Cloudflare data suggests Yandex outage reduced crawling, while malicious bots shifted hosts instead of disappearing

Cloudflare says reported strikes on Yandex facilities from October 7-11 drove traffic down as much as 99% for Yandex Search and 90% for Yandex.Cloud, but the effects differed by ASN. The Yandex Search drop was mostly verified crawler traffic, while Yandex.Cloud saw declines in probing and scanning, yet some malicious automation reappeared from other Russian hosting providers with the same fingerprints.

Security teams should not treat a provider-level outage or ASN-level traffic drop as proof that abuse has stopped; the gambling-account example showed traffic moving from Yandex.Cloud to Radist and Selectel while retaining the same JA4 fingerprint, paths, headers, and User-Agent strings. Blocking by host provider is simpler, but behavior-based detection is more portable across migrations; the article also notes a key limitation: origin provider does not identify who is responsible for the traffic.