Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Summary

Reported drone strikes on Yandex data centers from October 7 to 11 caused network traffic to drop 99% below baseline for Yandex Search and 90% for Yandex.Cloud. Using Cloudflare Radar and Bot Management data, the analysis compared pre-event automation baselines with post-strike patterns on both ASNs. The Yandex Search ASN drop consisted almost entirely of verified search crawlers: 93.6% of its bot requests were verified, and 78.1% belonged to YandexBot. On Yandex.Cloud, vulnerability scanning fell 90% and plugin probing dropped 93%, but high-volume operations migrated to other Russian hosting providers, preserving identical JA4 fingerprints. Global bot traffic remained stable at 39.5%, demonstrating that malicious automation moves rather than disappears and that request behavior analysis is necessary to understand threats.

Takeaways

1. 1

   The Yandex Search ASN traffic drop was almost entirely verified search crawlers (93.6% verified), not malicious bots; the main impact was reduced content discovery in Yandex Search.

2. 2

   Malicious automation from Yandex.Cloud migrated to other Russian hosting providers like Radist and Selectel within hours, maintaining identical JA4 fingerprints, request paths, and User-Agent strings.

3. 3

   Global bot traffic levels remained stable at around 39.5% of HTTP requests, indicating that network disruptions do not eliminate automated threats and that request behavior analysis is necessary.

FAQ