Claims that drone strikes on Yandex data centers had knocked Russian bot farms and influence operations offline spread quickly, backed by HTTP traffic charts showing steep drops. Aggregate traffic volume hides more than it reveals. Yandex operates two separate autonomous system numbers: AS13238 for its search engine and AS200350 for its cloud services, and Cloudflare Radar and Bot Management data show the two were affected in very different ways.
On Yandex Search (AS13238), the traffic that disappeared was almost entirely verified search crawlers indexing pages, images, and site resources. On Yandex.Cloud (AS200350), vulnerability scanning and probing declined, but high-volume automation did not disappear — it moved to other hosting providers. Traffic originating from a given provider says nothing about who is behind it; understanding the lack of lasting impact requires looking at request behavior rather than top-line traffic patterns.
Timeline and magnitude of the disruption
Reported Ukrainian drone strikes hit three Yandex facilities in Russia between October 7 and 11, progressively taking data centers and network capacity offline. On Cloudflare Radar, the collapse peaked on October 11, with traffic falling to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). After a brief partial recovery, both networks stayed disrupted through October 13, settling at 86–90% below normal baselines. As of October 14 at 18:00 UTC, traffic stood at 85% of normal.
A drop in total HTTP traffic confirms the network went down, but says nothing about whether malicious or evasive bots were affected. Before the strikes, automated requests made up 36.1% of all HTTP traffic observed globally across Cloudflare's network and 35.8% of traffic from Russian IP addresses.
Two ASNs, two automation profiles
Yandex Search (AS13238) handles search index crawling. Cloudflare classified 99.5% of its requests as automated, and 93.6% of its bot requests as Verified. Traffic from this ASN indexed pages, rendered pages, and rendered images — behavior consistent with a search crawler. It supplied about 7% of Russia-origin bot requests and 0.05% of the global total.
Yandex.Cloud (AS200350) hosts third-party applications and integrations, and its automation mix looks entirely different. Roughly 95.0% of scored requests were bots, and none of the observed bot requests were Verified. Nearly two-thirds of Yandex.Cloud bot requests sent data to websites, some identified themselves as JavaScript, Python, or Go programs, and a larger share targeted software companies than Yandex's search bots did. This ASN supplied about 2% of Russia-origin bot requests and 0.01% of the global total.
What fell, and what moved
Since nearly all traffic from both networks was automated, bot request volumes fell alongside total capacity, and Russia-origin bot requests dropped roughly in proportion to the Yandex traffic that went offline. No evidence tied that drop to a global disruption in malicious activity.
Date UTC+3 | Global bot requests | Russia-origin bot requests |
October 1–6: pre-event baseline | ||
October 7–8: drone strike on Sasovo | 39.2% (−0.2%) | 48% (-2.4%) |
October 9: drone strike on Kaluga | 39.4% (+0%) | 42.5% (-7.9%) |
October 11: drone strike on Vladimir | 39.5% (+0.1%) | 42.2% (−8.2%) |
October 12 | 39.6% (+0.2%) | 43.6% (−6.8%) |
October 13 | 39.5% (+0.1%) | 42.1% (−8.3%) |
* Radar reports global traffic by both total HTTP requests and HTML requests (an approximation of a page view). The above table reflects total request volume.
Search crawling on AS13238
The decline on Yandex Search was almost entirely crawl traffic. Sampled requests broke down as 78.1% verified YandexBot, 11.5% YandexRenderResourcesBot, and 1.9% YandexImages. Publishing and Newspapers saw the steepest drop by industry segment, with traffic from Yandex networks falling 44%; roughly 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles, and 40.5% of Cloudflare customers returned HTTP 403 Forbidden because the site owner blocked the crawler. When the ASN went offline, customers simply saw less indexing from Yandex.
Cloud traffic and vertical distribution on AS200350
Bot traffic from Yandex.Cloud fell about 40% after the strikes, with attack-like categories dropping harder: WordPress plugin probing fell 90% and scanner-identified requests fell 93%. Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event, suggesting proportionately less malicious traffic was reaching the Cloudflare WAF from this ASN at all. Across most industries, the share of Yandex.Cloud bot requests returning any HTTP 4xx response declined, largely because of the drop in attack-like traffic.
Destination industry | Bot traffic pre-event | Bot traffic during event (Oct 7-13) | Change | 4xx (client error) HTTP response status share: pre → event |
Computer software | 24.24M | 15.18M | −37.4% | 18.5% → 15.9% |
Gambling | 23.01M | 18.80M | −18.3% | 99.1% → 99.3% |
Media incl. adult | 1.33M | 223.1K | −83.3% | 82.0% → 61.8% |
Internet and telecom | 524.2K | 206.5K | −60.6% | 71.4% → 51.1% |
Travel / tourism | 363.9K | 158.1K | −56.6% | 27.0% → 12.3% |
Retail / wholesale | 316.0K | 167.7K | −46.9% | 71.0% → 55.9% |
Gaming / computer games | 226.3K | 63.2K | −72.1% | 51.4% → 9.2% |
Publishing / newspapers | 90.8K | 8.8K | −90.3% | 90.2% → 61.4% |
Two industry buckets dominated Yandex.Cloud request traffic: computer software and gambling. Computer software is predictable for an ASN hosting third-party applications and integrations — api.cloudflare.com is a top hostname for this traffic, and a majority of it returned 200s before and during the event, pointing to legitimate use.
Gambling provides the clearest evidence of relocation. Nearly all of Yandex.Cloud's bot requests targeted a single gambling customer account, shifting among its hostnames. Immediately after the October 8 disruption, bot requests from Yandex.Cloud to that account fell to zero, while identical requests began arriving from other Russian hosting ASNs, including Radist and Selectel. The incoming traffic kept an identical fingerprint across providers: the same JA4 TLS client fingerprint, the same uncommon request paths and HTTP headers, and the same custom User-Agent strings. Russian bot traffic targeting gambling accounts stayed essentially flat over the week, moving from 167.7 million to 170.1 million requests (+1.4%). The workloads moved to alternate cloud providers once Yandex.Cloud became unavailable.
Social media manipulation: no visible break
Social media traffic showed no unexpected change either from Russian-origin IPs (0.6% decrease in total traffic over the event period) or globally (1.2% increase). The same analysis repeated on bot traffic hitting the "post", "reply", and "like" endpoints of a specific social media platform found no unexpected shift from Russian-origin IPs (5.7% decrease) or globally (1.1% increase). The data does not appear to support claims that the strikes crippled social media manipulation, though without data from outside Cloudflare no conclusive answer is possible.
Reading infrastructure outages correctly
Two findings stand out. Search indexing fell: the bulk of traffic lost from Yandex Search consisted of verified YandexBot crawlers fetching news articles and web assets, so the main consequence was reduced content discovery in Yandex Search. And malicious automation migrated rather than stopped: vulnerability scanning and plugin probing dipped on Yandex.Cloud, but high-volume operations moved quickly to alternative hosting networks.
A network disruption means specific servers stopped sending requests; it does not mean an automated threat disappeared. Cloud workloads are portable, so when a data center goes dark or an IP prefix is blocked, operators can move scripts to another provider within hours. Client ASN traffic volume is an unreliable proxy for bot behavior. Defending against automated threats means inspecting request behavior — spotting shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints — no matter which network the request comes from. Physical infrastructure is static; malicious automation is built to move.
