As we read in the news this morning, Cloudflare Radar has detected a sudden and critical drop in automated bot traffic coming out of Russian tech giant Yandex’s networks. And this happened right after Ukrainian drones successfully attacked the company’s key data centers in Sasovo (a cool name) and Kaluga.
As we read in the news this morning, Cloudflare Radar has detected a sudden and critical drop in automated bot traffic coming out of Russian tech giant Yandex’s networks. And this happened right after Ukrainian drones successfully attacked the company’s key data centers in Sasovo (a cool name) and Kaluga.
According to measurements, Yandex bot traffic activity fell to a meager 0,4% of its previous peak on Sunday. On Monday, October 12, bot traffic rose slightly (to 10%). But it is still far from the level of the pre-drone attacks.
It should be emphasized here that this drop concerns only one autonomous system (ASN) — 13238, which belongs to Yandex. What is an autonomous system? This is a set of IP prefixes that can be routed on the Internet and which, as a rule, belong to one provider. In this case — Yandex. It has exactly more than 5 such systems (pools of IP prefixes). If you look at another autonomous system Yandex (215013), then everything is more stable with traffic here.
Following the attacks on data centers, reports emerged that Twitter, Facebook, and other platforms were seeing a significant decrease in the number of comments, mass reposts, and AI-generated content used to promote Kremlin narratives.
As Polish journalist Yaroslav Wolsky wrote on his page in X, "the de-Russified Internet (after arriving at Yandex data centers) suddenly works wonders on social networks."
Namely, support for the AfD on social media has dropped by 56%. “There are fewer ‘Polish’ accounts inciting Ukrainians, fewer ‘Ukrainian’ accounts inciting Poles, and online support for MAGA has fallen sharply,” he said.
This could indicate what the attack actually exposed: Yandex’s commercial servers served as a direct physical platform for deploying and hosting Russian botnets and disinformation farms around the world.
But this is still just a guess or perhaps even a coincidence.
Thus, in a post by antibot4navalny — who has long been tracking state campaigns on social media and “troll farms” — it is explained that the “bot traffic” graph from Cloudflare, which many have referred to, actually reflects the activity of Yandex’s automated web crawlers as they work on the network.
The researcher claims that this is not related to “bots” posting on social networks. “As can be seen from the graph of overall indicators for Russia, the volume of bot traffic this week (according to Cloudflare) remains about the same as in any other week,” the researcher writes.
Yandex is a search engine (among other things). Its architecture uses crawlers (automatic robots) that scan websites to index the Internet — thanks to this, the system subsequently searches the network at the user’s request.
This crawler activity is likely what Cloudflare recognizes as bot traffic.
By the way, CloudFlare often shows that the vast majority of traffic to major search engines is bots. Here’s an example from one of Google’s ASNs. Only 1,3% of the network is listed as human traffic.
Bottom line: yes, after the Ukrainian Armed Forces strikes, the total traffic in some autonomous Yandex systems dropped and on Monday it did not return to 100%.
Yes, there is a possibility that the attack affected the activity of propaganda campaigns hosted on Yandex. But this is a possibility that has no direct connection to the Cloudflare slides.
Crawlers are not equal to bots.
