Summary

  • Cloudflare observed Yandex Search traffic collapse mostly as verified crawling, while its Yandex.Cloud sample included both ordinary cloud applications and attack-like automation.
  • The strongest continuity evidence was account-specific: requests with matching JA4, paths, headers and user agents appeared on other Russian hosting ASNs after traffic from AS200350 stopped. It supports migration of that observed operation, not attribution of an actor or a conclusion about all Internet traffic.

An ASN tells a defender where a request entered the network. It does not, on its own, tell the defender what the request was doing, who controlled it or whether it continued somewhere else. Cloudflare’s account of the October disruption around Yandex makes the distinction unusually visible: the search network and the cloud-hosting network both lost traffic, but their automated requests had different functions and left different evidence behind.

Cloudflare published its analysis on 14 October, using Radar and Bot Management data from its own network. It reported that on 11 October traffic was 99% below baseline for Yandex Search, AS13238, and 90% below baseline for Yandex.Cloud, AS200350. Both remained 86–90% below normal on 13 October; Cloudflare’s 14 October 18:00 UTC observation put traffic at 85% of normal. Those are provider-level measurements, not a census of Russian Internet traffic.

The initiating event also needs careful attribution. Yandex’s public statements described damage and service interruption at facilities in Sasovo, Kaluga and Vladimir; Cloudflare dates the reported strikes between 7 and 11 October. The physical event helps explain why two networks lost capacity. It does not identify the people behind every request that had used them, and neither company’s public material establishes that Yandex itself operated the traffic later seen from other providers.

AS13238 is the simpler side of the comparison. Cloudflare classified 99.5% of the requests it observed from that ASN as automated and 93.6% of those bot requests as verified. Its sampled mix included YandexBot, YandexRenderResourcesBot and YandexImages, consistent with search indexing and page rendering. About 90% of pre-event AS13238 traffic to news sites was YandexBot indexing articles, according to Cloudflare. When that path disappeared, publishers lost some Yandex crawling and discovery. “Bot” here largely meant a search service doing its stated job, not an attack.

The Yandex.Cloud sample was more mixed. Cloudflare said about 95% of its scored requests were bots, but none of the observed bot requests were verified under Cloudflare’s system. That classification does not make every request malicious. Nearly two-thirds of the requests sent data to websites; software and integration traffic was prominent, and a majority of software-sector requests returned HTTP 200 both before and during the event. A cloud ASN hosts customer workloads. Its network label cannot be substituted for a behavioral verdict on each workload.

Cloudflare did see specific attack-like categories contract: bot traffic from AS200350 fell about 40%, WordPress-plugin probing 90%, scanner-identified requests 93%, and customer blocks of Yandex.Cloud traffic 70%. In its measurement surface, that is a real interruption in activity arriving from this ASN. It is not yet an answer about whether a task stopped.

For that, the report followed requests to one gambling-sector customer account. Almost all of the Yandex.Cloud bot requests in that segment had been aimed at this account, across its hostnames. After the 8 October disruption, requests from AS200350 to the account fell to zero. At the same time, Cloudflare observed requests from other Russian hosting ASNs, including Radist and Selectel, with the same JA4 TLS fingerprint, uncommon request paths and headers, and custom User-Agent strings.

Total Russian bot traffic directed at gambling accounts in Cloudflare’s sample moved from 167.7 million requests before the event to 170.1 million during it, a 1.4% increase.

This is stronger than a broad comparison of national traffic charts: several matching request characteristics reappeared at the same customer boundary when the former source ASN went quiet. It supports Cloudflare’s interpretation that this observed operation migrated. But the result remains bounded. It does not show that every bot moved, identify an operator, establish intent from a fingerprint alone or measure traffic to sites outside Cloudflare. JA4 is a continuity clue, not a human identity. The company’s own report says data beyond its network would be needed to rule on a connection to social-media manipulation.

The aggregate numbers reinforce the need to keep denominators visible. Cloudflare reports that automated requests represented 39.4% of its global HTTP-request volume on 1–6 October and 39.5% on 11 and 13 October. Russia-origin automated requests fell from 50.4% of Russia-origin HTTP requests in the baseline period to 42.2% on 11 October and 42.1% on 13 October. These percentages are shares of observed requests, not counts of all bots or people. A stable global share can coexist with a smaller regional share, a sharp fall on one ASN and a migration on one customer account.

That distinction is the operational lesson. The first question in an outage is whether the provider path is down. The next is whether the behavior of concern has stopped, shifted destination, or changed its hosting origin. Answering the latter requires a time-aligned baseline and evidence tied to destinations and request characteristics, rather than a single ASN total. A sudden drop in an origin network may matter greatly to search discovery and ordinary cloud customers even when one attack-like workflow persists elsewhere.

Heng Lu Note 65, “Running-Code Primacy,” informs this article only as an editorial lens: judge a system through what its deployed components actually do, not through labels standing in for behavior. It is not evidence about Yandex, Cloudflare or this incident. The relevant application here is modest: an ASN chart is useful for locating a path; request-level evidence is needed to assess what traversed it and what happened after it failed.

Sources: Cloudflare’s outage analysis; Yandex’s 9 October data-centre statement; Yandex’s 11 October investor statement; Cloudflare’s Verified Bots documentation; Heng Lu Note 65; Cloudflare Radar traffic view; Cloudflare Radar traffic view.