/
← Voltar ao feed
medium gambling publishing software technology

Yandex outage after reported strikes: Cloudflare data shows malicious bot automation migrated to other Russian hosts instead of going offline

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 17:24 · coletado há 4 dias

Following reported Ukrainian drone strikes on three Yandex facilities in Russia between October 7 and 11, claims spread that Russian bot farms and influence operations had been knocked offline. Cloudflare analyzed Radar and Bot Management data for the two Yandex ASNs, AS13238 (search) and AS200350 (Yandex.Cloud). It found no evidence that malicious activity across its network was disrupted. Traffic fell to roughly 90-99% below baseline, but the drop in Yandex Search was almost entirely verified search crawlers. On Yandex.Cloud, the high-volume automation moved to other Russian hosting providers, notably Radist and Selectel.

Detalhes técnicos

  • Traffic on AS13238 fell 99% below baseline and on AS200350 fell 90% on October 11. Both remained 86-90% below normal through October 13, and traffic was at 85% of normal as of October 14.
  • Pre-event, automated requests were 36.1% of global HTTP traffic and 35.8% of Russian-origin traffic. AS13238 supplied about 7% of Russia-origin bot requests, and AS200350 about 2%.
  • AS13238 requests were 99.5% automated and 93.6% of its bot requests were verified. Of sampled requests, 78.1% were verified YandexBot, 11.5% were YandexRenderResourcesBot and 1.9% were YandexImages.
  • Bot traffic from AS200350 fell about 40%. WordPress plugin probing fell 90%, scanner-identified requests fell 93%, and Cloudflare customer blocks fell 70%. About 95% of its requests were bots, none of them verified.
  • Nearly all Yandex.Cloud bot traffic was aimed at one gambling customer account. After the October 8 disruption it dropped to zero from Yandex.Cloud and appeared from Radist and Selectel with the same JA4 TLS fingerprint, uncommon request paths and headers, and custom User-Agent strings.
  • Russian bot traffic targeting gambling accounts stayed essentially flat, moving from 167.7M to 170.1M requests (+1.4%).
  • Social media traffic, including bot traffic to post, reply and like endpoints of one platform, showed no unexpected shifts from Russian-origin IPs or globally. Cloudflare cautions that it cannot rule out a connection without data from outside its network.
  • Network-level attribution is limited: traffic originating from a provider does not identify who is responsible for it.

Remediação

  • Do not use client ASN volume as a proxy for bot threat levels.
  • Detect automation by request behavior, for example shared JA4 fingerprints, anomalous request rates, and consistent header and User-Agent patterns across providers.
  • Apply WAF rules to sensitive endpoints regardless of the originating network.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 14/10/2026 17:24 · coletado 19/10 18:00 primeiro registro

    Yandex outage after reported strikes: Cloudflare data shows malicious bot automation migrated to other Russian hosts instead of going offline

    ler a análise desta fonte

    Following reported Ukrainian drone strikes on three Yandex facilities in Russia between October 7 and 11, claims spread that Russian bot farms and influence operations had been knocked offline. Cloudflare analyzed Radar and Bot Management data for the two Yandex ASNs, AS13238 (search) and AS200350 (Yandex.Cloud). It found no evidence that malicious activity across its network was disrupted. Traffic fell to roughly 90-99% below baseline, but the drop in Yandex Search was almost entirely verified search crawlers. On Yandex.Cloud, the high-volume automation moved to other Russian hosting providers, notably Radist and Selectel.

    Technical Details

    • Traffic on AS13238 fell 99% below baseline and on AS200350 fell 90% on October 11. Both remained 86-90% below normal through October 13, and traffic was at 85% of normal as of October 14.
    • Pre-event, automated requests were 36.1% of global HTTP traffic and 35.8% of Russian-origin traffic. AS13238 supplied about 7% of Russia-origin bot requests, and AS200350 about 2%.
    • AS13238 requests were 99.5% automated and 93.6% of its bot requests were verified. Of sampled requests, 78.1% were verified YandexBot, 11.5% were YandexRenderResourcesBot and 1.9% were YandexImages.
    • Bot traffic from AS200350 fell about 40%. WordPress plugin probing fell 90%, scanner-identified requests fell 93%, and Cloudflare customer blocks fell 70%. About 95% of its requests were bots, none of them verified.
    • Nearly all Yandex.Cloud bot traffic was aimed at one gambling customer account. After the October 8 disruption it dropped to zero from Yandex.Cloud and appeared from Radist and Selectel with the same JA4 TLS fingerprint, uncommon request paths and headers, and custom User-Agent strings.
    • Russian bot traffic targeting gambling accounts stayed essentially flat, moving from 167.7M to 170.1M requests (+1.4%).
    • Social media traffic, including bot traffic to post, reply and like endpoints of one platform, showed no unexpected shifts from Russian-origin IPs or globally. Cloudflare cautions that it cannot rule out a connection without data from outside its network.
    • Network-level attribution is limited: traffic originating from a provider does not identify who is responsible for it.

    Remediation

    • Do not use client ASN volume as a proxy for bot threat levels.
    • Detect automation by request behavior, for example shared JA4 fingerprints, anomalous request rates, and consistent header and User-Agent patterns across providers.
    • Apply WAF rules to sensitive endpoints regardless of the originating network.