Between October 7 and 11, Ukrainian drone strikes hit three Yandex facilities across Russia, progressively knocking the company's network infrastructure offline. By October 11, Yandex Search traffic had plummeted 99% below baseline and Yandex Cloud dropped 90%. The narrative that followed — that Russian bot farms and influence operations had been crippled — spread fast across social media and news commentary. Cloudflare's data tells a more precise and less satisfying story. The two Yandex autonomous system numbers serve completely different functions. AS13238 runs Yandex's search engine, where 99.5% of requests were automated and 93.6% were verified search crawlers — YandexBot indexing news articles, images, and web resources. This is benign infrastructure. AS200350 runs Yandex Cloud, a hosting platform where 95% of traffic was bots but zero percent were verified by Cloudflare. The cloud ASN carried vulnerability scanners, probing tools, and high-volume automation scripts written in Python, Go, and JavaScript. The search crawler traffic simply disappeared. Publishing and newspaper sites saw a 44% drop in Yandex indexing traffic, with 40.5% of Cloudflare customers already blocking YandexBot via HTTP 403 responses anyway. The practical impact: less content discovery in Yandex Search, which matters for Russian-language web users but has no bearing on malicious operations. Yandex Cloud told the real story. Bot traffic from that ASN fell about 40%, with WordPress plugin probing down 90% and scanner-identified requests down 93%. But the malicious operators didn't stop working — they migrated. Cloudflare tracked identical automation fingerprints (same JA4 TLS signatures, same unusual request paths, same custom User-Agent strings) reappearing from alternative Russian hosting providers Radist and Selectel within hours. Total Russian bot traffic targeting gambling accounts — the largest malicious category — moved from 167.7 million to 170.1 million requests over the week, a 1.4% increase. The gambling sector provided the cleanest forensic evidence. Nearly all of Yandex Cloud's malicious bot requests targeted a single gambling customer account. When Yandex Cloud went down on October 8, requests from that ASN dropped to zero. Simultaneously, requests with identical fingerprints appeared from other providers. The automation maintained continuity across the migration with no meaningful disruption to the campaign. Social media traffic showed no anomalies. Russian-origin traffic to social media decreased just 0.6% during the event period, while global social media traffic rose 1.2%. Cloudflare analyzed post, reply, and like endpoints on a specific platform and found a 5.7% decrease in Russian-origin traffic and a 1.1% global increase — both within normal variation. The data does not support claims that the strikes disrupted social media manipulation. The episode is a clean lesson in the difference between infrastructure and operations. Destroying a cloud provider's data center disrupts the provider. It does not disrupt operators who treat hosting as a commodity input — and sophisticated bot operators demonstrably do. The malicious traffic was never anchored to Yandex. It was renting rack space.
