Analyzing the Yandex Network Outage: How Malicious Bots Migrated Instead of Going Dark

When physical drone strikes between October 7 and October 11 damaged Yandex data center infrastructure across Sasovo, Kaluga, and Vladimir, internet traffic monitoring platforms observed steep declines in HTTP traffic originating from Russian networks. The initial public narrative postulated that these physical disruptions had crippled Russian bot farms, influence operations, and automated threat infrastructure. However, granular telemetry from Cloudflare Radar and Cloudflare Bot Management demonstrates that while legitimate search indexing halted, high-volume malicious bot activity simply migrated to alternative hosting providers.

Evaluating the impact of infrastructure failure requires differentiating between aggregate network throughput and request-layer behavioral indicators. Rather than going dark, malicious automation proved cloud-agnostic, shifting operational workloads across autonomous systems within hours.

Autonomous System Partitioning: AS13238 vs. AS200350

To accurately diagnose the outage, traffic must be segmented across Yandex’s primary Autonomous System Numbers (ASNs), which serve fundamentally different operational roles:

• AS13238 (Yandex Search): Dedicated to search engine infrastructure, index crawling, asset rendering, and content discovery. Cloudflare telemetry categorized 99.5% of requests from this ASN as automated, with 93.6% classified as Verified Bots. It supplied approximately 7% of Russian-origin bot requests and 0.05% of global bot requests prior to the outage.
• AS200350 (Yandex.Cloud): A public cloud platform hosting third-party application workloads, API integrations, and user-deployed software. Approximately 95.0% of its scored requests were automated, yet 0% were verified. These requests mirrored custom software applications, with nearly two-thirds sending data payload requests (HTTP POST) and exhibiting custom scripting environments (such as Python, Go, and JavaScript). This network supplied about 2% of Russian-origin bot requests and 0.01% globally.

Timeline and Disruption Architecture of the Outage

Prior to the strikes, automated traffic represented 36.1% of global HTTP requests across Cloudflare’s edge, and 35.8% of HTTP traffic originating from Russian IP addresses. Between October 1 and October 6, baseline global bot traffic sat at 39.4% of total HTTP requests, while Russian-origin bot traffic accounted for 50.4%.

As strikes impacted facilities sequentially, capacity degraded rapidly:

• October 7–8 (Sasovo Strike): Russian-origin bot traffic dropped slightly to 48.0% of local HTTP requests.
• October 9 (Kaluga Strike): Russian-origin bot volume fell to 42.5%.
• October 11 (Vladimir Strike): Physical damage caused a near-total collapse. Traffic plummeted 99% below baseline for Yandex Search (AS13238) and 90% below baseline for Yandex.Cloud (AS200350). Russian-origin bot traffic dipped to 42.2%.
• October 12–14 (Disruption Settlement): Both ASNs remained heavily degraded, settling between 86% and 90% below pre-event baselines. By October 14 at 18:00 UTC, traffic hovered at 85% of normal.

While local Russian bot request percentages decreased proportionally with lost network capacity, global bot percentages remained completely unaffected, oscillating between 39.2% and 39.6% throughout the event.

Yandex Search Infrastructure (AS13238) Analysis

The vast majority of the traffic drop observed on AS13238 corresponded directly to benign, verified web crawlers. Sampling of this ASN’s pre-event traffic revealed three main user agents: YandexBot (78.1%), YandexRenderResourcesBot (11.5%), and YandexImages (1.9%).

The media and publishing sector experienced the most pronounced drop from AS13238, seeing a 44% decline in total traffic. Roughly 90% of pre-event traffic to news publishers from this ASN consisted of YandexBot indexing articles. Notably, 40.5% of Cloudflare site owners had proactively configured Web Application Firewall (WAF) rules returning HTTP 403 Forbidden responses to this crawler. The primary operational impact of AS13238 going dark was therefore a pause in Yandex’s web indexing capabilities, not a drop in cyberattacks.

Yandex.Cloud Infrastructure (AS200350) and Bot Demographics

Bot traffic originating from Yandex.Cloud (AS200350) declined by approximately 40% during the outage. Specific attack-oriented automation categories dropped sharply:

• WordPress Plugin Probing: Reduced by 90%.
• Scanner-Identified Traffic: Reduced by 93%.
• WAF Block Actions: Cloudflare customer blocks against AS200350 fell by 70%, reflecting a temporary drop in aggressive scanning hitting firewall rules.

However, general application traffic and valid API interactions remained active where infrastructure allowed. For example, api.cloudflare.com was a top target hostname for AS200350 traffic; the vast majority of these requests succeeded with HTTP 200 OK status codes both before and during the event, confirming typical third-party SaaS integration behavior.

Industry Vertical Impact and Automated Scanning Patterns

Segmenting Yandex.Cloud’s bot volume across destination industries illustrates how client errors (HTTP 4xx responses, representing blocked or failing requests) shifted during the outage:

• Computer Software: Dropped from 24.24M to 15.18M requests (-37.4%). HTTP 4xx error rate changed from 18.5% to 15.9%.
• Gambling: Dropped from 23.01M to 18.80M requests (-18.3%). HTTP 4xx error rate remained steady, moving from 99.1% to 99.3%.
• Media & Adult: Dropped from 1.33M to 223.1K requests (-83.3%). HTTP 4xx error rate shifted from 82.0% to 61.8%.
• Internet & Telecom: Dropped from 524.2K to 206.5K requests (-60.6%). HTTP 4xx error rate decreased from 71.4% to 51.1%.
• Travel & Tourism: Dropped from 363.9K to 158.1K requests (-56.6%). HTTP 4xx error rate fell from 27.0% to 12.3%.
• Retail & Wholesale: Dropped from 316.0K to 167.7K requests (-46.9%). HTTP 4xx error rate dropped from 71.0% to 55.9%.
• Gaming: Dropped from 226.3K to 63.2K requests (-72.1%). HTTP 4xx error rate plunged from 51.4% to 9.2%.
• Publishing & Newspapers: Dropped from 90.8K to 8.8K requests (-90.3%). HTTP 4xx error rate fell from 90.2% to 61.4%.

The broader decline in 4xx error rates across most verticals indicates that low-quality, spray-and-pray vulnerability scanning subsided, while higher-value automated operations successfully maintained connectivity or migrated.

The Gambling Bot Case Study: Infrastructure Migration Tactics

The gambling vertical provided definitive proof of rapid bot migration. Pre-event data showed that nearly all gambling-directed bot traffic from AS200350 targeted a single customer account across various hostnames. This traffic maintained a 99.1% block/error rate.

Immediately following the October 8 infrastructure disruption, bot requests originating from AS200350 targeting this account collapsed to zero. Simultaneously, identical automated requests began reaching the exact same hostnames from alternative Russian cloud hosting networks, including Radist (AS207806) and Selectel (AS49505).

Deep packet and fingerprint inspection confirmed that these requests originated from the same automated actor:

• JA4 TLS Client Fingerprint: Identical cryptographic client handshake profile.
• HTTP Attributes: Identical, highly specific request paths and uncommon HTTP headers.
• User-Agent Strings: Identical custom User-Agent patterns.

Across the entire week of the outage, total Russian-origin bot requests targeting this gambling account remained virtually flat, shifting from 167.7 million to 170.1 million requests (+1.4%). The threat actors did not experience a system-wide failure; they re-routed their workload to secondary cloud providers.

Evaluating Claims of Disruption to Social Media Operations

Public speculation suggested that the Yandex outage disrupted social media manipulation and influence operations. Cloudflare analyzed global and Russian-origin traffic patterns across major platforms during the event window:

• Overall Social Media Volume: Russian-origin IP traffic to social platforms registered a minor 0.6% decrease, while global social media traffic rose 1.2%.
• Targeted Endpoint Automation: Analysis focused specifically on automated requests hitting write endpoints (such as /post, /reply, and /like) showed a modest 5.7% drop from Russian IPs, alongside a 1.1% increase globally.

These slight variations fall within standard operational baselines. The data offers no support for claims that infrastructure strikes disrupted social media botnets or coordinated amplification operations.

Technical Defenses and Behavioral Bot Detection Strategies

The primary takeaway from the Yandex outage telemetry is that network-level controls (such as IP or ASN blocking) are insufficient against modern automated threats. Cloud workloads are portable, and threat actors can redeploy code to clean IP prefixes in a matter of hours.

To build resilient mitigations against portable bot infrastructure, security teams must implement multi-layered defenses:

• Implement TLS Fingerprinting: Utilize JA4 and JA3 fingerprints to identify client connection characteristics regardless of source IP, ASN, or spoofed User-Agents.
• Behavioral Anomalies over Static Rules: Monitor request paths, header order consistency, and unexpected HTTP request methods on sensitive application endpoints.
• Dynamic WAF Profiling: Enforce rate limiting and managed challenges (e.g., Turnstile) at the API gateway layer rather than relying on perimeter network ACLs.
• Automate Cross-ASN Tracking: Configure security observability pipelines to aggregate security events by behavioral payload signatures instead of source network attributes.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.