Yandex outage: Data shows that instead of going dark, malicious bots went on the move
- ID
- 35535
- Status
- summarized
- Published
- 15 Oct 2026, 4:24 AM
- Fetched
- 15 Oct 2026, 5:26 AM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/yandex-outage/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 6.5
- Created
- 15 Oct 2026, 5:26 AM
- Tags
- Audience
- developerssaas_founders
What happened
Cloudflare analyzed HTTP traffic to two Yandex ASNs after reported Ukrainian drone strikes hit three Yandex facilities between October 7 and 11, 2026. Yandex Search (AS13238) traffic fell to 99% below baseline on October 11 and Yandex.Cloud (AS200350) to 90%, with both still 86-90% below normal through October 13 and Yandex overall at 85% of normal as of October 14 18:00 UTC. Crucially, the Search ASN drop was almost entirely verified crawlers (93.6% of its bot requests were Verified, 99.5% of all requests automated), while Yandex.Cloud saw a decline in vulnerability scanning and probing but high-volume automation migrated to other hosting providers rather than disappearing.
Why it matters
If you block or rate-limit by ASN, IP range, or hosting provider, this is evidence that the block is fragile: when one provider goes down, the scanning and probing traffic moved elsewhere instead of stopping. The pre-event baseline — automated requests at 36.1% of global HTTP traffic and 35.8% from Russian IP addresses — also means aggregate traffic charts are a bad proxy for whether abuse stopped. Build your abuse detection on request behavior (the classification approach Cloudflare used), not on which network the traffic came from, and don't treat an ASN's traffic drop as attribution of who is behind it.
Discussion angle
Cloudflare says traffic origin from a provider doesn't tell you who is responsible, and that the malicious automation just relocated. If you run a public API, what does your abuse detection actually key on today — IP/ASN reputation lists, or request behavior — and how would it hold up if your top-blocked hosting provider went offline tomorrow?