Following a series of reported Ukrainian drone strikes that battered critical infrastructure belonging to Russian tech giant Yandex, internet speculation ran wild. Observers across social media and various online forums pointed to dramatic, precipitous drops in HTTP traffic charts, confidently claiming that Russian bot farms, influence operations, and automated malicious networks had been decisively knocked offline.
The visual evidence appeared stark. Aggregate traffic metrics showed steep, sudden declines, leading many to conclude that the physical damage to data centers had effectively neutralized major cyber threat actors operating from within Russia. However, relying purely on aggregate traffic metrics can easily mislead analysts. A deeper inspection of the underlying network architecture reveals a far more nuanced reality.
Yandex operations are distributed across two distinct Autonomous System Numbers (ASNs): AS13238, which is utilized by the company’s primary search engine, and AS200350, which powers its cloud services. By analyzing data from Cloudflare Radar and Bot Management, cybersecurity researchers were able to separate the myth from the technical reality. While both networks experienced severe disruptions, the impact on automated traffic varied wildly depending on the role of the infrastructure. Furthermore, a closer examination of request behavior rather than broad traffic patterns proved that malicious infrastructure does not simply vanish when a physical data center goes dark; it migrates.
What Happened: The Effect of the Strikes and Pre-Event Baseline
Between October 7 and October 11, reported Ukrainian drone strikes struck three separate Yandex facilities in Russia, progressively degrading network capacity and forcing data centers offline. This physical destruction culminated on October 11 in a near-total collapse of Yandex’s network visibility. Traffic plummeted dramatically, sinking to 99% below normal baselines for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350).
Despite a brief and partial recovery in the days that followed, both networks remained heavily disrupted through October 13, settling at levels 86% to 90% below their normal operational baselines. By October 14, traffic hovered around 85% of normal volumes.
While a sharp drop in overall HTTP traffic confirms that a network has suffered a major outage, it provides zero insight into whether malicious or evasive automated bots were actually disrupted. Establishing a pre-event baseline is essential for proper context. Prior to the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare’s massive delivery network, and roughly 35.8% of traffic originating from Russian IP addresses.
Because the two affected Yandex ASNs served entirely different organizational purposes, the infrastructure outage had drastically different effects on the automated activity flowing through each one.
The Yandex Search ASN, designated as AS13238, is dedicated to search index crawling. Cloudflare’s analysis classified an overwhelming 99.5% of its requests as automated, with 93.6% of those bot requests categorized as verified entities. Traffic originating from this specific ASN performed typical search engine tasks, such as indexing web pages, rendering content, and processing images. Before the disruption, the Yandex Search ASN supplied about 7% of all bot requests originating from Russia, but a mere 0.05% of the global total.
In sharp contrast, the Yandex.Cloud ASN, designated as AS200350, operates as a commercial cloud-hosting network and carries a fundamentally different mix of automation. Approximately 95.0% of its scored requests were identified as bots, yet none of those observed bot requests were verified by Cloudflare. Instead, the automation on Yandex.Cloud behaved more like standard software applications. Nearly two-thirds of its requests transmitted data directly to websites, with many programs identifying themselves as JavaScript, Python, or Go scripts. A significantly larger share of this traffic targeted software companies compared to Yandex’s search bots. The Yandex.Cloud ASN accounted for about 2% of Russia-origin bot requests and just 0.01% of the global total.
Impact of the Event on Overall Bot Traffic
In the cybersecurity lexicon, "bot traffic" refers broadly to automated requests directed at websites across a network, including legitimate web crawlers, indexers, and automated scripts, rather than restricted social media engagement or political influence operations. As Yandex networks lost their operational capacity, the automated requests tied to those networks dropped in tandem. That outcome was entirely expected, given that nearly all traffic originating from Yandex Search and Yandex.Cloud was automated by design.
While the broad drop in total traffic was immediately visible on monitoring dashboards, analysts found no tangible evidence linking a global disruption in malicious internet activity to the offline status of Yandex infrastructure. Overall, Russian-origin bot requests fell roughly in proportion to the Yandex traffic that went offline, mirroring the fact that the vast majority of requests originating from those specific networks were automated anyway.
Prior to the disruptions, between October 1 and October 6, global bot requests accounted for 39.4% of total HTTP requests, while Russian-origin bot requests stood at 50.4% of all local HTTP traffic. Following the drone strike in Sasovo on October 7 and 8, global bot traffic remained steady at 39.2%, while Russian-origin bot traffic dipped slightly to 48%. As subsequent strikes hit Kaluga on October 9 and Vladimir on October 11, global bot traffic remained statistically flat at around 39.4% and 39.5%, while Russian-origin bot requests dropped to 42.5% and 42.2%, respectively, before stabilizing around 42.1% by October 13.
Impact on Yandex Search ASN: Less Search Crawling
The sharp decline observed on the Yandex Search ASN was almost entirely driven by a reduction in search crawling activities. A detailed sampling of requests showed that 78.1% belonged to the verified YandexBot, 11.5% to the YandexRenderResourcesBot, and 1.9% to YandexImages.
When categorized by industry, publishing and newspaper websites experienced the steepest drop, with traffic from Yandex networks falling by 44%. Approximately 90% of pre-event traffic hitting news sites from this specific ASN consisted of YandexBot indexing articles. Furthermore, 40.5% of Cloudflare customers returned HTTP 403 Forbidden responses because site owners had actively blocked the crawler. When the Yandex Search ASN went offline, website operators simply saw a reduction in search engine indexing.
Impact on Yandex.Cloud ASN: Legitimate Use and Migrating Malicious Traffic
The Yandex.Cloud network displayed a completely different profile. Following the physical strikes, bot traffic originating from Yandex.Cloud fell by roughly 40%. Several attack-like categories showed particularly sharp declines; WordPress plugin probing dropped by 90%, and scanner-identified requests plummeted by 93%. Tellingly, Cloudflare customer blocks on Yandex.Cloud traffic also fell by 70% during the event window, indicating that proportionately less malicious traffic was even reaching the web application firewall from this ASN.
When segmented by business verticals, Yandex.Cloud traffic revealed interesting operational patterns. Computer software and gambling sectors dominated the request destinations. The computer software segment was entirely expected for an ASN designed to host third-party applications and software integrations. For instance, analytics showed that major hostnames like api.cloudflare.com were prominent destinations for Yandex.Cloud request traffic. A strong majority of those requests succeeded by returning HTTP 200 status codes both before and during the event, highlighting legitimate use.
However, the gambling sector offered the clearest evidence that malicious automation did not disappear; it merely relocated. Nearly all of Yandex.Cloud’s bot requests in this category were directed at a single gambling customer account, with traffic shifting dynamically among its various hostnames. Immediately following the October 8 disruption, bot requests from Yandex.Cloud targeting this account fell to absolute zero.
Simultaneously, identical requests began appearing from alternative Russian hosting ASNs, including Radist and Selectel. This incoming traffic maintained an identical digital fingerprint across the different providers. Overall, Russian-origin bot traffic targeting gambling accounts remained essentially flat over the entire week, shifting slightly from 167.7 million to 170.1 million requests, marking a modest 1.4% increase. The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers the moment Yandex.Cloud became unavailable.
Across most industries, the share of bot requests from Yandex.Cloud returning HTTP client error responses fell significantly, driven largely by the sudden drop in attack-like probing traffic. Combined with the gambling customer analysis, this trend proves that malicious actors routing requests through Yandex.Cloud quickly shifted their operational infrastructure to alternative providers following the service disruption.
An analysis of social media traffic yielded similar conclusions regarding claims of crippled influence operations. Researchers found no unexpected anomalies in traffic originating from Russian IP addresses, which saw a minor 0.6% decrease in total traffic over the event period, while global traffic rose by 1.2%. Repeating the analysis on bot traffic interacting specifically with posting, replying, and liking endpoints on a major social media platform revealed no unexpected shifts. Russian-origin traffic to these endpoints experienced a modest 5.7% decrease, while global traffic increased by 1.1%. The available data does not support widespread claims that the physical strikes crippled social media manipulation, though researchers note that a definitive connection cannot be entirely ruled out without visibility into data outside of Cloudflare’s network.
What the Data Told Us and What It Didn’t
When traffic from Yandex networks collapsed, online speculation suggested that Russian influence operations and malicious botnets had suffered a crippling, permanent blow. Cloudflare’s empirical data tells a vastly different story, showing no evidence that the physical strikes knocked social media manipulation offline or caused a lasting disruption to malicious internet activity.
A network disruption means that specific physical servers have stopped transmitting requests, but it does not mean an automated threat has been eradicated. Modern cloud workloads are highly portable. When a data center goes dark or an IP prefix gets blocked, threat operators can easily migrate their scripts and infrastructure to another hosting provider within hours.
Ultimately, client ASN traffic volume serves as an unreliable proxy for interpreting sophisticated automated bot behavior. Defending against automated threats requires continuous inspection of actual request behavior, such as identifying shared cryptographic fingerprints, monitoring anomalous request rates, and applying robust firewall rules to sensitive endpoints regardless of the originating network. Physical infrastructure may be static, but malicious automation is inherently built to move.
Leave a Reply