In an analysis published October 14, 2026, Cloudflare said requests to one gambling customer from Yandex.Cloud fell to zero after the October 8 disruption, while requests with matching characteristics appeared on other Russian hosting networks, including Radist and Selectel. The observation points to a shift in that customer’s request traffic between providers; it does not identify who operated the requests. Cloudflare’s analysis also distinguishes Yandex.Cloud’s activity from the largely verified search crawling it observed on Yandex Search.
NeoTeo previously covered why a drop in Yandex traffic did not show that Russian bots had stopped. Cloudflare’s analysis adds a specific example of matching requests appearing on other hosting networks.
What Cloudflare matched across providers
Cloudflare compared several characteristics in requests targeting the same gambling customer: a JA4 TLS fingerprint, uncommon request paths and HTTP headers, and custom User-Agent strings. JA4 is a fingerprint derived from a client’s TLS connection; together, these features let Cloudflare match request patterns across providers. They do not establish that the same person or organization operated them.
The example is specific to one customer. Cloudflare also reported that Russian bot requests targeting gambling accounts totaled 167.7 million before the event and 170.1 million during the reported event week, an increase of 1.4%. That broader total stayed nearly flat even as requests from Yandex.Cloud to the individual customer dropped to zero.
Yandex Search and Yandex.Cloud had different traffic profiles
Cloudflare associates Yandex Search with AS13238 and Yandex.Cloud with AS200350. An autonomous system number, or ASN, identifies a network on the internet. The two networks carried different kinds of automated traffic in Cloudflare’s analysis.
| Network and ASN | Role in Cloudflare’s analysis | Observed automated activity |
| Yandex Search (AS13238) | Search network | Predominantly verified crawling |
| Yandex.Cloud (AS200350) | Cloud-hosting network | Software-related requests, alongside attack-like scanning and the gambling-account example |
Cloudflare classified 99.5% of observed AS13238 requests as automated and 93.6% of its bot requests as verified. For AS200350, about 95% of scored requests were bots, and Cloudflare verified none of the observed bot requests. That classification does not by itself mean those requests were malicious: Cloudflare also described successful software-related activity.
Cloudflare reported that Yandex.Cloud bot traffic fell about 40%, while WordPress plugin probing fell 90% and scanner-identified requests fell 93%. These declines describe different traffic categories; they do not show that every automated request from Yandex.Cloud had the same purpose.
What the traffic says about social media
In this analysis, “bot traffic” means automated HTTP requests to websites on Cloudflare’s network. Cloudflare separately reported no unexpected change in the social-media traffic it measured, including sampled post, reply and like endpoints. It said its data could not conclusively determine whether the reported disruptions were connected to social-media manipulation.
The network measurements describe requests and their provider paths. They do not name the operators behind the traffic.
