Yandex Cloud Bots Moved to Selectel After the Strikes

High-volume bots left Yandex Cloud the same week Ukrainian drones hit three of the company’s data centers, and they kept working from other Russian hosts. Cloudflare researchers Marina Elmore and Lai Yi Ohlsen showed the collapse on Yandex Search was almost all verified crawlers, while matching gambling jobs reappeared on Selectel and Radist with the same JA4 fingerprint.

Yandex had already asked Selectel, K2Cloud and VK Cloud to take paying customers. The malicious scripts used the same remaining cloud market. Search indexing went quiet. The jobs did not.

Search Crawlers Took the Biggest Hit

Yandex runs two networks that look alike on a traffic chart and do different work. AS13238 carries the search engine. AS200350 carries Yandex Cloud. Between October 7 and 11, reported Ukrainian drone strikes hit halls in Sasovo in the Ryazan region, Kaluga, and Vladimir, and both ASNs fell over. On October 11, HTTP traffic was 99 percent below baseline on the search ASN and 90 percent below on the cloud ASN, Elmore and Ohlsen wrote. Through October 13 both nets were still 86 to 90 percent below normal. On October 14 at 18:00 UTC, Cloudflare put the combined reading at 85 percent of normal.

Yandex said the Sasovo site, one of its large data centers and home to tens of thousands of servers, was fully shut after a fire. The company has said that hall housed two of the three supercomputers used for its AI model. Kaluga lost several modules. Vladimir was fully halted. Yandex said no employees were hurt. Firepoint, a Ukrainian arms maker, said it used FP-1 one-way drones on what it called Yandex’s biggest hall.

Charts of “bot traffic” from AS13238 then spread as proof that influence farms had gone dark. Almost all of that ASN is a crawler. Cloudflare classed 99.5 percent of its requests as automated, and 93.6 percent of those bot requests as verified. Sampled requests were 78.1 percent YandexBot, 11.5 percent YandexRenderResourcesBot, and 1.9 percent YandexImages. The search ASN supplied about 7 percent of Russia-origin bot requests and 0.05 percent of the global total. When it died, Publishing and Newspapers saw the steepest drop, with traffic from Yandex networks down 44 percent, most of it YandexBot fetching articles.

TWO YANDEX NETWORKS, TWO KINDS OF BOTS

Global bot share of all HTTP requests barely moved, from 39.4 percent on October 1-6 to 39.5 percent on October 13. Russia-origin bot share fell from 50.4 percent to 42.1 percent, in line with the Yandex capacity that went away, because almost all traffic from those two ASNs was automated. That is a hole in two Russian networks, not a hole in the world’s bots. As of October 19, Cloudflare Radar still listed a Yandex Cloud routing table of 57 prefixes, all RPKI-valid, so the ASN remained in the table even after the halls were hit.

Yandex Opened the Door to Selectel

On October 9, after Sasovo and Kaluga, Yandex said it had agreed with Selectel, K2Cloud and VK Cloud on faster placement of affected customers’ data and services. Extra specialist teams were assigned, terms were made flexible, and sign-up was simplified so clients could move without a long queue. Yandex said it still could not give a timeline for restoring gear in the damaged halls, and that Yandex Cloud staff would work the moves with the three hosts.

Selectel is a St. Petersburg data-center operator, not a mystery ASN. The Selectel network in PeeringDB is logged as AS49505, with looking-glass and peering records that read as a normal independent Russian host. Radist LTD, the other name Cloudflare later attached to the matching jobs, is a much smaller Sochi company in RIPE records. Yandex named Selectel as a refuge for legitimate tenants. The same week, identical abusive requests showed up there.

That is the sour part of the failover. A cloud customer with backups and a ticket can change halls in hours to days. A script with a second provider account can do it on the same clock. Yandex built a door for the first group. Cloudflare’s gambling case shows the second group used a door of the same kind.

Identical Jobs Showed Up on Other Hosts

Yandex Cloud is a rental hall. About 95.0 percent of scored requests from AS200350 were bots, and Cloudflare verified none of them. Nearly two-thirds of those requests sent data to websites. Some clients identified as JavaScript, Python or Go. A larger share went to software companies than the search crawler ever did, and api.cloudflare.com was among the top hostnames, with many of those calls returning HTTP 200 before and during the event. The cloud ASN supplied about 2 percent of Russia-origin bot requests and 0.01 percent of the global total.

After the strikes, bot traffic fell about 40% from Yandex Cloud. WordPress plugin probing fell 90 percent. Scanner-tagged requests fell 93 percent. Customer blocks on that ASN fell 70 percent, which Elmore and Ohlsen read as less abuse even reaching the WAF from those addresses. Attack-like probes on that net went quiet because the machines went quiet. High-volume jobs did not.

The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable.

Marina Elmore and Lai Yi Ohlsen, Cloudflare

Immediately after the October 8 Sasovo disruption, bot requests from Yandex Cloud to one gambling customer account dropped to zero. Identical requests began arriving from other Russian hosting ASNs, including Radist and Selectel. The copy kept the same JA4 TLS client fingerprint, the same uncommon paths and HTTP headers, and the same custom User-Agent strings. Changing the hall did not change the client software.

JA4 is a TLS Client Hello fingerprint from FoxIO. It hashes how a client starts TLS, not which IP it currently rents, so the same binary keeps the same mark after a provider hop. Cloudflare’s bot docs note that the mark is built at handshake time and will not be there for plain HTTP. In this case the jobs were TLS, and the mark followed them.

What Happened to the Gambling Bots?

Most Yandex Cloud bot traffic sat in two buckets, computer software and gambling. Software was the expected mix for a public cloud. Gambling was the tell. Nearly all of that ASN’s bot requests at gambling destinations hit one customer account, moving among its hostnames. From Yandex Cloud itself, gambling-bound bot traffic fell from 23.01 million requests before the event to 18.80 million during October 7-13, an 18.3 percent drop, while the 4xx share on those calls stayed at 99.1 percent then 99.3 percent. The account was still rejecting almost everything. The source ASN was no longer Yandex.

Across all Russian origins, bot requests at gambling accounts went from 167.7 million to 170.1 million, up 1.4 percent. That all-Russia total is a different pile from the Yandex Cloud row. The first pile fell because AS200350 went down. The second pile did not, because the same clients kept running from Selectel and Radist.

YANDEX CLOUD BOTS BY DESTINATION

4xx shares fell in most of those rows as the scan-and-probe traffic dropped off this ASN. Gambling did not get a holiday. Anyone watching only Yandex Cloud would have logged a win. Anyone watching the customer’s hostnames would have seen the same paths arrive from new addresses.

Inauthentic Posts Fell, Then Came Back

The viral claim was that social manipulation died with the halls. Cloudflare looked at HTTP to social platforms and did not find that. Russian-origin traffic to social destinations was down 0.6 percent over the event period, and global social traffic was up 1.2 percent. On bot hits to post, reply and like endpoints of one platform, Russian-origin volume was down 5.7 percent and global volume was up 1.1 percent. Elmore and Ohlsen wrote that this does not support a claim that the strikes crippled social manipulation, and that they cannot rule out a link without data outside Cloudflare.

Ukraine’s Center for Countering Disinformation, measuring a different thing, did see a short silence. Using Osavul on Facebook and Telegram in the Ukrainian information segment across 26 topics from October 6 to 12, it logged 22,664 messages from 5,201 accounts flagged as inauthentic, 14,058 of them on Facebook (62.0 percent) and 8,606 on Telegram (38.0 percent). On October 8 it recorded an 83.6 percent message decline, from 4,032 to 660, with active accounts down from 1,526 to 258. Telegram fell 90.0 percent that day and Facebook 79.5 percent. Volume was 2,231 on October 9, 4,585 on October 10, and 4,711 on October 11, above the October 7 level. After Vladimir shut, October 12 fell to 2,704, down 42.6 percent, with active accounts down from 1,976 to 1,166. A 98-account subset that had pushed destructive content fell 77.8 percent on October 8, from 198 messages to 44, then also recovered.

THE WEEK THE HALLS WENT DOWN

1. October 8: Yandex fully suspends Sasovo after a fire; the CCD sample of inauthentic messages falls 83.6 percent.
2. October 9: Kaluga loses several modules; Yandex names Selectel, K2Cloud and VK Cloud for customer moves; CCD volume is already climbing back.
3. October 11: Vladimir is fully halted; Yandex Search HTTP is 99 percent below baseline; CCD messages sit at 4,711, above the pre-Sasovo day.
4. October 12: CCD messages fall 42.6 percent, to 2,704, the day after Vladimir.
5. October 14: Elmore and Ohlsen publish the ASN split and the Selectel/Radist hop; Cloudflare puts Yandex traffic at 85 percent of normal at 18:00 UTC.

Graphika, which maps online communities, tested the Western political claim that AfD, MAGA and Reform UK accounts had gone quiet and found no notable loss of active accounts or heaviest posters in those groups. The clearest drop it reported was in Russian-speaking spaces, where Russian-language Telegram channels posted 5 to 15 percent less in the two days after the Vladimir strike than in the same hours of earlier weeks. That is a real dip. It is also not the “bots at zero” chart that ran on October 11.

Did the Yandex data center strikes silence Russian bots?

In recent days, viral posts claimed Ukrainian drone strikes on three data centers in Russia operated by the Russian technology company Yandex silenced Russian-run accounts in AfD, MAGA and Reform UK communities.

We…

— Graphika (@Graphika_NYC) October 14, 2026

WHERE EXPERTS DISAGREE

• Cloudflare HTTP: No unexpected swing in social traffic or in bot hits on one platform’s post, reply and like endpoints, from Russian IPs or globally.
• CCD sample: Two sharp drops in inauthentic Facebook and Telegram activity in the Ukrainian segment after Sasovo and Vladimir, each followed by a rebound.
• Graphika maps: No notable change in the Western political communities named in viral posts; a 5 to 15 percent dip in Russian-language Telegram after Vladimir.

Those findings can sit together. A crawler ASN can fall 99 percent, a Ukrainian-segment poster sample can go quiet for a day, and a gambling client can keep the same JA4 on a new host. The mistake was treating the Radar bot chart for AS13238 as a troll-farm census. Researchers who track those farms said as much while the screenshot was still circulating: that plot is Yandex fetching the web, and farms that run on residential proxies would not have been in it.

Why the Scripts Kept Running Anyway

A rented VM is not a building. When Sasovo burned, every process pinned to those racks stopped. Any process with an account on another Russian cloud could be pointed at a new IP in the time it takes to image a host. Yandex told paying customers to do that on October 9. Cloudflare watched a gambling workload do the equivalent on October 8, before the press note, which is how you know the operators did not need Yandex’s help.

Influence work that already lived on home proxies, infected devices or non-Yandex VPS would not have shown up in AS13238 or AS200350, so knocking those nets down would not have shown up as a social holiday either. The durable HTTP effect was less YandexBot against news sites, including sites that already answered 403. The durable abuse effect was a reminder to bind blocks to client behavior, not to a friendly ASN.

WHAT TRAVELED WITH THE JOBS

• JA4 mark: The TLS Client Hello stayed the same after the IP and ASN changed, which is what the fingerprint is for.
• Paths and headers: Uncommon request paths and HTTP headers copied across Radist and Selectel with the gambling account.
• User-Agent strings: Custom agent lines survived the move, so a UA allowlist by old Yandex Cloud ranges would have failed.
• Volume: All-Russia gambling-bot requests still rose 1.4 percent for the week, so the customer never saw a quiet inbox.

Elmore and Ohlsen closed on a point operators already know and keep ignoring when a famous ASN lights up red: inspect shared JA4s, odd paths and WAF hits on sensitive endpoints, whatever net the packet came from. On October 19 the cloud ASN still announced 57 prefixes. The gambling jobs had already found other halls.