Cloudflare: Russian bot traffic barely flinched after Yandex data center strikes, just switched providers

What happened

Cloudflare examined Russian-origin bot traffic after Ukraine struck some of Yandex's largest data centers. The result is clear: the attacks slowed overall bot traffic somewhat, but malicious bots did not disappear — they simply moved to other hosting providers.

Where Yandex traffic stands

Traffic on Yandex Search and Yandex.Cloud remains at 10% to 15% of normal levels, meaning the network is still disrupted. According to Cloudflare, most traffic from Yandex Search comes from verified search crawlers indexing websites. On Yandex.Cloud, malicious activity such as vulnerability scanning and probing declined.

Where the bots went

Cloudflare says "high-volume automation did not vanish — it simply migrated to other hosting providers." One gambling-sector customer saw malicious bot requests from Yandex.Cloud drop to zero, but the same activity started arriving through networks like Radist and Selectel. Weekly request volume rose from 167.7 million to 170.1 million, a 1.4% increase.

Social media shows the same pattern

Traffic from Russian-origin IPs fell only 0.6% over the same period. On one platform, Russian bot traffic hitting posts, replies and likes dropped just 5.7%. Cloudflare therefore debunks the theory that Ukrainian strikes caused a drop in social media manipulation.

Why it matters

Cloud workloads can be moved between data centers easily. Even if an IP prefix is blocked or physical infrastructure is destroyed, operators can shift to another provider within hours and return to normal traffic levels. Cloudflare notes its analysis is limited to traffic passing through its own services.