Skip to content

CLOUDFLARE 2026-10-14 Tier 1

Read original ↗

Yandex outage: data shows that instead of going dark, malicious bots went on the move

Summary

Following reported Ukrainian drone strikes on three Yandex data-center facilities in Russia (Oct 7–11, 2026), speculation circulated that Russian bot farms and influence operations had been knocked offline — HTTP traffic charts showed steep drops. Cloudflare used Radar + Bot Management data to show the aggregate drop is misleading. The two Yandex ASNs serve different roles: Yandex Search (AS13238), whose decline was almost entirely verified search crawlers (indexing fell), and Yandex.Cloud (AS200350), a hosting network whose malicious automation (vulnerability scanning, WordPress plugin probing) dropped locally but relocated to other Russian hosting providers rather than stopping. The post is a canonical instance of Cloudflare's alternative-explanation forensics shape: deflate a malicious-intent narrative about a Radar-visible anomaly by analyzing request behavior rather than aggregate traffic volume — the core lesson being that client-ASN traffic volume is an unreliable proxy for interpreting automated bot behavior, because cloud workloads are portable and operators migrate scripts to another provider in hours.

Key takeaways

  1. Aggregate traffic drop ≠ threat eliminated. The Yandex network collapsed to 99% below baseline (AS13238) and 90% (AS200350) on Oct 11, settling 86–90% below through Oct 13 (85% as of Oct 14 18:00 UTC). But a drop in total HTTP traffic "only confirms that the network went down. It does not reveal whether malicious or evasive bots were disrupted." (Source: sources/2026-10-14-cloudflare-yandex-outage-malicious-bots-migrated)

  2. The two ASNs had opposite automation profiles. Yandex Search (AS13238): 99.5% of requests automated, 93.6% of bot requests verified — behaving like a search crawler (indexed pages, rendered pages, rendered images); supplied ~7% of Russia-origin bot requests, 0.05% of the global total. Yandex.Cloud (AS200350): ~95.0% of scored requests bots, but none verified — looked like software apps (two-thirds sent data to websites; some self-identified as JavaScript/Python/Go programs); ~2% of Russia-origin bot requests, 0.01% global. ASN role (search vs cloud-hosting) determines the automation mix — the forensic hinge of the whole analysis.

  3. Pre-event automation baseline anchors the comparison. Before the strikes, automated requests were 36.1% of all HTTP traffic globally and 35.8% of traffic from Russian IPs. Russia-origin bot requests fell roughly in proportion to the Yandex traffic that went offline, as expected when nearly all of that traffic was automated — not evidence of a disrupted threat.

  4. Yandex Search decline = less search indexing. Sampled AS13238 requests: 78.1% verified YandexBot, 11.5% YandexRenderResourcesBot, 1.9% YandexImages. Steepest-hit vertical was Publishing/Newspapers (−44%); ~90% of pre-event news-site traffic from this ASN was YandexBot indexing, and 40.5% of Cloudflare customers already returned HTTP 403 because the site owner blocked the crawler. User-facing effect: reduced content discovery in Yandex Search.

  5. Malicious automation on Yandex.Cloud migrated, it did not vanish — the headline finding. Bot traffic from AS200350 fell ~40%; WordPress plugin probing fell 90%, scanner-identified requests fell 93%, and Cloudflare customer blocks on Yandex.Cloud traffic fell 70% (proportionately less malicious traffic even reached the WAF). The gambling-sector evidence is the clincher: nearly all of Yandex.Cloud's bot requests targeted one gambling customer account; immediately after the Oct 8 disruption those requests dropped to zero while identical requests began appearing from other Russian hosting ASNs — Radist and Selectel — carrying an identical fingerprint across providers: the same JA4 TLS client fingerprint, the same uncommon request paths + HTTP headers, the same custom User-Agent strings. Russian bot traffic to the gambling account stayed essentially flat over the week (167.7M → 170.1M requests, +1.4%). "The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers."

  6. Legitimate Yandex.Cloud usage is real too. The two biggest destination buckets were computer software (expected for a third-party-app hosting ASN — api.cloudflare.com was a top hostname) and gambling. Software traffic mostly succeeded (200s) before and during, pointing to legitimate usage; the attack-like categories are what dropped.

  7. No evidence the strikes crippled social-media manipulation. Social-media traffic showed no unexpected shift from Russian IPs (−0.6% total) or globally (+1.2%); repeating the analysis on "post"/"reply"/"like" endpoints for a specific platform likewise found no unexpected before/during-event shift (RU −5.7%, global +1.1%). Cloudflare states it cannot conclusively rule out a connection without data beyond its own network, but its data does not support the claim.

  8. Defense lesson — inspect behavior, not origin. "Client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior." Defending against automated threats requires inspecting request behavior — identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints — regardless of which network the request originates from. "Physical infrastructure is static, but malicious automation is built to move."

Systems / concepts / patterns extracted

  • Cloudflare Radar — the per-ASN / per-country traffic-measurement substrate; here used in its alternative-explanation forensics role (sibling to the Venezuela BGP-anomaly deflation) to quantify the Yandex-network collapse and the pre-event automation baseline.
  • Bot Management — scores every request (bot vs human, verified vs unverified) and supplies the automation-profile split between the two ASNs; the enforcement/visibility surface behind the WordPress-probing and scanner-request categories.
  • Autonomous System (ASN) — the unit of traffic-origin attribution. The whole analysis turns on two Yandex ASNs with different roles and on malicious traffic re-appearing under different hosting ASNs (Radist, Selectel) — the canonical demonstration that ASN is where traffic originates, not who is responsible for it, and that ASN traffic volume is a poor proxy for bot behavior.
  • Verified bots — the verified/unverified split (93.6% of AS13238 bot requests verified vs 0% of AS200350) is exactly the signal that separates legitimate search crawling from anonymous automation; the verified-bots program is the structural answer to "which automation do I trust."
  • JA4 TLS client fingerprint (plain-text; no page) — the behavioral primitive that let Cloudflare prove workload migration: the same JA4 + request paths + headers + custom User-Agents appeared on Radist and Selectel the moment Yandex.Cloud went dark. Recorded as the ja4-fingerprint tag and under ml-bot-fingerprinting; single-source named idea.
  • Malicious-automation migration / workload portability (plain-text; no page) — "Cloud workloads are portable, so when a data center goes dark or an IP prefix gets blocked, operators can migrate their scripts to another provider in hours." Recorded as the workload-portability / malicious-automation-migration tags; single-source named idea, Lint candidate at ≥3 citations.
  • Request-behavior-over-aggregate-traffic (plain-text; no page) — the core methodological lesson; recorded as a tag + enriched into concepts/autonomous-system and concepts/anomaly-detection.

Operational numbers

  • Strikes: Oct 7–8 Sasovo, Oct 9 Kaluga, Oct 11 Vladimir.
  • Traffic collapse (Oct 11): AS13238 −99%, AS200350 −90%; settling 86–90% below baseline through Oct 13; 85% of normal at Oct 14 18:00 UTC.
  • Pre-event automation share: 36.1% global, 35.8% Russian IPs.
  • Global bot-request share held ~39.2–39.6% Oct 7–13 (essentially flat); Russia-origin bot share fell from 50.4% (Oct 1–6 baseline) to ~42%.
  • AS13238: 99.5% automated, 93.6% of bots verified; sampled 78.1% YandexBot / 11.5% YandexRenderResourcesBot / 1.9% YandexImages; Publishing/Newspapers −44%; 40.5% of customers already returning 403.
  • AS200350: ~95.0% bots, 0% verified; bot traffic −40%; WordPress plugin probing −90%; scanner requests −93%; customer blocks −70%.
  • Gambling account: 167.7M → 170.1M requests over the week (+1.4%), effectively flat despite the Yandex.Cloud collapse.
  • Destination-industry bot traffic (pre → event): Computer software 24.24M → 15.18M (−37.4%); Gambling 23.01M → 18.80M (−18.3%); Media incl. adult 1.33M → 223.1K (−83.3%); Internet/telecom 524.2K → 206.5K (−60.6%); Gaming 226.3K → 63.2K (−72.1%); Publishing 90.8K → 8.8K (−90.3%).
  • Social media: RU total −0.6%, global +1.2%; post/reply/like endpoints RU −5.7%, global +1.1% — no unexpected shift.

Caveats

  • All figures are Cloudflare-network-visible only; the social-media conclusion is explicitly hedged ("without further analysis with data outside of Cloudflare, we cannot conclusively say there is no connection").
  • "Bot traffic" here = automated HTTP requests to websites on Cloudflare's network (crawlers/scripts), not social-platform posting activity.
  • The migration finding rests on fingerprint identity (JA4 + paths + headers + UA) across providers for one dominant gambling account; it is strong circumstantial attribution, not a claim about operator identity (ASN tells you where, not who).

Source

Last updated · 854 distilled / 2,448 read