Cloudflare Data Shows Yandex Outage Disrupted Bots, Not Necessarily Social Media Activity

The disruption at Yandex data centers produced a sharp drop in traffic from the company’s search and cloud services. But that isn’t evidence that social media bots went quiet. Cloudflare’s analysis shows that some automated activity on Yandex.Cloud was interrupted, then shifted to other hosting providers. Its network data can’t establish whether activity on platforms such as X changed as a result.

The distinction matters because “bot traffic” can describe very different things. Cloudflare Radar observes automated requests reaching websites on Cloudflare’s network, including search crawlers and scripts. It does not see all activity on social platforms, the hosting provider behind a particular account, or traffic sent directly to an individual platform.

That makes Cloudflare’s findings useful for tracking a disruption in web traffic, but insufficient to verify claims that it curtailed social media manipulation. The company says its assessment does not support the claim that the incident crippled such activity. It also cautions that data beyond Cloudflare’s view would be needed to rule out a connection conclusively.

What Cloudflare actually measured

After the Yandex data center disruption on October 8, Cloudflare Radar recorded a steep decline in traffic associated with two separate services. Yandex Search traffic fell 99 percent below its pre-incident baseline, while Yandex.Cloud traffic dropped 90 percent. Bot activity on Yandex.Cloud declined 40 percent, and traffic in categories Cloudflare labels “attack-like” fell by at least 90 percent.

Those figures describe activity visible to Cloudflare, not a count of social media accounts or posts. Search traffic is largely generated by verified crawlers that index webpages, images and other site resources. That’s routine work for a search engine, and its disappearance should not be treated as proof that a coordinated online operation has stopped.

Yandex.Cloud is a different service: a cloud computing platform that can host automated systems. Cloudflare says it has observed malicious bot traffic associated with that service, which helps explain why its measurements drew attention. Even so, a decline in requests coming from one hosting provider doesn’t tell the whole story. Operators can move software, infrastructure and request traffic elsewhere.

Evidence of disruption, followed by migration

Cloudflare’s report describes a specific example involving traffic aimed at a gambling customer. Nearly all of the Yandex.Cloud bot requests observed for that account were directed at it, with requests spread across the customer’s hostnames. Immediately after the October 8 disruption, requests from Yandex.Cloud to the account fell to zero. At the same time, matching requests began appearing from other Russian hosting providers.

That pattern is the clearest practical detail in the report: the original source stopped sending the requests, but the activity appeared to continue through different infrastructure. For defenders, that’s a reminder that blocking or losing access to one hosting environment may interrupt a bot operation without eliminating it. Monitoring changes in request patterns and source networks can help reveal a transition, though this example alone doesn’t describe every operator or every type of automated activity.

The measured drops were still substantial. But their meaning depends on which service generated the traffic, what kind of requests were involved, and where those requests went. A decline in normal indexing traffic and a decline in hostile automation are different events, even when they occur at the same time and within the same provider’s network.

What the data can’t establish

Cloudflare Radar doesn’t provide visibility into HTTP traffic reaching a specific customer, including X or Reddit, according to Lai Yi Ohlsen, Cloudflare’s head of Radar. Nor can Radar identify where accounts posting on those platforms are hosted. That leaves a gap between the data Cloudflare collected and the wider claims about social media activity.

In practical terms, the report supports a narrow conclusion: Yandex-related traffic dropped sharply, and some bot requests associated with Yandex.Cloud shifted to other hosting providers. It doesn’t show whether the volume, reach or effect of social media activity changed. Answering that would require platform-level information or other evidence that Cloudflare says it doesn’t possess.

There’s a broader operational lesson here. Internet infrastructure disruptions are often visible in traffic measurements, but interpreting them requires knowing what those measurements cover. A hosting provider’s traffic can include ordinary crawlers alongside potentially harmful automation; a sudden fall in one source can reflect interruption, relocation or both. Without visibility across the relevant services, correlation alone can’t settle what happened elsewhere.

Cloudflare’s analysis therefore complicates the initial story rather than proving that social media activity was unaffected. It documents a real interruption and evidence of migration, while leaving the platform-level impact unanswered. The useful next question is not simply whether traffic fell, but whether independent data from the services where the activity appeared shows a corresponding change.

Earlier coverage of the reported drop in bot activity | Cloudflare’s analysis | Related reporting on the claims | Cloudflare Radar background | Mashable newsletters