When drone strikes knocked Yandex's networks offline last week, the automation running on Yandex's cloud did not stop. It moved. A Cloudflare analysis published on October 14, 2026, found that bot requests aimed at one gambling customer fell to zero from Yandex.Cloud after the October 8 disruption and reappeared, with identical fingerprints, from other Russian hosting providers including Selectel and Radist. Russian bot traffic to gambling accounts ended the week 1.4% higher than it started.

In Short

After drones hit Yandex data centers, a lot of automated traffic from Yandex's networks disappeared, and some people online said Russian bot farms had been knocked out. Cloudflare looked at what that traffic actually was and found that most of the lost traffic from Yandex's search network was its own search crawler, while some of the malicious automation on Yandex's cloud simply restarted on other Russian hosting companies. So the outage cut Yandex's search indexing, but it did not switch off the bots, and blocking traffic by the network it comes from would not have stopped them either.

A second look at the Yandex outage

The post, titled "Yandex outage: Data shows that instead of going dark, malicious bots went on the move", was written by Marina Elmore and Lai Yi Ohlsen and carries Cloudflare's Bot Management, Outage and Radar tags. It responds directly to the claims that spread after the strikes. "Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline," the authors wrote. "HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead."

PPC Land covered the first phase of that story on October 12, when YandexBot requests on Cloudflare's network fell to near zero after strikes on three data centers and the viral reading of the chart ran ahead of the data. At that point Cloudflare had not commented. The October 14 post is the company's own analysis, and it goes further than the public Radar crawler page could: it separates Yandex's two networks, breaks the cloud traffic down by destination industry, and follows one set of bots from Yandex.Cloud to other providers.

The split matters because Yandex runs two autonomous system numbers, or ASNs, that do very different jobs. According to Cloudflare, AS13238 carries Yandex's search engine, while AS200350 runs its cloud services. Both lost traffic. The traffic they lost was not the same.

What the outage looked like on Cloudflare's network

According to Cloudflare, reported Ukrainian drone strikes hit three Yandex facilities in Russia between October 7 and 11, progressively taking data centers and network capacity offline. The post's table dates the strikes as Sasovo on October 7-8, Kaluga on October 9 and Vladimir on October 11, using UTC+3. On Cloudflare Radar, this culminated in what the authors called "a near-total collapse of the Yandex network on October 11", when traffic fell 99% below baseline for Yandex Search and 90% for Yandex.Cloud.

Both networks stayed disrupted through October 13, settling 86% to 90% below normal baselines, according to the post. A parenthetical then reads: "As of October 14 at 18:00 UTC, traffic is at 85% of normal." Read literally, that would mean a near-full recovery within a day of a reading 86% to 90% below normal. Given the surrounding sentence, the figure may instead describe traffic still 85% below normal. The post does not clarify which, and PPC Land has not been able to confirm either reading.

Before the strikes, Cloudflare said, automated requests made up 36.1% of all HTTP traffic seen globally on its network and 35.8% of traffic from Russian IP addresses. The post's own table gives different baseline figures for October 1 to October 6: 39.4% of global HTTP requests and 50.4% of Russia-origin HTTP requests classified as bots. The two pairs of numbers are not reconciled in the text. They may reflect different periods or different classification methods; the post does not say.

Yandex Search: a crawler that stopped crawling

Cloudflare classified 99.5% of requests from AS13238 as automated, and 93.6% of its bot requests as verified. A verified bot is one whose operator Cloudflare has confirmed, rather than one that merely claims a name in its user agent. The traffic indexed pages, rendered pages and rendered images, "which is consistent behavior for a search crawler," the authors wrote.

Sampled requests from the network broke down as 78.1% verified YandexBot, 11.5% YandexRenderResourcesBot and 1.9% YandexImages. The decline on this ASN, according to Cloudflare, "was almost entirely search crawling."

The network's footprint was smaller than the headlines implied. Yandex Search supplied about 7% of Russia-origin bot requests and 0.05% of the global total, according to Cloudflare.

Publishers felt it most. Among destination industries, Publishing and Newspapers saw the steepest drop, with traffic from Yandex networks down 44%. About 90% of pre-event traffic to news sites from AS13238 was YandexBot indexing articles. There is a further detail that changes how much the drop mattered: 40.5% of Cloudflare customers in that segment were already returning HTTP 403 Forbidden responses because site owners had blocked the crawler. "When the Yandex Search ASN went offline, customers simply saw less indexing from Yandex," the post says.

For sites that do want Yandex traffic, the consequence is the one PPC Land described on October 12: a crawler that is not running cannot refresh the index. Cloudflare's conclusion is that "the main impact was reduced content discovery in Yandex Search."

Yandex.Cloud: a different kind of automation

AS200350 looked nothing like a search network. About 95.0% of its scored requests were bots, according to Cloudflare, and none of its observed bot requests were verified. The authors described those bots as looking "more like software apps": nearly two-thirds of their requests sent data to websites, some identified themselves as JavaScript, Python or Go programs, and a larger share went to software companies than Yandex's search bots did. The network supplied about 2% of Russia-origin bot requests and 0.01% of the global total.

After the strikes, bot traffic from Yandex.Cloud fell about 40%. Some attack-like categories fell much further. WordPress plugin probing dropped 90%, and requests identified as coming from scanners dropped 93%. Cloudflare customer blocks on Yandex.Cloud traffic fell 70% over the event period, which the authors read as a sign "that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN."

Where the traffic was going

Cloudflare's breakdown by destination industry, comparing bot requests from Yandex.Cloud before the event with the October 7-13 period:

Destination industry Pre-event Event (Oct 7-13) Change 4xx share: pre to event
Computer software 24.24M 15.18M -37.4% 18.5% to 15.9%
Gambling 23.01M 18.80M -18.3% 99.1% to 99.3%
Media incl. adult 1.33M 223.1K -83.3% 82.0% to 61.8%
Internet and telecom 524.2K 206.5K -60.6% 71.4% to 51.1%
Travel / tourism 363.9K 158.1K -56.6% 27.0% to 12.3%
Retail / wholesale 316.0K 167.7K -46.9% 71.0% to 55.9%
Gaming / computer games 226.3K 63.2K -72.1% 51.4% to 9.2%
Publishing / newspapers 90.8K 8.8K -90.3% 90.2% to 61.4%

Source: Cloudflare. The 4xx column is the share of requests that received a client error response.

Two buckets account for most of the volume. Computer software is the expected one for a network that hosts third-party applications. Cloudflare noted that api.cloudflare.com was a top hostname for Yandex.Cloud request traffic, and that most of that traffic returned successful 200 responses before and during the event, "pointing to legitimate usage." That is a useful reminder that Yandex.Cloud hosts ordinary businesses as well as bad actors, and that its outage interrupted both.

Summed by PPC Land, the eight industries in the table fell from about 50.1 million to about 34.8 million bot requests, a decline of roughly 30.5%. That is smaller than the "about 40%" overall fall Cloudflare cites for Yandex.Cloud bot traffic. The table may omit other industries, or the two figures may use different windows; the post does not explain the gap.

The falling 4xx shares carry their own signal. Across most industries, a smaller proportion of Yandex.Cloud bot requests drew client errors during the event. Cloudflare attributes this largely to the disappearance of attack-like traffic, the kind of requests that tend to be blocked or refused. Gambling is the exception: its 4xx share stayed above 99% throughout, meaning almost every bot request to that sector was being turned away both before and after.

The gambling account: same fingerprint, new host

The gambling data is where Cloudflare makes its central argument. The sector "offers the clearest evidence that malicious automation relocated rather than disappeared," the authors wrote.

According to the post, nearly all of Yandex.Cloud's bot requests were aimed at one gambling customer account, with traffic shifting among its hostnames. That phrasing sits awkwardly beside the table, where gambling accounts for 23.01 million of roughly 50 million pre-event requests and computer software is larger. The sentence most likely refers to Yandex.Cloud's gambling-sector requests rather than all of its bot traffic, but the post does not specify.

Immediately after the October 8 disruption, bot requests from Yandex.Cloud to this account fell to zero. At the same time, identical requests began arriving from other Russian hosting ASNs, including Radist and Selectel. Cloudflare matched them on three characteristics:

  • the same JA4 TLS client fingerprint
  • the same uncommon request paths and HTTP headers
  • the same custom User-Agent strings

JA4 is a hash of how a client negotiates an encrypted connection. It is set by the software making the request, not by the server it runs on, so moving a script to a new provider changes the IP address and the ASN but leaves the fingerprint intact. PPC Land has previously reported on how TLS fingerprints captured as JA3 or JA4 hashes can expose a client claiming to be Chrome when it is actually a scripting library.

Across the week, Russian bot traffic targeting gambling accounts barely moved, going from 167.7 million to 170.1 million requests, an increase of 1.4%. "The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable," the authors wrote.

The post does not name the gambling customer, the jurisdiction it operates in, or what the bots were trying to do. With a 4xx share above 99%, most of their requests were being rejected either way.

The social media question

The viral claim was never really about websites. It was about posts, replies and likes on social networks. Cloudflare addressed that too, with the caveat that it only sees traffic passing through its own network.

According to the post, total social media traffic from Russian-origin IPs fell 0.6% over the event period, while global social media traffic rose 1.2%. Cloudflare then narrowed the analysis to bot traffic hitting the "post", "reply" and "like" endpoints of one social media platform, which it did not name. Russian-origin traffic there fell 5.7% and global traffic rose 1.1%. Neither shift, the authors said, was unexpected.

"Based on our assessment, the data does not appear to support the claims that the strikes crippled social media manipulation, though without further analysis with data outside of Cloudflare, we cannot conclusively say there is no connection," they wrote.

That hedge is worth taking at face value. A 5.7% decline in Russian-origin bot traffic to engagement endpoints on one platform is not nothing, and the post gives no baseline variance to show what a normal week looks like. Cloudflare's judgment that it was not unexpected is the company's own; the underlying weekly data is not published.

Overall bot share barely changed either. Global bot requests held between 39.2% and 39.6% of all HTTP requests across the event days in Cloudflare's table. The Russia-origin share fell from 50.4% in the baseline to between 42.1% and 48% during the strike days. The table labels those differences with percent signs, such as -8.2% for October 11, but they are percentage-point changes: 50.4% to 42.2% is a fall of 8.2 points, or about 16% in relative terms by PPC Land's calculation. Cloudflare said Russia-origin bot requests "fell roughly in proportion to the Yandex traffic that went offline."

Why this matters for marketers and publishers

For anyone who reads bot statistics, the post is a warning about the unit of measurement. "Our analysis here is a reminder that client ASN traffic volume is an unreliable proxy for interpreting automated bot behavior," the authors wrote. A drop in requests from a network shows that the network went down. It does not show that whatever ran on it stopped.

That has practical weight for publishers and advertisers who block or filter traffic by origin. Rules keyed to an ASN or an IP range would have seen the gambling bots vanish on October 8 and would have missed them arriving from Selectel and Radist at the same moment. Cloudflare's argument is that the durable signal is the request itself: the fingerprint, the paths, the headers, the rate. "Cloud workloads are portable, so when a data center goes dark or an IP prefix gets blocked, operators can migrate their scripts to another provider in hours," the post says. "Physical infrastructure is static, but malicious automation is built to move."

The episode also shows how much legitimate and illegitimate automation share the same infrastructure. Bot farms and botnet operators rent servers from the same clouds as software companies calling api.cloudflare.com. When a provider goes down, both disappear from the charts together, which is part of why the aggregate drop invited such a strong reading.

The scale of automated traffic on the web makes that distinction harder to see. Cloudflare Radar data in June showed bots at 57.4% of HTML traffic against 42.6% from humans, a different measure from the 36.1% of all HTTP requests in this post. Cloudflare chief executive Matthew Prince said in September that he expects bot traffic to reach about 1,000 times human levels within five years. In August, Decodo ranked Russia 12th by share of global bot traffic at 2.7%.

Impersonation is a related problem. GreyNoise found in August that scanners from 824 IP addresses forged the names of 13 AI crawlers while hunting for credential files, none of them matching the crawlers' published IP ranges. A Shopify merchant described in April how 500 fake carts an hour arrived through a myshopify.com subdomain that sat outside the merchant's own Cloudflare rules. In each case, the origin of the traffic told site owners less than its behavior.

What the post leaves open

Cloudflare is careful about attribution. "While malicious traffic may originate from a particular provider, it does not necessarily tell us who is responsible for the traffic," the authors wrote. The post does not identify the operators behind the gambling bots, does not say whether Selectel or Radist were notified, and does not name the social media platform it examined.

It also does not resolve the recovery figure for October 14, the gap between the 36.1% and 39.4% global baselines, or the difference between the 40% fall in Yandex.Cloud bot traffic and the industry table. The post was published on October 14. Yandex has not said when its damaged facilities will return to service.

Timeline

Summary

Who: Cloudflare, whose researchers Marina Elmore and Lai Yi Ohlsen analyzed the traffic; Yandex, whose search network (AS13238) and cloud network (AS200350) were disrupted; and Russian hosting providers Radist and Selectel, where relocated bot traffic reappeared.

What: Cloudflare found that the traffic lost from Yandex Search was almost entirely its own verified search crawlers, while bot traffic from Yandex.Cloud fell about 40%. Scanning and probing dropped sharply, but bots aimed at one gambling account moved to other providers with identical JA4 fingerprints, headers and user agents, and Russian bot traffic to gambling accounts rose 1.4% over the week. Cloudflare found no unexpected change in social media traffic.

When: The reported strikes took place between October 7 and October 11, 2026. Cloudflare published its analysis on October 14, 2026.

Where: Yandex facilities in Sasovo, Kaluga and Vladimir in Russia; the traffic data covers websites and services on Cloudflare's global network.

Why: The post responds to claims that the strikes knocked Russian bot farms and influence operations offline. It matters for publishers and advertisers because it shows that traffic volume from a network is a poor guide to bot activity, and that defenses keyed to where requests come from miss automation that simply changes host.