Following reported strikes on Yandex data centers, there were claims that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, leading to speculation that infrastructure damage had halted these malicious actors. However, aggregate traffic metrics can be misleading. Yandex operates under two autonomous system numbers (ASNs): AS13238 for its search engine and AS200350 for its cloud services.
Using Cloudflare Radar and Bot Management data, we analyzed the impact on these two ASNs. Both experienced drops in traffic, but the effects differed. Between October 7 and 11, Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. On October 11, traffic plummeted to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). After a brief partial recovery, both networks remained disrupted through October 13, settling at 86-90% below normal baselines. As of October 14 at 18:00 UTC, traffic was at 85% of normal.
A decline in overall HTTP traffic indicates that the network went down but does not confirm whether malicious or evasive bots were affected. Before the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare's network and 35.8% of traffic from Russian IP addresses.
The outage affected automated activity on the two ASNs differently due to their distinct roles. Yandex Search ASN (AS13238) is used for search index crawling, with Cloudflare classifying 99.5% of its requests as automated and 93.6% as verified. This ASN supplied about 7% of Russia-origin bot requests and just 0.05% of the global total.
In contrast, Yandex.Cloud ASN (AS200350) is a cloud-hosting network with approximately 95.0% of its scored requests classified as bots, but none were verified by Cloudflare. The bot requests from Yandex.Cloud resembled software applications, with a significant portion targeting software companies rather than Yandex’s search bots. This ASN supplied about 2% of Russia-origin bot requests and just 0.01% of the global total.
As Yandex’s networks lost capacity, their bot requests decreased as expected, given that nearly all traffic from Yandex Search and Yandex.Cloud was automated. While there was a notable drop in total traffic, there was no evidence linking a global disruption in malicious traffic to the drop in traffic from Yandex.
Russia-origin bot requests fell in proportion to the Yandex traffic that went offline, as most requests from those networks were automated. The decline on Yandex Search ASN was primarily due to search crawling, with sampled requests showing that 78.1% belonged to verified YandexBot.
The industry segment that saw the steepest drop was Publishing and Newspapers, where traffic from Yandex networks fell 44%. Approximately 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles. When the Yandex Search ASN went offline, customers experienced less indexing from Yandex.
Yandex.Cloud displayed a different profile, with bot traffic falling about 40% following the strikes. Several attack-like categories showed sharp declines, with Cloudflare customer blocks on Yandex.Cloud traffic also falling 70% during the event period, indicating that less malicious traffic was hitting the Cloudflare WAF from this ASN.
Most traffic from Yandex.Cloud was directed at two industries: computer software and gambling. The gambling sector showed that malicious automation relocated rather than disappeared. After the October 8 disruption, bot requests from Yandex.Cloud to a specific gambling account dropped to zero, while identical requests began appearing from other Russian hosting ASNs.
Overall, Russian bot traffic targeting gambling accounts remained essentially flat over the week, moving from 167.7 million to 170.1 million requests (+1.4%). The operators migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable.
Analysis of social media traffic revealed no unexpected changes in traffic from Russian-origin IPs (0.6% decrease) or globally (1.2% increase) over the event period. The data does not support claims that the strikes crippled social media manipulation or disrupted malicious activity on the Internet.
The analysis indicates that a network disruption means specific servers stopped sending requests, but it does not imply that automated threats disappeared. Cloud workloads are portable, allowing operators to migrate their scripts to another provider quickly. This analysis serves as a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Defending against automated threats requires inspecting request behavior, including identifying shared JA4 fingerprints and monitoring anomalous request rates.