Yandex Data Center Outage Shows Malicious Bots Migrate to Other Networks

Cloudflare research published recently analyzes the impact of infrastructure damage on automated web traffic. The study focuses on Yandex networks in Russia following reported strikes. The findings challenge the assumption that disabling specific data centers stops malicious bot operations. Instead, the data indicates that while legitimate search crawling ceased, high-volume automation simply moved to other hosting providers. This distinction matters for defenders monitoring global threat landscapes.

Root cause

The disruption stemmed from reported Ukrainian drone strikes on three Yandex facilities between October 7 and 11. These events progressively knocked data centers and network capacity offline. By October 11, traffic for Yandex Search (AS13238) fell to 99 percent below baseline. Yandex.Cloud (AS200350) traffic dropped 90 percent below baseline. Both networks remained disrupted through October 13. Traffic settled at 85 percent of normal by October 14.

Attack path

The two affected autonomous systems served different roles, leading to different outcomes. Yandex Search (AS13238) traffic consisted almost entirely of verified crawlers indexing pages and images. When this ASN went down, legitimate indexing stopped. Yandex.Cloud (AS200350) hosted unverified bots performing vulnerability scanning and probing. This network supplied a small fraction of global bot requests. When capacity was lost, these malicious actors did not stop; they migrated their operations to other hosting providers.

Affected versions

• Yandex Search network (AS13238)
• Yandex.Cloud network (AS200350)
• Global HTTP traffic baselines observed by Cloudflare

Mitigation

• Analyze request behavior rather than relying solely on aggregate traffic drops.
• Distinguish between verified search crawlers and unverified automated scripts.
• Monitor for migration of high-volume automation to new hosting providers.
• Maintain baselines for automated requests from specific autonomous systems.

Signals worth monitoring

Teams usually check for sudden shifts in autonomous system traffic patterns. Look for a drop in known crawler signatures alongside a rise in unverified scripts from new IP ranges. Verify whether user-agent strings match expected software behaviors. Check for increased scanning activity from hosting providers that previously showed low abuse rates. Monitor for changes in request payloads that indicate migration of bot infrastructure. Containment moves often involve rate-limiting new autonomous systems until their behavior is classified.

What to do and how to stay safe: Yandex

• Review your web server logs for changes in the origin autonomous systems of automated requests.
• Update your bot management rules to flag unverified traffic from new hosting providers.
• Establish baselines for normal automated traffic percentages to detect anomalies quickly.
• Correlate traffic drops with known infrastructure events to avoid false assumptions about threat cessation.

Step-by-step guide: Difference Between Cyber Espionage and Cyber Terrorism

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the Yandex outage stop Russian bot farms?

No, Cloudflare data shows that while search crawling stopped, malicious bots migrated to other networks.

What happened to Yandex Search traffic?

Traffic for AS13238 dropped 99 percent below baseline, consisting mainly of verified crawlers.

How much of global traffic was automated before the strikes?

Automated requests accounted for 36.1 percent of all HTTP traffic globally across Cloudflare's network.