Cloudflare Data Shows Malicious Bot Traffic Migrated Rather Than Disappeared After Yandex Data Center Attack
Cloudflare data indicates that after a Ukrainian drone attack on Yandex data centers, malicious automated traffic did not disappear but instead migrated to other hosting providers.
From October 7 to 11, 2026, reports indicated drone attacks on three Yandex facilities within Russia, leading to gradual network capacity disruptions. Cloudflare Radar showed that on October 11, Yandex Search (AS13238) traffic dropped to 99% below baseline, and Yandex.Cloud (AS200350) fell to 90% below baseline; by October 13, both remained 86% to 90% below normal levels, recovering to 85% of normal levels by October 14 at 18:00 UTC.
Nearly all traffic for Yandex Search ASN was verified search crawlers. Cloudflare classified 99.5% of its requests as automated, with 93.6% being verified bots, mainly including YandexBot (78.1%), YandexRenderResourcesBot (11.5%), and YandexImages (1.9%). Traffic for publishing and newspaper websites decreased by 44%, with about 90% being article indexing. This ASN accounted for only about 7% of bot requests from Russia and 0.05% of the global total.
Bot requests for Yandex.Cloud ASN accounted for about 95% of its traffic, but there were no verified bots. After the attack, bot traffic for this ASN decreased by about 40%, with WordPress plugin detection down by 90%, scanner identification requests down by 93%, and customer bans down by 70%. However, high-volume automation migrated to other Russian hosting ASNs, such as Radist and Selectel. Gambling client accounts showed that after the interruption on October 8, Yandex.Cloud requests dropped to zero, while other providers exhibited the same JA4 TLS fingerprints, uncommon request paths, HTTP headers, and custom User-Agent requests. Bot requests from Russia targeting gambling accounts rose from 167.7 million to 170.1 million (+1.4%).
The global proportion of bot requests to total HTTP requests remained nearly unchanged before and after the incident (about 39.4% to 39.6%). The proportion of bot requests from Russia dropped from a baseline of 50.4% to about 42%, roughly corresponding to the proportion of Yandex network downtime. There were no abnormal changes in social media-related endpoints (posting, replying, liking): total traffic from Russia decreased by 0.6%, while global traffic increased by 1.2%; specific platform bot traffic from Russia decreased by 5.7%, while global traffic increased by 1.1%.
From a market mechanism perspective, the incident represents traffic rerouting after infrastructure disruption: attackers migrated portable cloud workloads from the compromised ASN to other hosting providers to maintain vulnerability scanning, plugin detection, and high-volume automation. The decline in data center capacity led to a sharp decrease in Yandex-related traffic, but malicious requests continued to operate by switching ASNs; the beneficiaries were alternative hosting providers and defenders (who could identify threats based on behavioral characteristics rather than a single ASN), with the pressure point being the reliance on monitoring total ASN traffic volume and the asymmetry where physical infrastructure is static while automated scripts can migrate within hours.
Source: Public Information
ABAB AI Insight
As a major search and cloud service provider in Russia, Yandex's AS13238 has long been responsible for search indexing crawlers, while AS200350 serves as a third-party application hosting network carrying mixed automated traffic; previous observations by Cloudflare and others have shown that the proportion of automated requests from Russia is higher than the global average.
Capital and resources are effectively flowing to alternative hosting providers (such as Radist and Selectel), with attackers migrating scripts and fingerprints to maintain high-volume requests for industries like gambling; the motivation is that the portability of cloud workloads allows for quick switching after a single data center disruption, avoiding a drop to zero traffic.
This is similar to previous cases where automated traffic quickly migrated after disruptions at other data centers or IP prefix bans; currently, it is in an adaptation phase after infrastructure disturbances, with physical facility damage not changing the behavior patterns of malicious automation.
Essentially, this is a technological substitution: portable cloud scripts and client fingerprints allow automated threats to escape the constraints of a single physical facility, with request behaviors (JA4, paths, headers) becoming the basis for ongoing identification rather than ASN affiliation; the mechanism is that cloud environments decouple computing from networking, so disruptions only affect specific server exits, while operators can switch providers within hours to continue running the same logic.
ABAB News · Cognitive Laws
Infrastructure disruptions change exits but do not change behavior
Total declines can be misleading; fingerprint migration is the signal
Physical facilities are static, but automated workloads can migrate