Source: Cloudflare threat researchers Marina Elmore and Lai Yi Ohlsen published a forensic network traffic post-mortem on October 14, 2026, detailing global routing data following the Yandex outages.
Cloudflare's breakdown contrasted Yandex's two distinct autonomous systems: AS13238, dedicated to search engine indexing, and AS200350, hosting general cloud tenants. Prior to the strikes, automated activity accounted for 36.1% of all global HTTP traffic on Cloudflare and 35.8% of traffic originating from Russian IP space.
On AS13238, verified crawlers including YandexBot (78.1%), YandexRenderResourcesBot (11.5%), and YandexImages (1.9%) plummeted to near zero, giving immediate relief to web servers where 40.5% of requests had previously been answered with HTTP 403 Forbidden blocks.
In contrast, on Yandex.Cloud, malicious scanner traffic dropped by 93% and WordPress exploit attempts fell 90% only from that specific network. Telemetry monitoring a targeted commercial gambling customer showed bot requests from Yandex.Cloud vanished on October 8, only to reappear simultaneously from Radist and Selectel networks with matching JA4 TLS fingerprints and request payloads.
Cloudflare researchers warned that security operations teams must not mistake regional autonomous system outages for neutralized threat actors, as automated command systems can reroute traffic pools in seconds.