Speaking at the Warsaw Security Forum on Monday, Ukrainian President Volodymyr Zelensky said that once Ukraine’s drones reached the data centers of Yandex, Russia’s largest technology company, “it suddenly became a little easier to breathe on many social media platforms.” There was less hate and fewer provocations because there were fewer bots, he said, and it was clear where they had come from.
Ukraine’s drones did hit three Yandex data centers over the past week, and the company says so itself. The claim that the strikes silenced Russia’s online propaganda rests on a single chart from Cloudflare, the internet infrastructure company. That chart doesn’t measure social media bots at all.
One network’s HTTP requests, read as a bot army
Cloudflare Radar, the company’s public traffic monitor, tracks web requests coming from individual networks. Yandex’s main network is registered as AS13238. On Monday morning Cloudflare posted its chart for that network, with a note that traffic was already about 35% lower after the first strike and then “fell 99% vs. last week” at about 00:30 UTC on Oct. 11, when the company’s Vladimir site shut down.
The chart is titled “HTTP traffic from AS13238.” It counts requests that Yandex’s machines send to websites protected by Cloudflare. Nearly all of that traffic is automated. Yandex runs a search engine, and its crawlers visit websites to index them. The Deep Dive, a Canadian news site that went through the Radar page, found bots made up 99.6% of the network’s requests over seven days. That’s normal for a search company’s network.
So when Yandex’s servers went dark, its crawler traffic went with them. The researcher behind @antibot4navalny, an account that tracks Kremlin-backed troll networks, told Radio Free Europe/Radio Liberty that the chart “has little to do with malicious propaganda bots on social media.” The requests it counts can go to any kind of website, the researcher said, and social media is a negligible share. Euronews, whose headline asked whether bot activity had plummeted, noted in the same article that the data includes legitimate crawlers and doesn’t establish that Kremlin-linked bots were touched.
The figures circulating online differ because they use different baselines:
- About 0.4% of the chart’s recent peak, the figure Tom’s Hardware reported on Sunday as “bot traffic from the Yandex network,” and the one RFE/RL cites.
- 0.3% of the chart’s maximum at 02:00 UTC on Oct. 11, against 88.2% at the same hour a week earlier, by The Deep Dive’s reading.
- About 94% below the average for the second half of September, from Euronews’s analysis of the Radar data for Sunday.
Cloudflare’s chart also shows traffic climbing back later on Oct. 11. It was still rising, well short of normal, when the company posted it on Monday.
Sasovo, Kaluga and Vladimir in four days
The strikes are well documented. Yandex has confirmed damage at all three sites, and Reuters, The Moscow Times and The Record have all reported on them. The company said the Kaluga facility was struck by Ukrainian drones. Zelensky has described the strikes as retaliation for Russia’s attacks on Ukrainian data centers, without giving details.
| Date | Site | What Yandex said | Cloudflare chart |
|---|---|---|---|
| Overnight Oct. 7–8 | Sasovo, Ryazan region | Fire; operations fully suspended | Requests drop about 35% |
| Oct. 9 | Kaluga region | Several modules disabled; no one hurt | No visible change |
| Oct. 11 | Vladimir region | Site shut down completely; platform in emergency mode | Falls to near zero, then partial recovery |
The Sasovo hub is the one with the AI hardware. Yandex said in 2021 that it hosted two of its three supercomputers, which train the company’s YandexGPT model, Reuters reported. Yandex has declined to say whether they were damaged. The Record reports that the Vladimir site houses a third machine, Galushkin. Sources disagree on how many data centers Yandex runs in all. Reuters counts five from publicly available information. The Record says six.
After the Vladimir strike, Yandex said the data center had “shut down completely, and the remaining infrastructure is unstable,” according to The Record. Outages spread to Yandex’s cloud customers, including the grocery chain Magnit and the appliance retailer M.Video, The Moscow Times reported, citing Kommersant. Yandex Go, the company’s taxi and delivery app, was disrupted in Kazakhstan, Armenia, Uzbekistan and other neighboring countries. Yandex updated its terms of service on Saturday so that it isn’t liable for obligations it misses because of drone strikes.
Russia’s digital development minister, Maksut Shadayev, told a State Duma committee on Monday that his ministry was working with the Defense Ministry on protecting data centers. The scale of the attacks “was unprecedented,” he said.
The strikes followed weeks of Russian attacks on Ukraine’s data centers. Since late September, Russian strikes have damaged at least six Ukrainian data centers by The Record’s count. The Moscow Times counts at least eight in Kyiv. A Sept. 23 strike cut fixed-line internet to about 100,000 households, according to Ukrainian officials cited by The Record. Russia’s Defense Ministry called its campaign a “forced digital detox,” Meduza reported, and Moscow claimed the sites processed military intelligence for Ukraine.
AfD, Reform UK and the midterms
The bot reading spread fastest outside Russia. In Germany, posts claimed that online activity around the far-right Alternative for Germany had fallen off sharply. Czech MEP Tomáš Zdechovský shared a chart on X and wrote that if it was confirmed, the drop around AfD was telling. Euronews reported similar claims about Reform UK in Britain, and American users said they saw fewer automated-looking pro-conservative replies on X. Euronews found no independently verified figures behind the AfD claims, and researchers told RFE/RL the wider bot claims rest largely on anecdotal evidence.
The U.S. congressional midterms are in early November. One X post cited by The Deep Dive paired the Cloudflare chart with an earlier estimate that bots wrote roughly 21% to 29% of U.S. Twitter content.
We found no public evidence this week placing a Russian influence operation on Yandex’s servers. One security-news site asserted that Yandex hosts such infrastructure but offered no evidence, The Deep Dive noted.
This story is developing. Yandex said on Friday that it couldn’t yet say when the damaged equipment would be restored, and services were still disrupted on Monday. Putin had not commented as of Monday. We’ve followed Ukraine’s strike campaign inside Russia in October Refinery Strikes: The Damage Tally So Far and Ukraine Strikes Russian Oil Sites After Trump’s Diesel Deal. Cloudflare’s live chart for Yandex’s network is on Cloudflare Radar.
Sources
- Cloudflare Radar on X (Oct. 12, 2026) and Cloudflare Radar, AS13238 traffic page. Used for: the 35% and 99% figures, the chart’s title and metric, and the partial recovery.
- Radio Free Europe/Radio Liberty, “Zelenskyy Says Yandex Strikes Crippled Pro-Kremlin Bots But Tech Experts Question Evidence” (Oct. 12, 2026). Used for: the date and setting of Zelensky’s remarks, the @antibot4navalny researcher, the 0.4% figure, the anecdotal-evidence caveat and Yandex Go outages abroad.
- Euronews, “Did Ukrainian strikes on Yandex data centres cause Russian bot activity to plummet?” (Oct. 12, 2026). Used for: Zelensky’s quote, the 94% figure and its caveat, Zdechovský, and the AfD, Reform UK and U.S. claims.
- The Deep Dive, “Bot Traffic from Yandex’s Network Falls to Near Zero After Third Drone Strike” (Oct. 12, 2026). Used for: the 99.6% bot share, the 0.3% and 88.2% figures, the unchanged line on Oct. 9, the X post on bot-written content and the security-news claim.
- Tom’s Hardware, “Russia’s Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes” (Oct. 11, 2026). Used for: how the 0.4% figure was first framed.
- The Record, “Ukraine strikes third Yandex data center, disrupting digital services across Russia” (Oct. 12, 2026). Used for: Yandex’s Vladimir statement, the Galushkin supercomputer, the six-data-center count, the terms-of-service change and the Russian strikes on Ukrainian data centers.
- Reuters via ThePrint, “Ukraine expands drone strikes on data centres owned by Russia’s Yandex” (Oct. 9, 2026). Used for: the Kaluga strike, the Sasovo supercomputers, the five-data-center count and Zelensky’s retaliation remarks.
- The Moscow Times, “Ukraine’s Strikes on Yandex Data Centers, Explained” (Oct. 12, 2026) and “Ukrainian Drones Hit Yandex Data Center, Industrial Facilities Across Russia” (Oct. 8, 2026). Used for: the Sasovo fire, affected cloud customers, the eight-data-center count, Moscow’s intelligence claim, Shadayev’s remarks and Putin’s silence.
- Meduza, “Russia called its strikes on Ukrainian data centers a ‘forced digital detox'” (Oct. 8, 2026). Used for: the Russian Defense Ministry’s phrase.