TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cloudflare’s analysis of an October disruption to Yandex’s networks found that search-crawler traffic fell with Yandex Search, while some scanning activity declined on Yandex.Cloud. It found no evidence of a corresponding global drop in automated traffic; Cloudflare said high-volume automation appeared to shift to other hosting providers.
Cloudflare’s analysis of a major Yandex network disruption found that automated traffic fell on Yandex’s search and cloud networks, but did not show a corresponding decline in global bot activity. The finding challenges online claims that reported strikes on Yandex facilities had knocked Russian bot farms and influence operations offline: Cloudflare said much of the drop involved search crawlers, while some high-volume automation on Yandex.Cloud appeared to move to other providers.
Cloudflare said reported Ukrainian drone strikes hit three Yandex facilities in Russia between October 7 and 11, reducing network capacity. On October 11, its Radar data showed traffic at 99% below baseline for Yandex Search and 90% below baseline for Yandex.Cloud. Both networks remained heavily disrupted through October 13. At 18:00 UTC on October 14, Cloudflare reported traffic at 85% of normal; the source does not specify in that update which ASN the figure describes.
The two networks had different functions. Yandex Search, identified as AS13238, carried traffic Cloudflare classified overwhelmingly as automated: 99.5% of its scored requests were bots, and 93.6% of those bot requests were verified. Sampled traffic was largely attributable to Yandex’s search, rendering and image crawlers. Yandex.Cloud, AS200350, also had a high share of bot requests, but none of its observed bots were verified by Cloudflare. Its traffic included software-like requests and scanning behavior.
Cloudflare said bot traffic on Yandex.Cloud fell about 40% after the reported strikes. WordPress plugin probing declined 90%, and requests identified as scanning fell 93%. The company also reported that its customers’ blocks of Yandex.Cloud traffic decreased 70%. These changes indicate less activity observed from that network, but do not by themselves establish who operated the traffic or why it moved.
Why a Network Drop Does Not End Bots
The report highlights the difference between a hosting network going offline and automated activity disappearing. Overall HTTP traffic measures requests reaching a network; it cannot, on its own, determine whether those requests were malicious, legitimate crawlers or software tools, or whether their operators continued from elsewhere.
Cloudflare found that global bot requests remained broadly steady during the period. Its table put bots at 39.4% of all global HTTP requests during the October 1–6 baseline, then between 39.2% and 39.6% from October 7 through 13. Those figures do not support a clear global collapse in automated traffic. Cloudflare said high-volume automation appeared to migrate to other hosting providers, though the supplied analysis does not quantify how much activity moved or identify the operators.
For site owners, the distinction matters operationally: fewer requests from a particular ASN can mean less crawling or scanning from that source, without proving that the underlying activity has stopped. The data also cautions against treating traffic associated with a provider as proof that the provider—or any particular group—was responsible.
As an affiliate, we earn on qualifying purchases.
Two Yandex Networks, Different Traffic
Cloudflare examined AS13238, used by Yandex Search, separately from AS200350, which carries Yandex.Cloud services. Treating them as one network would obscure the difference between search indexing and cloud-hosted automation. The report says Yandex Search supplied about 7% of Russia-origin bot requests and 0.05% of the global total; Yandex.Cloud supplied about 2% of Russia-origin bot requests and 0.01% globally.
Before the strikes, Cloudflare measured automated requests at 36.1% of all HTTP traffic across its network and 35.8% of traffic from Russian IP addresses. Its event-period table uses a separate October 1–6 baseline: 39.4% of global requests and 50.4% of Russia-origin requests were bots. The source does not explain the difference between these baseline figures, so they should not be treated as interchangeable. The table shows Russia-origin bot share falling to 42.1%–43.6% from October 12–13, while the global share stayed near its baseline.
On Yandex Search, Cloudflare’s sampled requests included 78.1% YandexBot, 11.5% YandexRenderResourcesBot and 1.9% YandexImages. Publishing and newspaper traffic from Yandex networks fell 44%; Cloudflare said about 90% of pre-event traffic from that ASN to news sites was YandexBot indexing articles. It also reported that 40.5% of its customers returned HTTP 403 responses to the crawler, indicating those site owners blocked it.
“High-volume automation did not vanish — it simply migrated to other hosting providers.”
— Cloudflare, on the Yandex.Cloud traffic shift
As an affiliate, we earn on qualifying purchases.
What the Traffic Data Cannot Prove
Cloudflare’s measurements cover requests observed on its own network and classify traffic using its Radar and Bot Management systems. They do not establish the identity, location or intent of the people behind a request. In particular, traffic originating from a provider is not proof that the provider was responsible for malicious activity or that the activity was part of an influence operation.
The report says high-volume automation moved to other hosting providers, but the supplied material gives no destination providers, volume estimate or attribution to specific bot farms. It also does not establish whether the strikes caused every observed decline, or how long the changes lasted. The October 14 traffic snapshot is a dated status update, not a full account of subsequent recovery.
As an affiliate, we earn on qualifying purchases.
Watch for Network Recovery and Migration
The next indicators are whether Yandex’s two networks recover toward normal traffic levels and whether automated requests return to those ASNs or continue appearing elsewhere. Cloudflare’s October 14 snapshot placed traffic at 85% of normal, while the analysis described substantial disruption through October 13. The source provides no later recovery schedule or further traffic readings.
Any new claim that the outage stopped malicious operations would require evidence beyond a fall in traffic from Yandex. Cloudflare’s approach points to the need to compare request behavior across providers and over time, while keeping crawler activity distinct from suspicious scanning and avoiding attribution based only on network origin.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Cloudflare report about the Yandex outage?
Cloudflare said reported strikes from October 7 to 11 were followed by steep traffic declines on Yandex Search and Yandex.Cloud. Its data did not show a matching global drop in bot requests.
Did the outage stop malicious bots?
The analysis does not establish that. Cloudflare observed declines in some scanning activity on Yandex.Cloud, but said high-volume automation appeared to move to other hosting providers. It did not identify the operators.
What was the difference between Yandex Search and Yandex.Cloud?
Cloudflare classified most observed Yandex Search bot traffic as verified crawling, including page and image indexing. Yandex.Cloud traffic included unverified automation, software-like requests and scanning behavior.
How large was the global bot-traffic change?
In Cloudflare’s event-period table, bots accounted for 39.4% of global HTTP requests during October 1–6 and between 39.2% and 39.6% from October 7 through 13. The measure is a share of requests, not a count of unique bots or operators.
Does traffic from a Yandex network identify who was behind it?
No. Cloudflare cautioned that a provider’s network origin does not establish who is responsible for traffic or whether it is linked to a particular operation.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
