Breaking Lab srl
What a power cut revealed about bad bot traffic
When labour strikes disrupted Yandex data centres — Yandex is Russia’s largest search engine and cloud provider — many observers assumed the bot activity routed through those facilities would simply stop. Cloudflare, the company that sits in front of a huge slice of the world’s web traffic, watched what actually happened. The answer is unsettling for anyone who runs a website.
Legitimate Yandex search crawlers did go quiet, exactly as you would expect when the servers they run on lose power. But the malicious bots — the ones scraping data, probing for vulnerabilities, or hammering login pages — barely missed a beat. Within a short window they had migrated to other networks and carried on as before.
Why this matters if you host anything online
Most website owners think of bad bots as a problem tied to a particular IP address or country. Block the address, problem solved. What the Yandex outage shows is that organised bot operations are far more resilient than that. They are not running from a single location — they are distributed across many networks, and when one route closes, they find another.
For a small server owner, the practical implication is straightforward: IP-based blocking alone is not enough. If a bot network can survive a complete data centre outage, it can certainly survive you banning a handful of IP ranges. Tools that look at behaviour — request patterns, browser fingerprints, how fast a client navigates pages — catch more than tools that only look at where traffic comes from.
The quieter lesson about infrastructure resilience
There is a second lesson here that has nothing to do with attackers. If your own hosting depends on a single data centre or a single provider, an outage there means your site goes dark. The bots, ironically, have better failover planning than many legitimate websites. Spreading your setup across two providers, or at least keeping a current backup ready to spin up elsewhere, is the same kind of thinking — applied honestly.
Going forward, events like this give network researchers a rare, unplanned experiment: a large provider suddenly switching off lets analysts separate legitimate traffic from traffic that was never supposed to exist. Expect more of this kind of analysis as infrastructure disruptions become a regular research tool — and expect hosting providers to use the findings to build smarter, behaviour-aware traffic filters into their standard offerings.
