Yandex outage: Data shows that instead of going dark, malicious bots went on the move

What it is

Cloudflare Radar and Bot Management analysis of traffic from Yandex's two ASNs after reported Ukrainian drone strikes on three Yandex facilities between 7 and 11 October 2025. The question was whether the outage disrupted Russian bot farms. Cloudflare found no evidence that it did.

What the data showed

Traffic fell 99% below baseline for AS13238 (search) and 90% for AS200350 (cloud) on 11 October. Both stayed 86-90% down through 13 October. As of 14 October 18:00 UTC, traffic was at 85% of normal. The fall in raw HTTP volume only confirms the network went down.

• Yandex Search (AS13238): 99.5% of requests were automated, and 93.6% of bot requests were verified. The sampled mix was 78.1% YandexBot, 11.5% YandexRenderResourcesBot and 1.9% YandexImages. Publishing and newspaper traffic fell 44%. The ASN supplied about 7% of Russia-origin bot requests and 0.05% of the global total.
• Yandex.Cloud (AS200350): About 95% of requests were bots and none were verified. Bot traffic fell about 40%, WordPress plugin probing fell 90%, scanner-identified requests fell 93%, and customer WAF blocks fell 70%. Its share of Russia-origin bot requests was about 2%, and 0.01% of the global total. Much of the software-vertical traffic looked legitimate, such as calls to api.cloudflare.com that mostly returned 200.
• Gambling: Nearly all Yandex.Cloud bot requests targeted one gambling customer account. After the 8 October disruption they dropped to zero, and identical requests appeared from Radist and Selectel. The JA4 TLS fingerprint, uncommon paths, HTTP headers and custom User-Agent strings all matched. Russian bot traffic to gambling accounts went from 167.7 million to 170.1 million requests (+1.4%).
• Social media: Total traffic changed by -0.6% from Russian IPs and +1.2% globally. Bot traffic to one platform's post, reply and like endpoints changed by -5.7% from Russian IPs and +1.1% globally.

What to do

The post recommends defending on request behavior, not source network:

• Cluster on shared JA4 fingerprints, so a workload is recognized after it changes hosting provider.
• Monitor for anomalous request rates.
• Apply WAF rules to sensitive endpoints regardless of origin ASN.

An IP or ASN block on one provider is likely to be sidestepped. The post says operators can move scripts to another provider in hours.

Caveats

• The post says traffic from a provider does not identify who is responsible for it.
• The data covers only Cloudflare's network. Cloudflare says that without outside data it cannot conclusively rule out a link between the strikes and social media manipulation.
• The gambling finding rests on one customer account and one fingerprint set. The post does not say how many operators this represents.
• The "migration" is inferred from matching fingerprints and timing, not from any confirmed link between the hosting accounts.