Cloudflare data shows malicious bots migrated after Yandex strikes, not stopped

Infrastructure Damage vs. Malicious Activity

Following reported drone strikes on Yandex data centers between October 7 and 11, speculation arose that Russian bot farms were knocked offline. However, Cloudflare Radar and Bot Management data indicate that while network capacity collapsed, malicious automation did not vanish. Instead, high-volume malicious traffic migrated to alternative hosting providers, while the drop in legitimate search indexing was the primary observable impact.

Divergent Impacts on Yandex ASNs

The strikes affected two distinct Autonomous System Numbers (ASNs) differently:

• Yandex Search (AS13238): Traffic dropped 99% below baseline. This decline was almost entirely verified search crawlers (YandexBot, YandexRenderResourcesBot, YandexImages). The main consequence was reduced content discovery and indexing for websites, particularly in the Publishing and Newspapers sector, which saw a 44% drop in traffic from Yandex networks.
• Yandex.Cloud (AS200350): Traffic dropped 90% below baseline. This ASN hosts third-party applications and carried a mix of legitimate and malicious automation. While vulnerability scanning and plugin probing temporarily declined, the core malicious operations persisted by moving infrastructure.

Malicious Traffic Migration Evidence

Cloudflare analysis confirmed that malicious actors relocated their workloads rather than ceasing operations. Key evidence includes:

• Identical Fingerprints: Requests targeting gambling accounts maintained the same JA4 TLS client fingerprint, request paths, HTTP headers, and User-Agent strings across providers.
• Provider Shift: Immediately after Yandex.Cloud became unavailable, identical traffic patterns appeared from other Russian hosting ASNs, specifically Radist and Selectel.
• Volume Stability: Russian bot traffic targeting gambling accounts remained essentially flat, moving from 167.7 million to 170.1 million requests (+1.4%) over the event week.

Limitations of ASN-Based Analysis

The data underscores that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior. Physical infrastructure is static, but malicious automation is portable. Effective defense requires inspecting request behavior—such as shared fingerprints and anomalous rates—rather than relying on the origin network. Cloudflare found no evidence that the strikes crippled social media manipulation, with global and Russian-origin social media traffic showing only minor fluctuations.