FOLLOWING reported strikes on Yandex data centres, Cloudflare’s Radar and Bot Management data show that the initial expectation of a broad collapse of Russian bot activity was misleading. Across two distinct Yandex autonomous systems—AS13238 (Yandex Search) and AS200350 (Yandex[.]Cloud)—traffic fell, but the effects differed. Yandex Search saw a drop almost entirely in verified search crawlers indexing pages, images and site resources.
Yandex[.]Cloud also declined in automated activity, but high‑volume bot traffic did not disappear; it migrated to other hosting providers rather than stopping.
The analysis highlights nuanced changes: AS13238’s traffic drop was dominated by automated indexing rather than malicious activity, with about 7% of Russia-origin bot requests and 0.05% of global bot traffic linked to Yandex Search. By contrast, AS200350 carried a different bot mix—about 95% of scored requests were bots, but none of the observed bot requests were verified.
WordPress plugin probing and scanner‑identified requests fell sharply, while the overall automation persisted by shifting to other providers, illustrated by a preserved volume of bot activity targeting a gambling account using the same JA4 fingerprint and request patterns across providers. Importantly, there was no evidence that the regional strikes crippled social media manipulation or other global malicious activities; the data instead suggest that bot workloads were relocated, not extinguished.
The report stresses that defending against automated threats requires analysing request behaviour and fingerprints, not relying on ASN traffic volume alone.