Cloudflare复盘Yandex宕机：恶意机器人流量迁移而非消失
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
安全与风控从业者必读，这篇工程复盘用真实数据拆解了“流量归零”背后的流量迁移真相，提供了基于TLS指纹和行为特征的溯源思路。
Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services.
在据报道对 Yandex 数据中心发动袭击后，互联网上流传着俄罗斯机器人农场和影响力行动已被切断的说法。HTTP 流量图表显示大幅下降，加剧了人们对基础设施损坏已阻止这些恶意行为者的猜测。然而，聚合流量指标很容易产生误导。与 Yandex 关联的自治系统编号（ASN）有两个：AS13238 用于 Yandex 搜索引擎，而 AS200350 运行其云服务。
Using Cloudflare Radar and Bot Management data, we analyzed how these two ASNs were affected — and while both saw drops in traffic, they saw differing impact.
利用 Cloudflare Radar 和 Bot Management 数据，我们分析了这两个 ASN 受到的影响——尽管两者都出现了流量下降，但受到的影响程度不同。
- Yandex Search (AS13238): The drop in traffic consisted almost entirely of verified search crawlers indexing web pages, images, and site resources.
- Yandex.Cloud (AS200350): There was a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish — it simply migrated to other hosting providers.
- Yandex Search (AS13238)：流量的下降几乎完全由验证过的搜索爬虫组成，这些爬虫正在索引网页、图片和站点资源。
- Yandex.Cloud (AS200350)：漏洞扫描和探测等恶意活动有所减少，但大规模自动化并未消失——它只是迁移到了其他托管提供商。
While malicious traffic may originate from a particular provider, it does not necessarily tell us who is responsible for the traffic. Understanding why the strikes had little lasting effect on malicious traffic requires analyzing request behavior, rather than just overall traffic patterns.
虽然恶意流量可能源自某个特定提供商，但这并不一定告诉我们谁对该流量负责。理解袭击为何对恶意流量没有产生持久影响，需要分析请求行为，而不仅仅是整体流量模式。
What happened: the effect of the strikes and pre-event baseline
发生了什么：袭击的影响和事件前的基线
Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. As seen on Cloudflare Radar, this culminated in a near-total collapse of the Yandex network on October 11 when traffic plummeted to 99% below baseline for Yandex Search (AS13238) and 90% for Yandex.Cloud (AS200350). Despite a brief partial recovery, both networks remained disrupted through October 13, settling at 86-90% below normal baselines. (As of October 14 at 18:00 UTC, traffic is at 85% of normal.)
10 月 7 日至 11 日期间，据报乌克兰无人机袭击了俄罗斯境内的三处 Yandex 设施，逐步导致数据中心和网络容量离线。正如 Cloudflare Radar 所示，这最终导致 Yandex 网络在 10 月 11 日近乎全面崩溃，Yandex Search (AS13238) 的流量比基线下降了 99%，Yandex.Cloud (AS200350) 下降了 90%。尽管出现短暂的局部恢复，但两个网络直到 10 月 13 日仍处于中断状态，维持在低于正常基线 86-90% 的水平。（截至 10 月 14 日 UTC 时间 18:00，流量为正常的 85%。）
A drop in overall HTTP traffic only confirms that the network went down. It does not reveal whether malicious or evasive bots were disrupted. Looking at the pre-event automation baseline, we can see that before the strikes, automated requests accounted for 36.1% of all HTTP traffic observed globally across Cloudflare's network, and 35.8% of traffic from Russian IP addresses.
整体 HTTP 流量的下降仅确认网络已宕机。它并不能揭示恶意或规避型机器人是否受到干扰。通过查看事件前的自动化基线，我们可以看到，在袭击发生前，自动化请求占 Cloudflare 全球网络中所有观测到的 HTTP 流量的 36.1%，以及来自俄罗斯 IP 地址流量的 35.8%。
The outage had different effects on automated activity on the two affected ASNs because they served different roles.
由于这两个受影响的 ASN 服务于不同的角色，这次故障对它们的自动化活动产生了不同的影响。
Yandex Search ASN (AS13238) is used for search index crawling. Cloudflare classified 99.5% of its requests as automated, and 93.6% of its bot requests as Verified. Our analysis showed that traffic from this ASN indexed pages, rendered pages, and rendered images, which is consistent behavior for a search crawler. The Yandex Search ASN supplied about 7% of Russia-origin bot requests, and just 0.05% of the global total.
Yandex Search ASN（AS13238）用于搜索索引爬取。Cloudflare 将其 99.5% 的请求归类为自动化请求，并将其 93.6% 的机器人请求标记为已验证。我们的分析表明，来自该 ASN 的流量对页面、渲染后的页面以及渲染后的图像进行了索引，这与搜索爬虫的行为一致。Yandex Search ASN 提供了约 7% 的源自俄罗斯的机器人请求，仅占全球总量的 0.05%。
Yandex.Cloud ASN (AS200350) is a cloud-hosting network and carries a very different mix of automation. Approximately 95.0% of its scored requests were bots, but none of its observed bot requests were verified by Cloudflare. Yandex.Cloud’s bots looked more like software apps: nearly two-thirds of their requests sent data to websites, some identified themselves as JavaScript, Python, or Go programs, and a larger share went to software companies than Yandex’s search bots. The Yandex.Cloud ASN supplied about 2% of Russia-origin bot requests, and just 0.01% of the global total.
Yandex.Cloud ASN（AS200350）是一个云托管网络，其自动化混合比例截然不同。大约 95.0% 的评分请求是机器人请求，但其观察到的所有机器人请求均未获得 Cloudflare 的验证。Yandex.Cloud 的机器人更像软件应用程序：近三分之二的请求向网站发送数据，部分请求将自己标识为 JavaScript、Python 或 Go 程序，且流向软件公司的请求比例高于 Yandex 的搜索机器人。Yandex.Cloud ASN 提供了约 2% 的源自俄罗斯的机器人请求，仅占全球总量的 0.01%。
Impact of the event on overall bot traffic
事件对整体机器人流量的影响
"Bot traffic" refers to automated requests to websites on Cloudflare's network, such as crawlers and scripts, not necessarily activity on social media platforms. As Yandex’s networks lost capacity, their bot requests fell too. That was expected: nearly all traffic from Yandex Search and Yandex.Cloud was automated. While we saw the obvious drop in total traffic, we did not see any evidence linking a global disruption in malicious traffic to the drop in traffic from Yandex.
“机器人流量”指的是 Cloudflare 网络上针对网站的自动化请求，例如爬虫和脚本，并不一定指社交媒体平台上的活动。随着 Yandex 网络的容量损失，其机器人请求也随之下降。这是预期的结果：来自 Yandex Search 和 Yandex.Cloud 的几乎所有流量都是自动化的。虽然我们看到了总流量的明显下降，但没有发现任何证据表明恶意流量的全球中断与来自 Yandex 的流量下降有关。
Russia-origin bot requests fell roughly in proportion to the Yandex traffic that went offline, since most requests from those networks were automated.
源自俄罗斯的机器人请求大致按比例下降，这与 Yandex 流量离线情况相符，因为这些网络的大多数请求都是自动化的。
| Date UTC+3 | Global bot requests (% of all HTTP requests)* | Russia-origin bot requests (% of Russia-origin HTTP requests) |
|---|---|---|
| October 1–6: pre-event baseline | 39.4% | 50.4% |
| October 7–8: drone strike on Sasovo | 39.2% (−0.2%) | 48% (-2.4%) |
| October 9: drone strike on Kaluga | 39.4% (+0%) | 42.5% (-7.9%) |
| October 11: drone strike on Vladimir | 39.5% (+0.1%) | 42.2% (−8.2%) |
| October 12 | 39.6% (+0.2%) | 43.6% (−6.8%) |
| October 13 | 39.5% (+0.1%) | 42.1% (−8.3%) |
| UTC+3 日期 | 全球机器人请求（占所有 HTTP 请求的百分比）* | 源自俄罗斯的机器人请求（占源自俄罗斯的 HTTP 请求的百分比） |
|---|---|---|
| 10 月 1–6 日：事件前基准 | 39.4% | 50.4% |
| 10 月 7–8 日：对萨索诺的无人机袭击 | 39.2%（−0.2%） | 48%（-2.4%） |
| 10 月 9 日：对卡卢加的无人机袭击 | 39.4%（+0%） | 42.5%（-7.9%） |
| 10 月 11 日：对弗拉基米尔的无人机袭击 | 39.5%（+0.1%） | 42.2%（−8.2%） |
| 10 月 12 日 | 39.6%（+0.2%） | 43.6%（−6.8%） |
| 10 月 13 日 | 39.5%（+0.1%） | 42.1%（−8.3%） |
* Radar reports global traffic by both total HTTP requests, and by HTML requests (an approximation of a page view). The above table reflects total request volume.
* Radar 报告通过总 HTTP 请求量和 HTML 请求量（页面浏览量的近似值）来统计全球流量。上述表格反映的是总请求量。
Impact on Yandex Search ASN (AS13238): less search crawling
对 Yandex Search ASN（AS13238）的影响：搜索爬取减少
The decline on Yandex Search ASN was almost entirely search crawling. Sampled requests showed that 78.1% belonged to verified YandexBot, 11.5% to YandexRenderResourcesBot, and 1.9% to YandexImages.
Yandex Search ASN 的下降几乎完全源于搜索爬取。抽样请求显示，78.1% 属于已验证的 YandexBot，11.5% 属于 YandexRenderResourcesBot，1.9% 属于 YandexImages。
Among websites and services, the industry segment that saw the steepest drop was Publishing and Newspapers, where traffic from Yandex networks fell 44%. Approximately 90% of pre-event traffic to news sites from this ASN was YandexBot indexing articles, with 40.5% of Cloudflare customers returning HTTP 403 Forbidden responses because the site owner blocked the crawler. When the Yandex Search ASN went offline, customers simply saw less indexing from Yandex.
在网站和服务中，跌幅最陡峭的行业板块是出版与报纸，来自 Yandex 网络的流量下降了 44%。在此 ASN 发生事件前，流向新闻网站的流量中约有 90% 是 YandexBot 对文章进行索引，其中 40.5% 的 Cloudflare 客户返回了 HTTP 403 Forbidden（禁止访问）响应，因为网站所有者阻止了该爬虫。当 Yandex Search ASN 下线时，客户只是看到来自 Yandex 的索引量减少。
Impact on Yandex.Cloud ASN (AS200350): legitimate use and migrating malicious traffic
对 Yandex.Cloud ASN (AS200350) 的影响：合法使用及恶意流量的迁移
Yandex.Cloud displayed a completely different profile. Following the reported strikes, bot traffic from Yandex.Cloud fell about 40%. Several attack-like categories showed especially sharp declines. For example, WordPress plugin probing fell 90% and scanner-identified requests fell 93%. Interestingly (and tellingly), Cloudflare customer blocks on Yandex.Cloud traffic also fell 70% during the event period, suggesting that proportionately less malicious traffic was even hitting the Cloudflare WAF from this ASN.
Yandex.Cloud 呈现出完全不同的特征。在报告的袭击之后，来自 Yandex.Cloud 的机器人流量下降了约 40%。几个类似攻击的类别显示出特别急剧的下降。例如，WordPress 插件探测下降了 90%，扫描器识别的请求下降了 93%。有趣的是（且具有指示意义），在事件期间，Cloudflare 客户对 Yandex.Cloud 流量的拦截也下降了 70%，这表明从该 ASN 进入 Cloudflare WAF 的恶意流量比例相对更少。
Impact on business verticals
对业务垂直领域的影响
Yandex.Cloud’s bot traffic is also interesting when segmented by top request destination industries:
按顶级请求目的地行业细分时，Yandex.Cloud 的机器人流量也很有趣：
| Destination industry | Bot traffic pre-event | Bot traffic during event (Oct 7-13) | Change | 4xx (client error) HTTP response status share: pre → event |
|---|---|---|---|---|
| Computer software | 24.24M | 15.18M | −37.4% | 18.5% → 15.9% |
| Gambling | 23.01M | 18.80M | −18.3% | 99.1% → 99.3% |
| Media incl. adult | 1.33M | 223.1K | −83.3% | 82.0% → 61.8% |
| Internet and telecom | 524.2K | 206.5K | −60.6% | 71.4% → 51.1% |
| Travel / tourism | 363.9K | 158.1K | −56.6% | 27.0% → 12.3% |
| Retail / wholesale | 316.0K | 167.7K | −46.9% | 71.0% → 55.9% |
| Gaming / computer games | 226.3K | 63.2K | −72.1% | 51.4% → 9.2% |
| Publishing / newspapers | 90.8K | 8.8K | −90.3% | 90.2% → 61.4% |
| 目的地行业 | 事件前的机器人流量 | 事件期间的机器人流量（10月7日-13日） | 变化 | 4xx（客户端错误）HTTP 响应状态占比：事件前 → 事件 |
|---|---|---|---|---|
| 计算机软件 | 2424万 | 1518万 | −37.4% | 18.5% → 15.9% |
| 赌博 | 2301万 | 1880万 | −18.3% | 99.1% → 99.3% |
| 媒体（含成人内容） | 133万 | 22.31万 | −83.3% | 82.0% → 61.8% |
| 互联网和电信 | 52.42万 | 20.65万 | −60.6% | 71.4% → 51.1% |
| 旅游/旅游业 | 36.39万 | 15.81万 | −56.6% | 27.0% → 12.3% |
| 零售/批发 | 31.60万 | 16.77万 | −46.9% | 71.0% → 55.9% |
| 游戏/电脑游戏 | 22.63万 | 6.32万 | −72.1% | 51.4% → 9.2% |
| 出版/报纸 | 9.08万 | 8800 | −90.3% | 90.2% → 61.4% |
The majority of traffic from the Yandex.Cloud ASN fell into two industry buckets: computer software and gambling. The computer software bucket was predictable for an ASN meant to host third-party applications and software integrations. In fact, we even saw that api.cloudflare.com is a top hostname for Yandex.Cloud request traffic. An overall majority of that traffic succeeded (requests returned 200s) both before and during the event, pointing to legitimate usage.
来自 Yandex.Cloud ASN 的大部分流量落入两个行业类别：计算机软件和赌博。对于一个旨在托管第三方应用程序和软件集成的 ASN 来说，计算机软件类别的出现是可预见的。事实上，我们甚至观察到 api.cloudflare.com 是 Yandex.Cloud 请求流量的主要主机名之一。总体而言，大部分流量在事件前后都成功（请求返回 200 状态码），这表明这是合法的使用行为。
The gambling sector offers the clearest evidence that malicious automation relocated rather than disappeared. Nearly all of Yandex.Cloud’s bot requests were targeted at one gambling customer account, with traffic shifting among its hostnames. Immediately following the October 8 disruption, bot requests from Yandex.Cloud to this account dropped to zero. Simultaneously, identical requests began appearing from other Russian hosting ASNs, including Radist and Selectel. The incoming traffic maintained an identical fingerprint across providers:
赌博行业提供了最清晰的证据，表明恶意自动化活动只是发生了转移而非消失。Yandex.Cloud 几乎所有的机器人请求都针对一个赌博客户账户，流量在其主机名之间切换。在 10 月 8 日中断事件发生后，来自 Yandex.Cloud 对该账户的机器人请求立即降至零。与此同时，相同的请求开始出现在其他俄罗斯托管 ASN 中，包括 Radist 和 Selectel。跨提供商的传入流量保持了相同的指纹：
- The same JA4 TLS client fingerprint
- The same uncommon request paths and HTTP headers
- The same custom User-Agent strings
- 相同的 JA4 TLS 客户端指纹
- 相同的非常见请求路径和 HTTP 头
- 相同的自定义 User-Agent 字符串
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力