: nearly all traffic from Yandex Search and Yandex.Cloud was automated. While we saw the apparent autumn in total traffic, we did not see any evidence linking a earth disruption in malicious traffic to the autumn in traffic from Yandex.
Russia-origin bot requests cut approximately in proportion to the Yandex traffic that went offline, since most requests from those networks were automated.
Date UTC+3 | Global bot requests | Russia-origin bot requests |
October 1–6: pre-event baseline | ||
October 7–8: drone attack on Sasovo | 39.2% (−0.2%) | 48% (-2.4%) |
October 9: drone attack on Kaluga | 39.4% (+0%) | 42.5% (-7.9%) |
October 11: drone attack on Vladimir | 39.5% (+0.1%) | 42.2% (−8.2%) |
October 12 | 39.6% (+0.2%) | 43.6% (−6.8%) |
October 13 | 39.5% (+0.1%) | 42.1% (−8.3%) |
* Radar reports earth traffic by the two total HTTP requests, and by HTML requests (an approximation of a leaf view). The complete array reflects total petition volume.
Impact on Yandex Search ASN (AS13238): small hunt crawling
The decrease on Yandex Search ASN was nearly entirely hunt crawling. Sampled requests showed that 78.1% belonged to verified YandexBot, 11.5% to YandexRenderResourcesBot, and 1.9% to YandexImages.
Among websites and services, the industry section that saw the steepest autumn was Publishing and Newspapers, anywhere traffic from Yandex networks cut 44%. Approximately 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles, alongside 40.5% of Cloudflare customers returning HTTP 403 Forbidden responses since the location owner blocked the crawler. When the Yandex Search ASN went offline, customers merely saw small indexing from Yandex.
Impact on Yandex.Cloud ASN (AS200350): lawful use and migrating malicious traffic
Yandex.Cloud displayed a entirely distinct profile. Following the reported strikes, bot traffic from Yandex.Cloud cut concerning 40%. Several attack-like categories showed particularly keen declines. For example, WordPress plugin probing cut 90% and scanner-identified requests cut 93%. Interestingly (and tellingly), Cloudflare client blocks on Yandex.Cloud traffic additionally cut 70% during the event period, suggesting that proportionately small malicious traffic was equal hitting the Cloudflare WAF from this ASN.
Impact on endeavor verticals
Yandex.Cloud’s bot traffic is additionally engaging whenever segmented by top petition destination industries:
Destination industry | Bot traffic pre-event | Bot traffic during event (Oct 7-13) | Change | 4xx (client error) HTTP reply position share: pre → event |
Computer software | 24.24M | 15.18M | −37.4% | 18.5% → 15.9% |
Gambling | 23.01M | 18.80M | −18.3% | 99.1% → 99.3% |
Media incl. adult | 1.33M | 223.1K | −83.3% | 82.0% → 61.8% |
Internet and telecom | 524.2K | 206.5K | −60.6% | 71.4% → 51.1% |
Travel / tourism | 363.9K | 158.1K | −56.6% | 27.0% → 12.3% |
Retail / wholesale | 316.0K | 167.7K | −46.9% | 71.0% → 55.9% |
Gaming / device games | 226.3K | 63.2K | −72.1% | 51.4% → 9.2% |
Publishing / newspapers | 90.8K | 8.8K | −90.3% | 90.2% → 61.4% |
The bulk of traffic from the Yandex.Cloud ASN cut into two industry buckets: device application and gambling. The device application bucket was predictable for an ASN meant to presenter third-party applications and application integrations. In fact, we equal saw that api.cloudflare.com is a top hostname for Yandex.Cloud petition traffic. An general bulk of that traffic succeeded (requests returned 200s) the two before and during the event, pointing to lawful usage.
The gambling field offers the clearest evidence that malicious automation relocated fairly than disappeared. Nearly all of Yandex.Cloud’s bot requests were targeted at one gambling client account, alongside traffic shifting among its hostnames. Immediately following the October 8 disruption, bot requests from Yandex.Cloud to this document dropped to zero. Simultaneously, identical requests began appearing from another Russian hosting ASNs, including Radist and Selectel. The incoming traffic maintained an identical fingerprint throughout providers:
- The identical JA4 TLS client fingerprint
- The identical rare petition paths and HTTP headers
- The identical tradition User-Agent strings
Overall, Russian bot traffic targeting gambling accounts remained basically flat complete the week, moving from 167.7 myriad to 170.1 myriad requests (+1.4%). The automation never stopped running; the operators merely migrated their workloads to substitute haze providers formerly Yandex.Cloud became unavailable.
Across most industries, the portion of bot requests from Yandex.Cloud returning any HTTP 4xx reply fell. This is mostly because of a autumn off in the attack-like traffic mentioned above. This, in blend alongside the gambling client analysis, shows that malicious traffic that was sending requests through Yandex.Cloud merely shifted its “services” to another providers following the assistance disruption.
Finally, whenever we analyzed social media traffic, we established no unexpected changes in traffic either from Russian-origin IPs (0.6% decrease in total traffic complete the event period) or globally (1.2% addition in total traffic complete the event period). We repeated the inspection on bot traffic hitting the “post”, “reply”, and “like” endpoints for a particular social media phase and likewise did not discover an unexpected change before or during the event duration from either Russian-origin IPs (5.7% decrease in total traffic complete the event period) or globally (1.1% addition in total traffic complete the event period). Based on our assessment, the data does not appear to assistance the claims that the strikes impaired social media manipulation, although without additional inspection alongside data exterior of Cloudflare, we cannot conclusively say there is no connection.
What the data told us — and what it didn’t
When traffic from Yandex networks collapsed, speculation dispersed throughout the Internet that Russian power operations and malicious botnets had suffered a crippling blow. Cloudflare data tells a distinct story: throughout Cloudflare's network, there was no evidence that the strikes knocked social media manipulation offline or alternatively disrupted malicious action on the Internet. Instead, the data demonstrated:
- Search indexing dropped. The overwhelming bulk of the traffic that dropped from Yandex Search ASN consisted of verified YandexBot crawlers fetching news articles and web assets. The chief effect was reduced satisfied finding in Yandex Search.
- Malicious automation migrated alternatively of stopping. While exposure scanning and plugin probing temporarily dropped on Yandex.Cloud, high-volume operations quickly moved to substitute hosting networks.
A network disruption method that particular servers stopped sending requests, but it does not average an automated danger disappeared. Cloud workloads are portable, so whenever a data center goes dreary or an IP prefix gets blocked, operators can migrate their scripts to another provider in hours.
Our inspection current is a reminder that client ASN traffic quantity is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting petition behavior, specified as identifying shared JA4 fingerprints, monitoring anomalous petition rates, and applying WAF rules to delicate endpoints, despite of which network the petition begins from. Physical infrastructure is static, but malicious automation is built to move.
