After Yandex drone strikes, Cloudflare saw bots move hosts and Russian gambling bot traffic rise

When reported drone strikes knocked three Yandex facilities offline between October 7 and 11, automated traffic from Yandex's networks collapsed, but much of the malicious part simply moved, according to an analysis Cloudflare published on October 14. Bot requests that vanished from Yandex.Cloud turned up on other Russian hosting providers with the same technical fingerprints, and Russian bot traffic to gambling sites ended the week slightly higher.

"Physical infrastructure is static, but malicious automation is built to move," the company wrote.

Two very different Yandex networks

Cloudflare split Yandex traffic in two. The search network, AS13238, is almost entirely bots, 99.5% of requests, and 93.6% of those are verified crawlers such as YandexBot. At its low point on October 11 it was 99% below normal.

Yandex.Cloud, AS200350, looked different. Roughly 95% of the requests Cloudflare scored there were automated, yet not one was a verified bot, meaning none came from a known, declared crawler. Its bot traffic fell about 40%, probing of WordPress plugins dropped 90% and requests flagged as scanners fell 93%.

Where the bots went

The clearest case involved one gambling customer. Bot requests from Yandex.Cloud to that site dropped to zero after the October 8 disruption, then matching requests appeared from two other Russian hosts, Radist and Selectel.

Cloudflare says the new traffic shared the same JA4 TLS fingerprint, request paths, HTTP headers and User-Agent strings. Over that week, bot requests from Russia to gambling customers went up 1.4%, reaching 170.1 million against 167.7 million before.

The company cautions that seeing traffic on a provider's network says nothing about who controls it.

What the data does not show

The outage set off viral claims that Russian social media manipulation had gone quiet. Cloudflare's numbers do not support that. Bot traffic to post, reply and like endpoints from Russian IP addresses fell 5.7%, while total traffic from Russian IPs to social media fell only 0.6%.

Yandex's own crawler is a different story. Its absence was real, and publishing and newspaper sites saw a 44% drop in traffic from the search network, though 40.5% of Cloudflare customers were already returning a 403 error to it.

Cloudflare adds that its view is limited to traffic hitting its own network and that it cannot rule out links to social media activity without outside data. By the evening of October 14, UTC, Yandex traffic had recovered to roughly 85% of its usual level.