Yandex Search traffic drop after strikes was almost entirely search crawling, Cloudflare data shows
Cloudflare says the post-strike drop in Yandex Search traffic was almost entirely verified search crawling. Yandex.Cloud's automation moved to other hosting providers, so a falling aggregate chart cannot show whether bot threats receded.
The Engineer · Build desk
Key figures from Cloudflare: 78.1% of sampled requests in the Yandex Search decline belonged to verified YandexBot. 93.6% of Yandex Search bot requests were Verified, and 99.5% of Yandex Search requests were automated.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Sampled Yandex Search decline from verified YandexBot | 78.1% | 6 | |
| Search bots Verified | 93.6% | 4 | |
| Search requests automated | 99.5% | 4 |
What happened
- Both networks stayed disrupted through October 13 at 86% to 90% below normal, and traffic was back to 85% of normal by 18:00 UTC on October 14.
- Cloudflare classified 99.5% of Yandex Search requests as automated and 93.6% of those bot requests as Verified.
- About 95.0% of Yandex.Cloud's scored requests were bots, and none of its observed bot requests were verified by Cloudflare.
Why it matters
- Who has to decide decision Rules keyed to AS200350 stop matching when the same automation changes host, so blocking by ASN needs request-level signals such as method mix and declared runtime beside it.
- What doesn't add up contradiction Claims that the strikes took bot farms offline run against Cloudflare's data. Cloudflare found no evidence linking a global drop in malicious traffic to Yandex.
- What it limits constraint Traffic that originates on a provider does not identify who runs it, so ASN-level counts cannot support attribution to a named operator.
Next story · Build · 1h ago
Cloudflare's Deno deal gives the runtime one more year of monthly fixesConfirmed2 publishers
Yandex runs two autonomous systems, and they carry different kinds of traffic [3]. Most of the traffic on the search ASN, AS13238, is search crawling. In Cloudflare's sample of the decline, 78.1% of requests belonged to verified YandexBot and 11.5% to YandexRenderResourcesBot [6]. That is 89.6% in two named crawlers [19]. As Yandex's networks lost capacity, their bot requests fell too [14].
The cloud ASN, AS200350, looks like hosted software. Nearly two-thirds of its bot requests sent data to websites, and some identified themselves as JavaScript, Python or Go programs [17]. Cloudflare saw vulnerability scanning and probing decline there. It also saw high-volume automation continue on "other hosting providers" [7]. Cloudflare's summary does not name them.
Before the strikes, automation was 36.1% of HTTP traffic across Cloudflare's network and 35.8% of traffic from Russian IP addresses [15]. The search ASN supplied about 7% of Russia-origin bot requests and the cloud ASN about 2% [5][18], roughly 9% together [20]. Their combined share of the global total is 0.06% [21]. Russia-origin bot requests fell roughly in proportion to the Yandex traffic that went offline [9].
Several things would have to hold for this to transfer to your own logs. Cloudflare sees only the requests that reach sites on its network [15]. "Verified" is Cloudflare's own classification [4]. The strikes themselves are described by Cloudflare as reported [1]. If your sites sit in a different slice of the web, the crawler-to-scanner mix you see from these ASNs could differ.
Cloudflare wrote that a drop in overall HTTP traffic "only confirms that the network went down" [10]. Cloudflare's conclusion is that explaining why the strikes had little lasting effect on malicious traffic requires analyzing request behavior [13].
What to watch
- Which hosting providers show the migrated automation in Radar's ASN-level data.
- Whether scanning and probing from AS200350 returns as Yandex traffic climbs back from 85% of normal.
- Whether any attribution work ties the migrated traffic to a named operator, since hosting origin alone does not.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline.
- [2]
On October 11, traffic fell to 99% below baseline for Yandex Search (AS13238) and 90% below baseline for Yandex.Cloud (AS200350), per Cloudflare Radar.
- [3]
Two ASNs are associated with Yandex: AS13238 is used by Yandex's search engine, while AS200350 runs its cloud services.
- [4]
Cloudflare classified 99.5% of Yandex Search ASN (AS13238) requests as automated, and 93.6% of its bot requests as Verified.
- [5]
The Yandex Search ASN supplied about 7% of Russia-origin bot requests, and just 0.05% of the global total.
- [6]
The decline on the Yandex Search ASN was almost entirely search crawling; sampled requests showed 78.1% belonged to verified YandexBot and 11.5% to YandexRenderResourcesBot.
- [7]
On Yandex.Cloud there was a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish; it migrated to other hosting providers.
- [8]
Cloudflare did not see any evidence linking a global disruption in malicious traffic to the drop in traffic from Yandex.
- [9]
Russia-origin bot requests fell roughly in proportion to the Yandex traffic that went offline, since most requests from those networks were automated.
- [10]
Cloudflare wrote: "A drop in overall HTTP traffic only confirms that the network went down. It does not reveal whether malicious or evasive bots were disrupted."
- [11]
While malicious traffic may originate from a particular provider, it does not necessarily tell us who is responsible for the traffic.
- [12]
Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline.
- [13]
Understanding why the strikes had little lasting effect on malicious traffic requires analyzing request behavior, rather than just overall traffic patterns.
- [14]
As Yandex's networks lost capacity, their bot requests fell too, which was expected because nearly all traffic from Yandex Search and Yandex.Cloud was automated.
- [15]
Before the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare's network, and 35.8% of traffic from Russian IP addresses.
- [16]
Approximately 95.0% of Yandex.Cloud (AS200350) scored requests were bots, but none of its observed bot requests were verified by Cloudflare.
- [17]
Yandex.Cloud's bots looked more like software apps: nearly two-thirds of their requests sent data to websites, some identified themselves as JavaScript, Python, or Go programs, and a larger share went to software companies than Yandex's search bots.
- [18]
The Yandex.Cloud ASN supplied about 2% of Russia-origin bot requests, and just 0.01% of the global total.
- [19]
Verified YandexBot and YandexRenderResourcesBot together made up 89.6% of the sampled Yandex Search decline.
- [20]
The two Yandex ASNs together supplied roughly 9% of Russia-origin bot requests.
- [21]
The two Yandex ASNs together supplied 0.06% of the global total.
- [22]
Both networks remained disrupted through October 13, settling at 86-90% below normal baselines; as of October 14 at 18:00 UTC, traffic is at 85% of normal.
Sources
2 independent publishers whose own reporting we read for this story.
- blog.cloudflare.comYandex outage: Data shows that instead of going dark, malicious bots went on the move
1 article · October 14, 2026
- tomshardware.comMalicious Russian disinformation bot traffic barely flinches after Ukraine strikes Yandex data centers and auto-migration kicks in
1 article · October 15, 2026
Topics and entities
Topics
- Internet outages
- Bot Traffic
- Russia-Ukraine war infrastructure strikes