Yandex outage: data shows that instead of going dark, malicious bots moved
Points and comments are a snapshot, not live.
Yandex data center strikes did not disrupt malicious bots, which simply migrated to other hosts.
Following reported Ukrainian drone strikes on three Yandex facilities (Oct 7-11), Yandex Search (AS13238) traffic dropped 99%, and Yandex.Cloud (AS200350) dropped 90%. However, Cloudflare data shows the lost traffic on AS13238 was almost entirely verified search crawlers (99.5% automated, 93.6% verified). On AS200350, malicious automation fell temporarily but quickly migrated to other Russian hosts like Radist and Selectel, evidenced by identical JA4 TLS fingerprints, request paths, and User-Agent strings. Global bot traffic remained flat, and social media manipulation showed no unexpected change. The article concludes client ASN volume is an unreliable proxy for bot behavior, and defending requires inspecting request fingerprints and behavior.
Yandex.Cloud bot traffic to the gambling sector actually increased 1.4% over the week, as operators moved workloads. Cloudflare customer blocks on Yandex.Cloud traffic fell 70%, indicating less malicious traffic even reached their WAF from that ASN. The piece explicitly refutes claims that the strikes crippled Russian influence operations or social media bots.
What commenters are saying
The thread broadly agrees that early popular claims-spurred partly by Cloudflare's own tweets-that the strikes crippled Russian troll farms were misleading. Several commenters note that Cloudflare's data on web bot traffic does not capture social media bots, which often run on residential proxies and mobile phones, not data centers. Some share anecdotal observations of right-wing posters disappearing from forums, but others call for serious analysis. One commenter cites Benn Jordan's social media bot analysis and UK political party engagement drops as counter-evidence. Another points out that Cloudflare later clarified their tweets did not mean social media manipulation was affected, but the clarification came five days later. Two named alternative hosts for migrated malicious traffic: Radist and Selectel.
Some defend Cloudflare's original tweets as not actually ambiguous, while others argue the company bears responsibility for the resulting rumors. A few practical defenders note that blocking by ASN alone is ineffective because malicious actors use VPNs and residential proxies. One commenter sarcastically suggests the real indicator is that both Russia and the US responded seriously, implying the strikes mattered despite Cloudflare's analysis.