After Ukrainian drone strikes knocked out yet another Yandex data center in Russia, online sleuths have noticed that bot traffic originating from Yandex’s network dropped sharply. They’re also seeing some bizarre coincidences regarding Russian disinformation campaigns.

All traffic from Yandex is down. Unsurprisingly, this also means bot traffic – Cloudflare reports that it dropped to just 0.4% of the maximum number of HTTP requests recorded in the past 2 weeks.

Some personalities online claim this means that Russian disinformation campaigns, so prevalent on social media, will now be paralyzed – and that this might be important before the mid-term elections in the US.

A few individuals say they themselves see a lot fewer posts from suspicious accounts on X, Facebook, and other social networks.

“If confirmed, this is telling: Russian data centers get hit, and online activity around AfD (a German political party, Alternative for Germany), suddenly plummets,” said Tomáš Zdechovský, member of the European Parliament.

Historian Timothy Snyder also observed: “Well, it’s a quick take, and no doubt data will come in, but it sure looks like, based on today’s evidence, that a lot of pro-Trump and pro-AfD bot work depends directly on Russian data centers.”

Ukrainian drones shredding Russian bot networks and helping Western democracies along the way would be a wild story indeed. But it’s just not true – people are naively (or deliberately) confusing bots with “bots,” a word used to describe state-sponsored social media accounts.

As a result of drone attacks, Yandex has already suffered damage at 3 data centers. Facilities in Sasovo and Vladimir were shut down completely, and some equipment in Kaluga is now unusable as well.

These hits are Ukraine’s response to Moscow’s recent strikes on its own data centers.

“You all know, they have been hitting and continue to hit our data centers. We are responding. I can’t share all the details,” Ukrainian President Volodymyr Zelensky said after the Sasovo strike on October 8th.

Legitimate crawling affected

A threat by “antibot4navalny,” which has been tracking state-sponsored social media campaigns and troll farms, has helpfully explained that the Cloudflare “Bot Traffic” chart many are citing is really about automated web crawlers operated by Yandex accessing the web.

To those implying that Kremlin-controlled social media bot/troll farms became silent after Ukraine hit a Yandex data center, posting this CloudFare chart ( radar.cloudflare.com/bots/as13238 ): Hate to disappoint you all ⤵️

[image or embed]

undefined antibot4navalny | bot blocker | блокировщик ботов (@antibot4navalny.bsky.social) October 11, 2026 at 11:55 PM

What Cloudflare Radar showed falling sharply was HTTP requests from AS13238, a network operated by Yandex, that were estimated to be automated traffic.

An AS (autonomous system) is a unit of network operated under a common administrative policy.

This data, therefore, shows neither the volume of internet traffic across Russia nor the number of messages posted on any particular social network.

According to Cloudflare's bot classification, traffic with a bot score of 1 to 29 is considered likely automated, while a score of 30 or higher is considered likely human.

However, this mechanism assesses only the likelihood that traffic was automatically generated. It does not examine whether the content is political propaganda or who funds and operates it.

“The Cloudflare chart has nothing to do with social media. Cloudflare measures automated requests to websites (of any kind, among which social media share is negligible),” wrote “antibot4navalny.”

Actually, if one looked at Cloudflare’s Russia-totals chart, one would see that the volume of bot traffic last week was largely the same as in any other week.

Finally, although Yandex bot traffic fell to an extremely low level last week, it began recovering on Sunday and is definitely not stuck near zero.

In other words, this looks like a temporary plunge rather than a complete outage – and what’s stopped is standard search engine web crawling.

How covert bot farms actually operate

There’s no basis for treating all automated traffic – some or most of it serves legitimate purposes – as disinformation activity. Plus, we don’t know the content of the traffic.

Of course, influence operations on social media exist. But as a rule, Russian state-sponsored troll farms and disinformation networks don’t even run the bots directly through Yandex.

Since 2022, when Russia attacked Ukraine, platforms like Reddit and Facebook have usually blocked traffic originating directly from known Russian corporate data centers.

This is the reason why covert influence operations typically rely on residential proxy networks, compromised IoT devices, commercial VPNs, and – crucially – Western cloud hosting providers to disguise their IP addresses and mimic real localized users.

Some disinformation experts are already calling the idea that Ukrainian drones have hurt the Russian troll farms a “hoax.” Their advice? To stop fighting disinformation with disinformation.

“It sucks to see so many pro-Ukraine accounts spreading disinformation and pretending it’s ok just because it’s an anti-Russia/pro-Ukraine narrative,” wrote Caroline Orr Bueno, a behavioral scientist specializing in disinformation.

“If you want to defend democracy, you have to be willing to reject disinformation even when it’s telling a story that you want to hear.”