Cloudflare says bots moved providers after the Yandex disruption
Its 14 October analysis found matching request patterns elsewhere. A traffic drop at one network did not establish that the activity had stopped.

In this article
Cloudflare says a sharp decline in traffic from Yandex networks did not mean that all the automated activity had disappeared. In an analysis published on 14 October, it reported finding matching request patterns at other hosting providers.
The company distinguished verified search crawling from scanning and probing associated with cloud-hosted traffic. Some requests it tracked elsewhere shared technical characteristics, including TLS fingerprints, unusual paths and headers, and custom user-agent strings.
A hosting change can hide the same pattern
For website operators, the useful distinction is between a network going quiet and an activity ending. Cloudflare's account describes the former without establishing the latter.
What the evidence cannot tell us
The findings reflect traffic visible to Cloudflare, not a complete census of the internet. Similar fingerprints are investigative clues; they do not establish who operated every request or its purpose.
Auratro has not independently reproduced the analysis. The accompanying original diagram explains the reported relationship; it is not a data chart or a photograph of an attack.
Sources & further reading
Cloudflare's 14 October 2026 analysis of Yandex traffic and bot migration
Our articles help you explore AI and build practical skills. For a correction or a question, contact us. Contact

