AI

Ukraine Hit Yandex’s Data Centers and Bot Traffic Collapsed. What It Does and Does Not Show

A large windowless data center building at dusk with faint cooling vapor and an empty road in front
A large windowless data center building at dusk with faint cooling vapor and an empty road in front

Between October 8 and October 11, 2026, Ukrainian drones struck three data centers belonging to Yandex, the Russian technology company often called Russia’s Google. The sites were in Sasovo, in the Ryazan region, in the Kaluga region, and in the Vladimir region east of Moscow. Yandex said operations at the Vladimir site were completely suspended. In the same days, RFE/RL, citing Cloudflare Radar, reported a collapse in automated traffic from Yandex’s network to roughly 0.4 percent of its recent peak, and social media filled with claims that Russia’s bot armies had gone quiet.

The outages are well documented. The claim about the bots is a different matter, and so far it rests mostly on anecdotes. This piece separates the two and labels each anecdote as one.

What is documented

Yandex itself and several outlets, including RFE/RL and Euronews, agree on the physical facts. Yandex confirmed damage at Vladimir and said the remaining infrastructure there was unstable. Services including ride-hailing, payments, food delivery and cloud computing were disrupted, and RFE/RL reported that service resumed on October 12, though the company said it was still working to stabilize performance. Ukraine’s president described the strikes as a response to Russian attacks on Ukrainian data centers.

The traffic number comes from Cloudflare Radar, a public tool that tracks internet activity. RFE/RL, citing Radar, described a collapse in automated traffic from Yandex’s network to roughly 0.4 percent of its recent peak, and Tom’s Hardware wrote: “Cloudflare reports that bot traffic from the Yandex network has dropped to just 0.4% of the maximum number of HTTP requests recorded in the past two weeks.” XenoSpectrum, a Japanese technology site quoted by RFE/RL, said the Radar series shows HTTP requests from AS13238, a network operated by Yandex, that were estimated to be automated traffic. Euronews, citing an analysis of the same data, put the fall at about 94 percent against the second half of September. The figures differ because they use different windows and baselines, and Radar reports values relative to a chart maximum rather than absolute counts.

What the chart measures

Several researchers say the chart is being misread. RFE/RL quoted the operator of @antibot4navalny, an account that tracks state-backed troll networks, saying the chart “has little to do with malicious propaganda bots on social media. It measures automated requests to websites (of any kind, among which social media share is negligible).” Euronews noted that the figures include legitimate automated traffic such as search-engine crawlers and do not establish whether Kremlin-linked social media bots were affected.

An independent analyst at flyingpenguin.com, who pulled Cloudflare’s own data on October 12, reported that YandexBot, Yandex’s search crawler, made up 99.8 percent of verified-bot requests from Russia in the week before the strikes and in the week of them. That analyst also found that bot-classified requests from Russia as a whole barely moved, from 86 percent of the monthly peak to 83 percent, and that the fall in Yandex’s own share accounted for most of that change. This is one analyst’s reading of public data, not a Cloudflare statement, but it matches what the other researchers say. A network that is mostly a search company’s crawler going dark would produce a chart like this.

The tool also has a plain limit. Radar sees traffic to websites that sit behind Cloudflare. It does not see activity on X, Facebook, Telegram, TikTok or YouTube.

A low angle view of a wall of server racks with several rows dark and a few still blinking

The anecdotes

Here is what has been offered as evidence that the bots fell silent. Each item below is an anecdote or a claim, and I have not been able to verify any of them as measurements.

Volodymyr Zelensky. Speaking at the Warsaw Security Forum on October 12, the Ukrainian president said that after the strikes “it suddenly became a little easier to breathe on many social media platforms,” with “less hate, less division, and fewer provocations because there were fewer bots.” He cited no platform data. This is a political statement from a party to the conflict.

Tomas Zdechovsky. The Czech member of the European Parliament posted a chart on X showing a plunge in online activity around Germany’s AfD party, writing “if confirmed, this is telling.” Euronews reported that no independently verified figures had emerged. The flyingpenguin.com analyst reported problems with the chart, including data points dated after the time it was posted. I could not check that claim independently, so treat it as the analyst’s allegation.

Social media users. Euronews reported that online activity associated with Britain’s Reform UK was also reported to have declined, and that users in the United States reported fewer apparently automated pro-conservative responses on X. Figures including Garry Kasparov, Michael McFaul and Laura Loomer joined the discussion. These are impressions of timelines, which depend on the recommendation algorithm and the day of the week.

An account-level number that did not last. According to the flyingpenguin.com analyst, a Mozilla engineer posted that average views on the main AfD account had fallen 90 percent, then edited the post hours later to say he was probably misreading the data. I have not seen the original posts.

The numbers people are citing

Some of the claims come with numbers. None of them comes from a platform, and none measures bots directly.

The AfD chart. The German technology site Rohtext reported that Zdechovsky’s post showed about 232,000 views, 3,400 reposts and 14,100 likes in a screenshot taken the evening of October 11. The chart it carried showed roughly 6,000 to 6,800 “activities per day” falling by 30 and 56 percent, with no stated source, search query or definition of “activity.” Rohtext also noted that the chart’s axis runs to October 15 although the post went up on October 11, and that it found no underlying analysis. Rohtext said this proves neither who made the chart nor how.

Rohtext’s own count. To test the claim, Rohtext used X post counts supplied by Grok for German-language posts without retweets, and checked that the hourly figures and sums were consistent. Comparing the first 18 hours of Saturday, October 10 with the same hours of Sunday, October 11, it found posts mentioning AfD down 19.3 percent (14,375 to 11,594), CDU down 17.8 percent, SPD down 36.8 percent and the Greens down 28.6 percent. AfD fell less than the SPD and the Greens, and a Sunday is not a Saturday. Rohtext’s daily AfD totals also rose 9.3 percent from Thursday, October 8 (20,572) to Friday (22,493), the day after the first strike. Rohtext says these counts say nothing about bots, because they include any post that mentions the party.

Reform UK posts. The London Economic compared recent posts by Richard Tice, Zia Yusuf and Nigel Farage with their engagement in earlier days. It reported, for example, that a clip from Yusuf, who has 158,000 followers, drew 8,000 views after three hours, and that a Farage clip drew 60,000 views after three hours. The article compares a handful of posts and gives no baseline beyond the writer’s account of earlier engagement, so it shows what the writer saw on a few posts, not a measured trend.

Two Storm-1516 stories. The London Economic also cited David Colon, a French researcher of information operations, who compared the performance of Russia-linked Storm-1516 stories before and after the strikes and reported a large difference. That is two stories, and reach on X depends on the platform’s recommendation algorithm.

What I could not find. Searches by two research passes found no before-and-after numbers from Instagram, TikTok or YouTube, none for scam or spam posts, and nothing from the tracking services of the platforms themselves.

A magnifying glass held over a tangle of glowing network lines with one thread picked out in orange

What the data points the other way

An anonymous analyst checked the r/Conservative subreddit, where users had reported fewer bots, using the public Arctic Shift archive of Reddit data. The analysis compared comments, distinct commenters, submitters, removed comments and the share of newer accounts around October 8 and 9 with a year of baseline and with control subreddits, describes its method, and offers its data as a download. Its conclusion was that nothing in a year of archived data suggests the strikes changed the subreddit, and that what people noticed is more plausibly the subreddit’s months-long decline. The author is unnamed, so this is a method others can rerun, not an authority.

The same analyst counted daily posts on public Telegram channels run by six Russian-aligned figures from September 28 to October 12 and saw no break at the time of either strike, only ordinary weekend dips. One channel posted 4.7 times a day before the strikes and 4.2 during them, another went from 21.4 to 26.8. Those are public channels, and their posting does not depend on Yandex’s servers, so this shows little about hidden networks. It does show that the visible amplifiers kept working.

The same analyst also reported checking where documented Russian influence operations are hosted. Reports from VIGINUM and others, as he summarizes them, place the Storm-1516 sites on American hosting ranges and increasingly behind Cloudflare, not on Yandex. If that is right, a strike on Yandex would not be expected to reach them.

Euronews reported that no independently verified figures had emerged for the claimed fall in AfD activity, and RFE/RL says more data is likely to emerge in the coming weeks. The research I commissioned looked for any platform or research group reporting a fall in Russian-linked accounts after the strikes and found none, though some sources were blocked to it.

The case that something real happened

None of this proves the bots were unaffected. Yandex Cloud may host scraping tools, comment spam and small campaigns, and some of the 0.4 percent could be traffic of that kind. RFE/RL says more data is likely to emerge in the coming weeks, and people who spend hours on X may really have seen their feeds change. What the evidence does not support is the jump from a search company’s outage to a conclusion about who posts on Western social networks.

What would settle it

Three things would help: platform-side data from X, Meta and Reddit on activity from flagged accounts across October, a fixed list of known influence accounts tracked against a baseline of several weeks, and a check of where known campaign domains are actually hosted. Until then, the documented story is that three data centers went down and a search crawler went quiet. The story about the bots is a hypothesis, and the evidence for it is a handful of anecdotes.


Sources: RFE/RL, “Zelenskyy Says Yandex Strikes Crippled Pro-Kremlin Bots But Tech Experts Question Evidence,” by Luke Allnutt; Euronews, “Did Ukrainian strikes on Yandex data centres cause Russian bot activity to plummet?” by Sasha Vakulina, October 12, 2026; Tom’s Hardware, “Russia’s Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of ‘Russia’s Google’ data centers” (page title continues with a subtitle about Ukraine intensifying bombing of Yandex data centers) (https://www.tomshardware.com/tech-industry/data-centers/russian-disinformation-bot-traffic-nearly-eliminated-overnight-after-ukraine-drone-strikes-cripple-multiple-of-russias-google-data-centers-ukraine-intensifies-bombing-of-yandex-data-centers-in-response-to-moscows-strikes-on-kyiv-data-centers), the source of the two-week baseline; flyingpenguin.com, “Drones Hit Yandex so Cloudflare Kept the Russians Online,” an independent analyst’s blog; Rohtext, “AfD-Bots und Yandex: Virale Grafik ohne Belege” (https://rohtext.de/news/afd-bots-offline-yandex-angriffen-was-virale); The London Economic, “Reform figures see social media engagement drop as bot accounts ‘fall silent'” (https://www.thelondoneconomic.com/politics/reform-figures-see-social-media-engagement-drop-after-strikes-on-russia-data-centres-410517/) and “Far-right bot accounts ‘fall silent’ as Ukraine strikes cripple Russian data centres” (https://www.thelondoneconomic.com/politics/what-is-yandex-ukraine-strike-russia-data-centres-410510/); an anonymous “Subreddit Activity Check” of r/Conservative built on the Arctic Shift archive (https://dx8ewpz065bse.cloudfront.net/); Cloudflare Radar. The flyingpenguin.com figures are one analyst’s reading of public data and were not independently verified.

Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com

Leave a Reply

Your email address will not be published. Required fields are marked *