Yandex outage: malicious bots migrated instead of stopping, Cloudflare data shows

Yandex network collapse after reported strikes

Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. According to Cloudflare Radar, this culminated in a near-total collapse of the Yandex network on October 11, when traffic plummeted to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Despite a brief partial recovery, both networks remained disrupted through October 13, settling at 86-90% below normal baselines. As of October 14 at 18:00 UTC, traffic stood at 85% of normal.

Before the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare's network and 35.8% of traffic from Russian IP addresses. The outage affected the two Yandex ASNs differently because they served different roles.

Search crawling dropped on Yandex Search ASN

Yandex Search (AS13238) is used for search index crawling. Cloudflare classified 99.5% of its requests as automated and 93.6% of its bot requests as Verified. Sampled requests showed 78.1% belonged to verified YandexBot, 11.5% to YandexRenderResourcesBot and 1.9% to YandexImages. The steepest drop was in Publishing and Newspapers, where traffic from Yandex networks fell 44%. Approximately 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles, and 40.5% of Cloudflare customers returned HTTP 403 Forbidden responses because the site owner blocked the crawler. When the ASN went offline, customers simply saw less indexing from Yandex.

Malicious automation migrated from Yandex.Cloud

Yandex.Cloud (AS200350) is a cloud-hosting network with a very different profile. Approximately 95.0% of its scored requests were bots, but none were verified by Cloudflare. Following the strikes, bot traffic from Yandex.Cloud fell about 40%. WordPress plugin probing fell 90% and scanner-identified requests fell 93%, while Cloudflare customer blocks on Yandex.Cloud traffic also fell 70%.

The gambling sector offered the clearest evidence that malicious automation relocated rather than disappeared. Nearly all of Yandex.Cloud's bot requests targeted one gambling customer account. After the October 8 disruption, requests from Yandex.Cloud to this account dropped to zero, while identical requests began appearing from other Russian hosting ASNs, including Radist and Selectel, maintaining the same JA4 TLS client fingerprint, request paths, HTTP headers and custom User-Agent strings. Overall, Russian bot traffic targeting gambling accounts remained essentially flat, moving from 167.7 million to 170.1 million requests (+1.4%).

No evidence of disrupted influence operations

Across Cloudflare's network, global bot requests stayed roughly flat at 39.2-39.6% of all HTTP requests during the event, compared with a 39.4% pre-event baseline. Russia-origin bot requests fell from 50.4% to around 42-43%, roughly in proportion to the Yandex traffic that went offline. Cloudflare also analyzed social media traffic and found no unexpected changes, either from Russian-origin IPs (0.6% decrease in total traffic over the event period) or globally (1.2% increase).

Based on its assessment, the data does not appear to support claims that the strikes crippled social media manipulation, though Cloudflare noted it cannot conclusively rule out a connection without data from outside its network. The company concluded that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior, and that defending against automated threats requires inspecting request behavior, such as shared JA4 fingerprints and anomalous request rates, regardless of which network a request originates from.

Sources: The Cloudflare Blog