Cloudflare on the Yandex outage: malicious bots moved to other hosts instead of going dark

Victoria Shinder15 October 2026, 06:372 min read

Cloudflare published an analysis on 14 October 2026 of what happened to automated traffic when Yandex's networks went down. Its conclusion runs against claims that circulated online: the outage cut search crawling, but malicious automation largely migrated to other hosting providers rather than stopping.

What the traffic charts showed. According to the post, reported Ukrainian drone strikes hit three Yandex facilities in Russia between 7 and 11 October. On Cloudflare Radar this culminated on 11 October, when traffic fell 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Both networks stayed disrupted through 13 October at 86–90% below normal; at 18:00 UTC on 14 October, Cloudflare put traffic at 85% of normal.

Two networks, two kinds of bots. Cloudflare classified 99.5% of requests from the Yandex Search network as automated and 93.6% of its bot requests as verified crawlers — sampled requests were mostly YandexBot (78.1%), YandexRenderResourcesBot (11.5%) and YandexImages (1.9%). On Yandex.Cloud about 95% of scored requests were bots, but none were verified; nearly two-thirds sent data to websites, and some identified themselves as JavaScript, Python or Go programs.

What actually dropped. On the search network the loss was almost entirely indexing. Publishing and newspaper sites saw the steepest fall in Yandex traffic, 44%, and Cloudflare notes that 40.5% of its customers had already been answering that crawler with HTTP 403. On Yandex.Cloud, bot traffic fell about 40%, WordPress plugin probing by 90% and scanner-identified requests by 93%.

Where it went. Cloudflare calls the gambling sector the clearest evidence: it writes that nearly all of Yandex.Cloud's bot requests were targeted at one gambling customer account. After the 8 October disruption those requests dropped to zero, and identical requests — same uncommon paths and headers — began arriving from other Russian hosting networks, including Radist and Selectel. Russian bot traffic to gambling accounts stayed essentially flat over the week, from 167.7 million to 170.1 million requests (+1.4%). Cloudflare found no unexpected change in traffic to social media platforms either, while noting that without data outside its network it cannot rule out a connection.

The point for defenders. The post argues that traffic volume from a client network is an unreliable proxy for bot behaviour, and that defence has to look at the requests themselves — shared JA4 fingerprints, anomalous request rates and WAF rules on sensitive endpoints — wherever they come from.

Source: Cloudflare, "Yandex outage: Data shows that instead of going dark, malicious bots went on the move" — https://blog.cloudflare.com/yandex-outage/