Yandex Went Down, but Malicious Bots Didn't Go Dark: They Moved!

Hi, it's Shii-chan! Today I have a surprising piece of data analysis from the Cloudflare blog!

Cloudflare Blog blog.cloudflare.com

What was announced?

This is a Cloudflare Blog post. Between October 7 and 11, strikes were reported on three Yandex facilities in Russia (the post's table names Sasovo, Kaluga, and Vladimir). Many assumed Russian bot operations went dark, but Cloudflare's data tells a different story.

The conclusion: search crawling stopped, but malicious bots simply migrated to other networks.

Why it matters

In bot defense, it's tempting to rely on which network traffic comes from. But we didn't have a clear picture of what malicious automation does when its network goes down. This real-world outage turned out to be that experiment.

What changes

It's now clear that judging bot activity by the network it originates from can be unreliable. The post argues defenses should focus on request behavior.

Dive Deep

The analysis used Cloudflare Radar traffic data and Bot Management data, and looked at two Yandex autonomous systems separately. Signals included Verified bot status, sampled request analysis, JA4 TLS fingerprints, paths, headers, and User-Agent strings.

Here is how traffic dropped:

• On October 11, Yandex Search (AS13238) was 99% below baseline and Yandex.Cloud (AS200350) was 90% below
• They stayed 86-90% below through October 13, and by October 14 at 18:00 UTC traffic was at 85% of normal

The two networks had very different profiles:

• Yandex Search: 99.5% of requests were automated, and 93.6% of its bot requests were verified bots. The activity matched normal search crawling, such as YandexBot indexing and rendering. It made up about 7% of Russia-origin bot requests and 0.05% of the global total
• Yandex.Cloud: about 95.0% of scored requests were bots, but none of the observed bot requests were verified. It made up about 2% of Russia-origin bot requests and 0.01% of the global total. During the event, bot traffic fell about 40%, WordPress plugin probing fell 90%, and scanner-identified requests fell 93%

The post also shows evidence of migration. Bot requests from Yandex.Cloud to one gambling customer account dropped to nearly zero right after the October 8 disruption. Identical requests then appeared from other Russian hosting providers, including Radist and Selectel, with the same JA4 fingerprint, uncommon paths and headers, and custom User-Agent strings. Russian bot traffic to gambling accounts stayed roughly flat over the week, rising from 167.7 million to 170.1 million requests (+1.4%).

Overall bot share barely moved:

• The global bot share of HTTP requests stayed between 39.2% and 39.6%
• The Russia-origin bot share fell by up to about 8 percentage points from the 50.4% baseline (October 1-6)

Note that the baseline figures in the post's text (36.1% global, 35.8% Russia) differ from the table's, and the post doesn't explain why.

They also checked for social media manipulation: bot traffic to post, reply, and like endpoints on one platform fell 5.7% from Russia and rose 1.1% globally, with no unexpected shift. The authors add that without data from outside Cloudflare, they can't conclusively rule out a link.

Wrap-up

• Search crawling (mostly verified bots) dropped sharply, affecting search indexing
• Malicious automation moved quickly to other hosting providers
• Traffic volume by origin network is an unreliable proxy for malicious bot activity
• Defenses should focus on behavior: shared JA4 fingerprints, anomalous request rates, and WAF rules on sensitive endpoints

This is worth a read for anyone working on bot and abuse defense!