Following reported strikes on Yandex data centers, claims circulated online that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead.
There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex's search engine, while AS200350 runs its cloud services. Using Cloudflare Radar and Bot Management data, researchers analyzed both ASNs and found that both saw drops in traffic, but with differing impact. Yandex Search (AS13238) saw a drop consisting almost entirely of verified search crawlers indexing web pages, images, and site resources. Yandex.Cloud (AS200350) saw a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish; it simply migrated to other hosting providers.
Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia. Traffic plummeted to 99% below baseline for Yandex Search and 90% for Yandex.Cloud on October 11. Both networks remained disrupted through October 13, settling at 86-90% below normal baselines, and as of October 14 at 18:00 UTC, traffic was at 85% of normal.
A drop in overall HTTP traffic only confirms that the network went down. It does not reveal whether malicious bots were disrupted. Before the strikes, automated requests accounted for 36.1% of all HTTP traffic globally. Yandex Search supplied about 7% of Russia-origin bot requests, while Yandex.Cloud supplied about 2%. Researchers found no evidence linking a global disruption in malicious traffic to the drop in traffic from Yandex.
Source: Hacker News · Summarized by HeadlinesBriefing