Web

Yandex Outage Shows Malicious Bots Migrated to Other Networks

Following reported strikes on Yandex data centers that disrupted search engines and cloud services, telemetry data shows that malicious automation did not vanish but instead shifted to alternative networks.

Radwan AbdulhadiEditor and technology writer

Published: October 14, 2026 · Updated: October 14, 2026 · 3 min read

Yandex Outage Shows Malicious Bots Migrated to Other Networks — Image: Cloudflare Blog

The Impact of Data Center Strikes on Yandex Networks

Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. According to the Cloudflare Blog, this culminated in a near-total collapse of the Yandex network on October 11 when traffic plummeted significantly for both search engines and cloud services.

When the infrastructure disruptions occurred, initial internet speculation suggested that Russian bot farms and influence operations had been knocked completely offline. However, aggregate traffic metrics can easily mislead, and a drop in overall HTTP traffic only confirms that a network went down rather than revealing whether malicious or evasive bots were actually disrupted.

Yandex outage: Data shows that instead of going dark, malicious bots went on the move — Image related to the report from Cloudflare Blog · Source: Cloudflare Blog

Analyzing Autonomous System Numbers and Bot Behavior

There are two autonomous system numbers associated with Yandex that serve completely different roles: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. Utilizing Cloudflare Radar and Bot Management data, researchers analyzed how these separate networks were affected.

The Yandex Search ASN is used primarily for search index crawling. Cloudflare classified the vast majority of its requests as automated, with a high proportion identified as Verified bots indexing pages, rendering images, and fetching site resources. When this network went offline, websites experienced a sharp drop in search indexing rather than a reduction in malicious attacks.

Shift in Yandex.Cloud Automation and Scanning Activity

In contrast to the search engine network, the Yandex.Cloud ASN carries a different mix of automation. Approximately 95% of its scored requests were bots, but none of its observed bot requests were verified search crawlers. Instead, Yandex.Cloud bots behaved more like software applications, with nearly two-thirds sending data to websites.

Following the reported strikes, bot traffic from Yandex.Cloud fell by about 40%. Several attack-like categories showed sharp declines, including WordPress plugin probing and scanner-identified requests. Furthermore, customer blocks on Yandex.Cloud traffic fell significantly during the event period, indicating that proportionately less malicious traffic was hitting the web application firewall from this ASN.

Evidence of Malicious Migration Across Russian Hosting Providers

The gambling sector offers the clearest evidence that malicious automation relocated rather than disappeared entirely. Nearly all of Yandex.Cloud’s bot requests in this sector were targeted at a single gambling customer account, with traffic shifting dynamically among its hostnames.

Immediately following the disruption, bot requests from Yandex.Cloud to this specific account dropped to zero. Simultaneously, identical requests began appearing from other Russian hosting ASNs, maintaining an identical fingerprint across providers with the same uncommon request paths and HTTP headers. This migration demonstrates that while localized network outages can disrupt specific infrastructure, threat actors quickly pivot their automated operations to alternative hosting providers.