The strikes knocked Yandex infrastructure offline, but a drop in its web requests does not by itself show that political bots disappeared. A web crawler is an automated program that visits web pages and resources so a search engine can index them. The distinction matters because website requests and social media posts measure different kinds of activity.
On October 12, Ukrainian President Volodymyr Zelenskyy claimed that people saw fewer bots and less hostility on social media. That was a claim, not proof that influence accounts had gone quiet. The Yandex bot traffic drone strikes unproven 2026 story calls for care: a network outage does not count political accounts, and a change in web traffic cannot confirm who posted online.
Key Takeaways
- The strikes disrupted three Yandex facilities.
- Yandex Search web requests fell sharply during the outages.
- Most requests on its search network were automated crawler traffic.
- Some cloud-hosted automated requests appeared through other providers.
- Social media activity changed in different ways across monitored groups.
- Account-level evidence is needed to link a political account to disrupted infrastructure.
The key test is whether account-level evidence matches the network disruption.
What happened at Yandex’s three data centers?
Three Yandex facilities were hit in a five-day span, with the Vladimir site going offline after the final reported strike. The Ukrainian drone strikes damaged infrastructure in Sasovo, Kaluga, and Vladimir, and services that relied on those sites faced disruption. Yandex said none of its employees were hurt.
The outages affected more than search. Yandex Cloud entered emergency mode, while Yandex Go faltered in three neighboring countries.
The Sasovo, Kaluga, and Vladimir outages
The three data centers were hit between October 7 and 11, 2026. Their reported conditions differed:
- Sasovo: Serious damage overnight October 7-8 stopped the facility from operating.
- Kaluga: An October 9 attack left part of the facility out of action.
- Vladimir: An October 11 attack was followed by the site going offline.
The strikes affected data centres in several regions, not just one shared site. Reporting on the three data center attacks describes the reported damage and service effects. Yandex data centers support a mix of online services, so an outage can affect users far from the damaged building.
Some readers may see both “data centers” and “data centres” in coverage of the same event. The first spelling is common in the United States; the second appears in British English. In either form, the term refers to facilities that house computing equipment and network links.
Cloud customers were advised to use their available disaster-recovery plans during the emergency.
Services affected by the disruption
Yandex Cloud entered emergency mode on October 11. The company advised customers to use available disaster-recovery plans, which can help keep services running when a main system fails. The advice did not mean every customer had a working backup ready.
Yandex Go also faltered in Armenia, Kazakhstan, and Uzbekistan. The ride service depends on digital systems, so problems with the company’s infrastructure can reach users outside Russia. The reported disruption shows how one company’s services can connect across borders.
A separate account of the outages explains how availability zones and backup plans can shape recovery. That Yandex outage report also describes the strain on services that relied on Yandex systems.
Reported damage at each facility gives a clear picture of the physical disruption, but it does not reveal every task performed there. Treat an outage at a named site as evidence of infrastructure damage, not proof of what every system there was doing.
Yandex Bot Traffic Drone Strikes Unproven 2026: What the Data Shows
A 99% drop in AS13238 requests on October 11 measured the network’s collapse, not a count of political accounts going silent. AS13238 carries Yandex Search crawling, while AS200350 carries Yandex.Cloud services. Cloudflare’s bot traffic measures automated requests to websites, not activity on social platforms.
That difference helps explain why the sharp search drop does not show that Russian influence accounts stopped posting. The networks carry different services, and automated website requests can come from search tools, scanners, or other software.
Two networks with different roles
On October 11, AS13238 traffic fell 99% below baseline, while AS200350 traffic fell 90%. AS13238 remained 86-90% below normal through October 13. At 18:00 UTC on October 14, it had reached 85% of normal.
AS13238 made up about 7% of Russia-origin bot requests and 0.05% of global bot requests. Before the strikes, automated requests accounted for 36.1% of HTTP traffic Cloudflare observed worldwide, and 35.8% of traffic from Russian IP addresses.
Cloudflare classified 99.5% of AS13238 requests as automated. Of those bot requests, 93.6% were verified. Its sampled requests included 78.1% verified YandexBot, 11.5% YandexRenderResourcesBot, and 1.9% YandexImages.
Why the search drop was mostly crawling
YandexBot indexing traffic fell 99% on October 11 and later recovered to about 85% of normal. Traffic from AS13238 to publishing and newspaper sites fell 44%. Before the event, about 90% of that news-site traffic was YandexBot indexing articles.
Those figures point to lost search crawling as the main cause of the steep AS13238 drop. They do not show which social media accounts were active or whether those accounts coordinated.
A Cloudflare analysis of the 2023 Yandex outage also separated search crawling from other automated requests. That earlier event is not evidence about the October 2026 measurements.
How Yandex crawler verification works
A User-Agent string identifies the software a request claims to use, but another program can copy that text. Yandex checks a crawler’s IP address with reverse-then-forward DNS lookups. The check asks whether the address maps to a Yandex host and then back to the same IP.
Yandex’s crawler verification method helps websites tell a genuine crawler from a request that only claims to be one. In robots.txt, “YandexBot” targets the main indexing crawler, while “Yandex” applies more broadly to Yandex bots.
Cloudflare customers also chose to block many requests: 40.5% returned HTTP 403 responses to AS13238 crawler requests. A crawler’s verified identity establishes who sent a request, not the political purpose of a different account on a social platform.
Did malicious automation stop when Yandex.Cloud went offline?
The cloud disruption reduced some attack-like traffic from AS200350, but requests to one gambling customer soon appeared through other Russian hosts. About 95.0% of scored requests from the network were bots, and Cloudflare verified none of its observed bot requests. A drop in one provider’s traffic did not mean every targeted request stopped.
AS200350 accounted for about 2% of Russia-origin bot requests and 0.01% of global bot requests. From October 7-13, several types of bot activity fell:
| Metric | Change during October 7-13 | What it measured |
|---|---|---|
| Yandex.Cloud bot traffic | About 40% lower | Bot requests from AS200350 |
| WordPress plugin probing | 90% lower | Requests probing WordPress plugins |
| Scanner-identified requests | 93% lower | Requests identified as scanning |
| Cloudflare customer blocks on Yandex.Cloud traffic | 70% lower | Requests blocked by Cloudflare customers |
One gambling customer saw its requests fall to zero after the October 8 disruption. Identical requests later came from Russian hosting providers Radist and Selectel. They shared a JA4 TLS client fingerprint, uncommon paths, HTTP headers, and custom User-Agent strings.
A JA4 fingerprint is a pattern made from details of a network connection. Matching fingerprints and request features support the view that the workload shifted providers. They do not name the people or group behind it.
Russian bot traffic aimed at that gambling-sector client rose from 167.7 million to 170.1 million requests over the following week. The Cloudflare analysis of the earlier Yandex outage describes a similar distinction between provider traffic and requests that move elsewhere.
The earlier analysis covered a 2023 incident, so it does not establish the cause of the 2026 pattern. A shared request fingerprint is stronger evidence of workload migration than a provider-wide traffic chart, but it does not identify the person behind the requests.
Did social-media activity fall after the strikes?
The available account and posting snapshots moved in different directions, rather than showing one consistent, across-platform shutdown. Graphika measured 40,365 posts from 1,022 AfD-related accounts on October 11, compared with 42,040 posts from 1,037 accounts a week earlier. Graphika described the 4% dip as within the community’s normal range.
Social media monitoring also showed changes in other groups. Those shifts do not all point to the same cause, and posting volume alone cannot establish coordinated influence.
- AfD-related accounts: Graphika counted 40,365 posts from 1,022 accounts on October 11, down from 42,040 posts and 1,037 accounts a week earlier.
- MAGA mentions on X: Mentions rose 25% in the hours after the October strike on the Vladimir data center.
- Russian-language Telegram channels: Posting fell 5% to 15% in the two days after the Vladimir strike.
- Ukraine-focused networks: Ukraine’s Center for Countering Disinformation studied 22,664 messages from 5,201 accounts showing signs of inauthentic behavior between October 6 and 12.
The Ukraine-focused monitoring found a sharp early drop: messages fell from 4,032 to 660 on October 8, while active accounts fell from 1,526 to 258. Activity recovered within two days and exceeded pre-strike levels on October 10 and 11.
After the Vladimir data center shut down, messages in those monitored networks fell 42.6% on October 12. A short-term decline is meaningful, but the earlier recovery shows why one day cannot describe a whole operation.
Posting volume can rise in one group while falling in another, so a single total can mislead.
Cloudflare’s web-request dashboard does not measure social-media activity. The European Digital Media Observatory said there was no conclusive evidence as of October 2026 that the attacks significantly reduced activity among accounts linked to Russian propaganda and disinformation. Its October 2026 assessment reflects the limits of treating changes in posts as proof of a political effect.
A change in posting volume becomes evidence about an influence operation only when the accounts and their coordination are identified.
Conclusion
The strongest conclusion is that the strikes disrupted Yandex infrastructure, while a broad shutdown of Russian influence accounts remains unproven. Web traffic showed severe interruptions, and some automated requests later appeared through other hosting providers.
Social media snapshots showed mixed changes, not a shared pattern of silence. Before treating a traffic chart as proof of political impact, look for account-level evidence that connects specific influence accounts to the disrupted infrastructure.
Before sharing a claim about fewer bots, check whether it measures web requests, social posts, or identified coordinated accounts.
FAQ
What does Cloudflare mean by bot traffic?
Cloudflare means automated HTTP requests to websites on its network, not social-media activity. A request might come from a search crawler, a scanner, or another automated tool. The label describes how the request was made, not why it was sent. A bot count in a website dashboard cannot show how many political accounts posted on a social platform.
Was YandexBot the same thing as a Russian social-media bot?
No. YandexBot is Yandex Search’s indexing crawler, a program that visits web pages and resources so a search engine can index them. It sends requests to websites, rather than posting as a person on social media. A verified YandexBot request identifies a crawler, not a political account or an influence campaign.
How can a website verify that a request really came from YandexBot?
A website can use reverse-then-forward DNS lookups to check a claimed YandexBot request. A User-Agent string alone is not enough because another program can copy it. The DNS check tests whether the request’s IP address maps to a Yandex host and then resolves back to the same IP address.
Did Yandex.Cloud carry only malicious bots?
No. About 95.0% of its scored requests were bots, but Cloudflare verified none of its observed bot requests. That does not mean every automated request was malicious. Cloud services can carry many kinds of automated work, and a network-level bot label does not reveal each request’s purpose.
Did Yandex.Cloud’s traffic drop mean the targeted automation stopped?
No. Requests to one gambling customer dropped to zero after the disruption, then appeared through Russian hosting providers Radist and Selectel. The requests shared a JA4 fingerprint, uncommon paths, HTTP headers, and custom User-Agent strings. Those matches support provider migration, but they do not identify who sent the requests.
Did AfD-related posting collapse after the strikes?
No. Graphika measured a 4% dip in posts from AfD-related accounts on October 11 and described it as within the community’s normal range. The count was 40,365 posts from 1,022 accounts, compared with 42,040 posts from 1,037 accounts a week earlier. That snapshot does not show a collapse.
