In the wake of reported Ukrainian drone strikes targeting critical Yandex data center infrastructure in Russia, widespread speculation swept across the internet. Viral claims suggested that the physical damage to Russia’s tech giant had successfully knocked massive bot farms and state-backed influence operations offline. HTTP traffic charts showcasing steep, sudden drops across Yandex-affiliated networks appeared to lend immediate credibility to these assertions, painting a picture of malicious cyber infrastructure brought to a grinding halt by kinetic warfare.
However, a deep-dive analysis by Cloudflare Radar and Bot Management data reveals that aggregate traffic metrics can easily mislead. While the physical infrastructure undoubtedly suffered catastrophic disruption, a closer examination of request behavior rather than raw traffic volume tells a vastly different story. The data shows that the strikes did not cripple Russian bot activity or silence online influence campaigns; instead, malicious operators seamlessly migrated their flexible workloads to alternative cloud hosting providers within hours, proving once again that digital threats are fundamentally portable while physical infrastructure remains static.
What Happened: The Effect of the Strikes and Pre-Event Baseline
Between October 7 and 11, a series of reported drone strikes struck three distinct Yandex facilities situated in Sasovo, Kaluga, and Vladimir, progressively degrading and knocking network capacity offline. According to telemetry from Cloudflare Radar, this wave of attacks culminated in a near-total collapse of the Yandex network architecture on October 11. Traffic plummeted to 99 percent below the pre-event baseline for Yandex Search, which operates under Autonomous System Number AS13238. Simultaneously, traffic dropped by 90 percent for Yandex.Cloud, which runs on ASN AS200350.
Despite a brief and partial recovery in the days that followed, both networks remained severely impaired through October 13, settling at levels 86 to 90 percent below normal baselines. By October 14, traffic hovered around 85 percent of normal capacity.
Before these disruptions, automated requests formed a massive component of global and regional internet traffic. Between October 1 and 6, automated requests accounted for 36.1 percent of all HTTP traffic observed globally across Cloudflare’s extensive content delivery network, and 35.8 percent of traffic originating from Russian IP addresses specifically.
Yet, the outage impacted automated activity on the two affected ASNs in markedly different ways because each system served a completely distinct operational role. The Yandex Search ASN (AS13238) is dedicated entirely to search index crawling. Cloudflare classified a staggering 99.5 percent of its requests as automated, with 93.6 percent of those bot requests identified as verified search crawlers. Traffic analysis confirmed that this ASN was actively indexing pages, rendering websites, and processing images—classic behaviors for a legitimate search engine. Prior to the strikes, the Yandex Search ASN supplied about 7 percent of Russia-origin bot requests, but a mere 0.05 percent of the global total.
In contrast, the Yandex.Cloud ASN (AS200350) functions as a commercial cloud-hosting network carrying a significantly different mix of automation. Approximately 95.0 percent of its scored requests were automated, but none of these observed bot requests carried verification from Cloudflare. Instead, traffic from Yandex.Cloud closely resembled software applications: nearly two-thirds of its requests transmitted data directly to websites, with many clients explicitly identifying themselves as JavaScript, Python, or Go programs. A larger share of this traffic targeted software companies compared to Yandex’s search bots. The Yandex.Cloud ASN accounted for roughly 2 percent of Russia-origin bot requests and just 0.01 percent of the global total.
Impact of the Event on Overall Bot Traffic
Because nearly all traffic coursing through the Yandex Search and Yandex.Cloud networks was automated by design, the physical network outages predictably triggered an immediate drop in bot requests originating from those specific IP blocks. Russia-origin bot requests fell roughly in proportion to the volume of Yandex traffic that went offline.
In the pre-event baseline window from October 1 to 6, global bot requests sat at 39.4 percent of all HTTP requests, while Russia-origin bot requests accounted for 50.4 percent of traffic from Russian IPs. As the drone strikes unfolded—hitting Sasovo on October 7 and 8, Kaluga on October 9, and Vladimir on October 11—Russia-origin bot requests experienced measurable dips, falling to 48 percent, 42.5 percent, and 42.2 percent respectively, before hovering around 42.1 percent by October 13. Global bot traffic percentages, however, remained virtually flat, showing no noticeable global disruption.
While the drop in total traffic from Yandex was undeniable, analysts found no evidence linking this localized infrastructure failure to any broader, global reduction in malicious internet activity.
Impact on Yandex Search ASN: Less Search Crawling
For the Yandex Search ASN, the dramatic decline in traffic was almost entirely composed of suppressed search engine crawling. Sampled request data demonstrated that 78.1 percent of the traffic belonged to the verified YandexBot, 11.5 percent to YandexRenderResourcesBot, and 1.9 percent to YandexImages.
When examining traffic trends across various industry segments, publishing and newspaper websites experienced the steepest decline, with traffic from Yandex networks falling by 44 percent. Approximately 90 percent of pre-event traffic hitting news sites from this specific ASN consisted of YandexBot indexing articles. Interestingly, 40.5 percent of Cloudflare customers operating news sites routinely returned HTTP 403 Forbidden responses because site owners actively blocked the crawler. When the Yandex Search ASN went offline, webmasters simply observed a drop in uninvited or blocked search indexing attempts.
Impact on Yandex.Cloud ASN: Legitimate Use and Migrating Malicious Traffic
The Yandex.Cloud network displayed a vastly different threat and traffic profile. Following the infrastructure strikes, bot traffic originating from Yandex.Cloud dropped by roughly 40 percent. Several attack-oriented categories witnessed particularly sharp declines; WordPress plugin probing plummeted by 90 percent, and scanner-identified requests dropped by 93 percent. Furthermore, Cloudflare customer security blocks on Yandex.Cloud traffic fell by 70 percent during the event period, indicating that a significantly smaller volume of suspicious traffic was even reaching the Cloudflare Web Application Firewall from this provider.
When segmented by destination industries, Yandex.Cloud bot traffic was heavily concentrated in computer software and online gambling. The computer software category was a natural expectation for a cloud infrastructure network hosting third-party applications and software integrations. Analysis revealed that a prominent hostname for Yandex.Cloud request traffic was api.cloudflare.com. An overwhelming majority of these requests succeeded, returning standard HTTP 200 OK responses both before and during the event, highlighting extensive legitimate usage.
The online gambling sector, however, provided the most compelling evidence that malicious automation did not vanish, but merely relocated. Nearly all bot requests originating from Yandex.Cloud and targeting gambling customer accounts were concentrated on a single targeted account, with traffic shifting dynamically among its various hostnames. Immediately following the October 8 disruption, bot requests from Yandex.Cloud directed at this account dropped completely to zero.
Simultaneously, however, identical requests began appearing from alternative Russian hosting autonomous systems, including Radist and Selectel. This incoming traffic maintained an identical technical fingerprint across the new providers. Overall, Russian bot traffic targeting gambling accounts remained essentially flat throughout the week, shifting slightly from 167.7 million to 170.1 million requests, representing a 1.4 percent increase. The automation scripts never stopped executing; operators simply migrated their operational workloads to alternative cloud infrastructure providers the moment Yandex.Cloud became unavailable.
Across most industry sectors, the proportion of bot requests from Yandex.Cloud returning HTTP client error responses decreased, driven largely by the sudden drop-off in attack-like traffic. This data, combined with the migration patterns observed in the gambling sector, demonstrates that malicious actors seamlessly redirected their automated services to alternative hosting providers in the wake of the physical disruptions.
Finally, an analysis of social media traffic revealed no unexpected anomalies or shifts. Traffic originating from Russian IP addresses saw a modest 0.6 percent decrease in total traffic over the event period, while global social media traffic increased by 1.2 percent. A deeper examination focusing specifically on bot traffic hitting "post," "reply," and "like" endpoints on a specific major social media platform similarly showed no unusual statistical deviations before or during the event period, either from Russian IPs or globally. Consequently, available network telemetry does not support widespread internet claims that the physical strikes crippled organized social media manipulation networks, though definitive conclusions regarding broader influence operations would require intelligence beyond network-layer visibility.
What the Data Told Us—and What It Didn’t
When traffic across Yandex networks collapsed, rumors spread rapidly that Russian influence operations and malicious botnets had suffered a crippling, definitive blow. Cloudflare’s comprehensive data tells a fundamentally different story, uncovering no evidence that the physical strikes knocked social media manipulation offline or suppressed broader malicious activity across the wider internet.
The incident underscores a fundamental reality of modern cybersecurity: a network disruption means that specific physical servers have stopped transmitting requests, but it does not mean an automated threat has been eradicated. Cloud-based workloads and malicious scripts are inherently portable. When a data center goes dark or an IP prefix gets blocked by kinetic action or administrative action, operators can easily reconfigure and migrate their automation scripts to alternative hosting providers within hours.
Ultimately, client ASN traffic volume serves as an unreliable proxy for interpreting automated bot behavior. Defending against modern automated threats requires rigorous inspection of underlying request behavior—such as identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying robust WAF rules to sensitive endpoints—regardless of the network origin. Physical infrastructure may be static and vulnerable to disruption, but malicious automation is engineered to move.
Leave a Reply