aiqbench analysis
This analysis demonstrates that infrastructure degradation from strikes did not neutralize Russian bot operations, as malicious actors rapidly migrated to alternative hosting providers rather than ceasing activity. The distinction between legitimate search crawlers and adversarial automation highlights the resilience of threat actors in adapting to physical network disruptions.
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks.
Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. Using Cloudflare Radar and Bot Management data, we analyzed how these two ASNs were affected — and while both saw drops in traffic, they saw differing impact. Yandex Search (AS13238): The drop in traffic consisted almost entirely of verified search crawlers indexing web pages, images, and site resources. Yandex.Cloud (AS200350): There was a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish — it simply migrated…
Excerpt shown under the publisher's RSS terms · 142 words · full text and figures are on the publisher's site
