On October 11 and 12, a claim spread fast: Ukraine's drone strikes on three Yandex data centers had silenced Russia's social-media bots. The strikes are real, and so is the damage to Yandex's services. But the chart behind the claim counts automated web requests from Yandex's own network, mostly its search crawler, not accounts posting on social media. This page tracks what the data can and cannot show, and what would change our assessment.
Ukraine's strikes knocked out three Yandex data centers and disrupted real services, from cloud computing to payments. The viral "bot traffic" chart counts automated web requests from Yandex's own network, which closely tracks Yandex's own search crawler. No platform report, researcher dataset or posting count yet shows a drop in Russian coordinated activity on social media.
What would change this rating ↓
russianbots.america2.newsAnalysis of Russian influence, information warfare and the networks behind them. Free; unsubscribe anytime.
The most-shared claims, and what public sources can confirm. Tap the link icon to share a single claim.
Origin. Yandex's own statements after drone strikes on its Sasovo (October 7–8), Kaluga (October 9) and Vladimir (October 11) data centers (Reuters).
What the evidence shows. Yandex said Sasovo and Vladimir were shut down completely and Kaluga partly. More than 80 Yandex Cloud services were affected (Kyiv Post), along with ride-hailing, payments, food delivery and chatbots, including Yandex Go outages in five other countries (RFE/RL). Network probes show about 78% of Yandex Cloud's reachable address blocks went dark (IODA, see the chart above), and on October 12 NetBlocks saw "no signs of recovery" (NetBlocks).
Bottom line. The damage is real and continuing.
Origin. Tom Robinson, co-founder of the blockchain analytics firm Elliptic, on October 12 (X).
What the evidence shows. A7A5 is a ruble-backed stablecoin used to move money around sanctions. Its main exchange moved to Yandex hosting in September 2025, after the token was sanctioned in August. Elliptic's on-chain data shows hourly transactions falling to near zero within hours of the Sasovo strike; most of what remains is swaps on decentralized exchanges.
Bottom line. This is what a real dependency on Yandex looks like in the data.
Origin. A NetBlocks chart posted on October 11 (NetBlocks), repeated by Tom's Hardware and then by many posts as bot figures.
What the evidence shows. The chart is titled "Network Connectivity by Provider." It shows Yandex's cloud network at 30% of normal and its main network at 63%. It measures whether Yandex's networks can be reached. It says nothing about bots.
Bottom line. Accurate numbers, wrong label.
Origin. Tom's Hardware, October 11, citing Cloudflare Radar's "bot traffic" chart for Yandex's network. The article's web address calls it "disinformation bot traffic." Screenshots of the chart spread with captions about troll farms.
What the evidence shows. Cloudflare counts web requests it scores as "likely automated" that come from Yandex's own network (Cloudflare docs). Normally 99.5% of that network's requests are automated, and hour by hour the series moves almost exactly with Yandex's search crawler (correlation 0.996; see the table above). Cloudflare's own posts call the drop "traffic" and do not mention bots or social media (Cloudflare Radar).
Bottom line. The 0.4% is real. It shows Yandex's search crawler going offline, not social-media bots.
Origin. Viral posts from October 11, then President Zelensky at the Warsaw Security Forum on October 12: "there were fewer bots… it's pretty clear where those bots were coming from" (Euronews); and posts pointing to the replies under a single post, such as one from the White House, as proof that "the bots are completely gone."
What the evidence shows. No data was cited. The posting counts we have from known networks show no drop: about 500 pro-Russian accounts on Polish X (Res Futura), the Matryoshka operation's daily videos through October 9, and 10 pro-Kremlin Telegram channels. October 10–11 was a weekend, when most platforms are quieter. A Danish consultancy that tracks 17,000 political accounts found comments on AfD and MAGA Facebook posts at normal levels after the strikes (Valdemar Osted). The tone of the replies under one post depends on who sees it and chooses to respond; without comparing many posts over time, it cannot show a change in bot activity.
Bottom line. Impressions, not measurements.
Origin. A chart posted by Czech MEP Tomáš Zdechovský on October 11 ("If confirmed…"), recaptioned by Polish analyst Jarosław Wolski as a 56% fall in AfD support. The two posts drew about 100,000 likes.
What the evidence shows. The chart names no source, platform or metric, does not mention AfD, and plots values for dates after it was posted. Capital traced it to a Threads post that Meta labels as AI-generated content (Capital). Asked where the chart came from, Zdechovský's office did not say, according to OCCRP editor Ilya Lozovsky (X). Zdechovský later told Novinky.cz he should have checked its origin and data more thoroughly (Novinky.cz). The German fact-checker Rohtext found X posts about every major party fell over the weekend, the SPD and Greens more than the AfD (Rohtext).
Bottom line. The chart cannot support the claim, and its author has stepped back from it.
Origin. An anonymous analysis of Reddit activity around the three strikes, posted to r/theydidthemath on October 12 with its data and code. Cropped images of its tables spread on X the same day, and Polymarket posted that "several major U.S. political subreddits" had plunged, naming none.
What the study did. It took hourly post and comment counts for 1,221 subreddits (968 busy enough to analyze) from the social-listening service Syften, and compared the 12 hours after each strike with the 12 hours before, adjusting each hour against the same hour and weekday in the three previous weeks. It then re-ran the test with other start times, 10-hour windows and a Reddit-wide benchmark.
What it found. 90 subreddits fell after all three strikes. None stayed down across the timing checks. The author's conclusion: "No ranked community is a timing-stable result," and the results are "not evidence of bots, server use or causation." The author also notes this "does not prove there was no effect." In the study's data, 77 subreddits rose after all three strikes, about what chance would produce alongside the 90 that fell. The 80% figure that spread is one 12-hour window in r/irishpolitics; starting it six hours later turns it into a 49% rise.
Bottom line. A careful study, done in the open, that found no reliable drop. Its own author says so.
Origin. An X post on October 12 by @tleilax___, a pseudonymous account that describes itself as a commodity portfolio manager, apparently using the same public Reddit data as the anonymous study, compared 147 political and regional subreddits with 825 others during the Vladimir outage (01:00–12:00 UTC, October 11), and listed the political ones that fell most, led by r/democraticparty (−71%).
What the evidence shows. We re-ran the comparison on the same data (the study's public archive, 24.6 MB). Over that window the median political community fell 7.8% and the median other community fell 6.4%, almost the same; 66 of the 147 political communities rose. A week earlier, on Sunday, October 4, with no strike, the same number of political communities (10) fell by more than half, including r/democraticparty (about −75%) and r/illinois (about −60%). Small communities swing like this all the time; a list of only the biggest decliners hides that.
Bottom line. The political communities moved like the rest, and the "collapses" happen on ordinary days too.
Origin. An X post on October 11, seen more than 600,000 times, sharing charts from X's own trends tool. They showed posts mentioning "Zelensky" rising while "genocide" and "Free Palestine" fell.
What the evidence shows. The charts were captured about 18:00 UTC on October 11, so the last point covers only three-quarters of a day; the drops of about a quarter match that. Both terms peaked on October 7, the anniversary of Hamas's 2023 attack; a fall after an anniversary spike is expected, strike or no strike. "Zelensky" rose with that week's news about Ukraine, including the strikes themselves. The tool counts posts on a topic; it cannot tell who posted them or whether they were automated.
Bottom line. A partial day and an anniversary, not a bot effect.
Origin. A post sharing a Google Trends screenshot that showed Canadian interest in the Conservative Party "down 60%" (October 12, about 250,000 views), and posts on Facebook, Threads and Reddit saying Alberta separatist posts and websites had gone quiet, a week before Alberta's October 19 independence referendum (Elections Alberta).
What the evidence shows. Google Trends measures Google searches by people in Canada, not social-media posts, and the screenshot covered Canadian Thanksgiving weekend. The Alberta Prosperity Project, a leading group campaigning for independence, had its website online on October 12. A site Canadian researchers have tied to the Russian operation Storm-1516, albertaseparatist.com, went dark long before the strikes: its domain was re-registered in July 2026 and is parked for sale (DisinfoWatch; domain records).
Bottom line. Neither shows a bot effect. Foreign interference in the referendum is a documented concern, but this is not evidence about it.
Origin. X posts on October 12 claiming that Elon Musk "loses 100M followers" (seen more than 580,000 times) and that the MAGA influencer Gunther Eagleman "lost a half a million followers."
What the evidence shows. CalMatters put Musk at 241 million followers on October 8, before the first strike (CalMatters); his account showed about 241.5 million on the evening of October 12. Gunther Eagleman had 1.7 million followers in September (The Daily Beast); his account showed about 1.77 million on October 12. Neither number fell.
Bottom line. The follower counts did not drop.
Origin. Tomasz Siemoniak, Poland's minister coordinating the intelligence services, said on October 12 that the Internal Security Agency (ABW) had seen "a significant, radical drop" in Russian bot activity and that, after the strikes, Russian bot traffic had "practically stopped" worldwide (Rzeczpospolita).
What the evidence shows. No data has been released. NASK, Poland's state research institute for cybersecurity, analyzed the Russian disinformation accounts it monitors on X from September 30 to October 11 and found no significant decline in their activity after the strikes; only a few individual accounts stopped, with no basis to tie that to the strikes (Interia).
Bottom line. Poland's own research institute found no drop.
Origin. The Czech news site iDNES on October 12, amplified by Zdechovský ("Coincidence?"), naming a site it called "AC.CZ."
What the evidence shows. AC24.cz, a well-known Czech disinformation site with a similar name, published three articles that Monday, according to its own feed, and is hosted in France, not on Yandex. We could not find a working site at ac.cz.
Bottom line. The example does not hold up.
Origin. Viral posts noting that the Sasovo site housed two of Yandex's three AI supercomputers, which train its YandexGPT models; and a widely shared thread (about 250,000 views) that correctly identified the crawler traffic but asserted, without sources, that bot farms had lost YandexGPT and Yandex's translation tools, and that "crawlers that spread, clone, and rank" propaganda sites were frozen.
What the evidence shows. No report ties Yandex's supercomputers or YandexGPT to any influence operation. Supercomputers like these train models rather than run accounts, and operations that use AI tools can choose among many providers or run models on their own machines. The influence-operation websites we checked are hosted elsewhere. Yandex's crawler indexes websites for Yandex's own search engine; it does not spread or copy them, and its outage does not change what audiences outside Russia see.
Bottom line. An inference from location, with no evidence behind it.
Origin. Anonymous X accounts comparing single posts, such as two posts by President Trump on different days; and a London Economic "exclusive" on October 12 setting posts by Reform UK figures Nigel Farage, Richard Tice and Zia Yusuf that were a few hours old against their posts from the week before; and, from the other side, posts inviting followers to "interact" with a post to show that their views are real rather than bot-driven; and posts holding up a single celebrity post, such as one by Elon Musk with fewer than 5,000 likes, as proof.
What the evidence shows. Posts keep gathering views and reposts for a day or more, so a post a few hours old will always look weaker than last week's. Engagement also varies widely from post to post with topic, timing and day of the week, so comparing a handful of posts proves little. The one chart of slogan reach that showed a drop (October 8–10) gave no method, and reach rebounded on October 11, the day of the largest outage. Our own test of eight pro-Kremlin accounts found likes and reposts per post at their usual levels on October 8–10; October 11 is too recent to judge, and we will update. A post that draws heavy engagement from its own followers shows only that those followers respond when asked; it says nothing about whether bots were ever present or have gone. One account's numbers swing widely with topic and with how the platform shows its posts. In a sample of Musk's original posts on October 11, most still drew more than 5,000 likes; the median was lower than a week earlier, but those posts were still gathering engagement when we counted them.
Bottom line. Not evidence of a cause.
New reporting from major outlets and official sources, listed as it appears. Our monitoring adds headlines from major outlets automatically. "Checked" means our software fetched the full report and confirmed it supports its headline. "Reviewed" means an editor checked it against its source. "Auto" items have not been checked yet. Tap a label for our note. None of this is an endorsement. Our assessment is the rating above.
Anecdotes ("everyone noticed") and the Cloudflare chart cannot move this rating. Any one of these could:
Every chart in circulation that names its data source measures Yandex's own infrastructure. Each shows servers going dark, which is what you would expect from destroyed data centers.
| Measure | What it counts | What it shows |
|---|---|---|
| Cloudflare Radar "bot traffic," Yandex network (AS13238): the viral chart | Automated HTTP requests from Yandex's own network to Cloudflare-served websites | Fell 99% from the prior week around 00:30 UTC Oct. 11, when Vladimir shut down (Cloudflare Radar) |
| Cloudflare's verified YandexBot crawler | Requests from Yandex's search-engine crawler | Moves almost exactly with the viral chart: hour by hour over two weeks the two correlate at 0.996 (Google's crawler: 0.17). Normally 99.5% of requests from Yandex's network are automated (Cloudflare Radar data, analyzed by America 2.0; first shown side by side by Antibot4Navalny) |
| Cloudflare bot traffic from all of Russia | Share of Russian web requests that are automated | Slipped from about 49% in the days before the strikes to about 44% after, consistent with losing Yandex's crawler; it had already been drifting down from about 55% in late September (Cloudflare Radar data, analyzed by America 2.0) |
| NetBlocks connectivity | Reachability of Yandex networks | Yandex Cloud at 30% of normal, Yandex LLC at 63%, on Oct. 11 (NetBlocks). These are the "30%" and "63%" figures quoted as bot numbers. |
| A7A5 stablecoin transactions | On-chain transfers of the sanctioned ruble stablecoin, whose exchange is hosted by Yandex | Collapsed within hours of the Sasovo strike (Elliptic's Tom Robinson). A known dependency on Yandex shows up clearly in the data. |
| Pravda network articles | Articles published, from the network's own sitemaps | About half of normal for roughly 13 hours after Vladimir; normal after Sasovo and Kaluga |
| 10 pro-Kremlin Telegram channels | Public posts | No drop; 20% above normal in the 12 hours after Vladimir |
| Engagement on eight pro-Kremlin X accounts (four Russian state accounts, including RT and Sputnik, and four large commentary accounts) | Median likes and reposts per post, up to 20 posts a day each | Normal after Sasovo and Kaluga (October 8–10: 99–114% of each account's usual level). Too soon to judge October 11; we will re-measure once those posts have aged. (Analysis by America 2.0) |
| Nearly 10,000 accounts on TikTok, Telegram and X in German-speaking countries (disinformation actors, AfD-aligned and pro-Russian) | Posting activity and new-account creation | No statistically noticeable drop (Polisphere, with the Hasso Plattner Institute, via Capital) |
| Comments on 76 AfD politicians' and 136 MAGA accounts' Facebook posts | Each post against that account's normal (same post age, weekday, time of day) | No collapse: AfD −8% to +5%, MAGA +4% to +10%; MAGA posts drew 480,000–560,000 comments a day after the strikes, against about 370,000 in late September (Common Consultancy, via Valdemar Osted) |
| Russian disinformation accounts monitored by NASK on X (Polish) | Overall activity, September 30–October 11 | No significant decline after the strikes (NASK, via Interia) |
| Posting by ~500 pro-Russian accounts on Polish X | Posts by a monitored network, and replies under them | No drop. The busiest stretch was Sunday afternoon, after the Vladimir shutdown; the analysts call it "a classic weekend" (Res Futura Data House) |
There are real ways a Yandex outage could slow a Russian operation: Yandex mail, cloud hosting, its AI and speech tools, or its payment apps. Some Russian state media do depend on Yandex. RT, the video agency Viory and the pro-Kremlin site Anti-Spiegel route their email through it. And when a known dependency breaks, it shows: the sanctioned A7A5 stablecoin's transactions collapsed with the first strike (Elliptic).
But the evidence stops there. The web fronts of known operations that we checked (the "Pravda" network and a Doppelgänger fake-news site) are hosted elsewhere. No report ties YandexGPT, Yandex Cloud or Yandex Pay to a troll operation. The posting data is mixed in one telling way. Matryoshka posted 8 to 10 videos a day on X from October 5 to 9, through the Sasovo and Kaluga strikes, according to daily logs kept by volunteer researchers, and 10 pro-Kremlin Telegram channels did not slow. But the automated "Pravda" news network lost about half its output for 13 hours after the Vladimir shutdown, while its Telegram sources were busier than usual, then recovered. That is consistent with an automated pipeline that leaned on something in a Yandex data center and quickly routed around it. It is a website network, not social-media accounts, and we cannot see which part of it failed. Matryoshka's logs do not yet cover October 11.
The closest precedent points the other way from this week's evidence, and shows what a real test looks like. During a two-hour, nationwide Russian internet outage in January 2024, researchers at the Brussels think tank Bruegel found that posts from 221 X accounts popular with pro-Kremlin networks drew about 49 fewer reposts per account in the peak hour than a control group and the day before. The authors called the results preliminary (Bruegel). That outage hit the whole Russian internet; this week's strikes hit three data centers belonging to one company.
The most specific example so far comes from David Colon, who teaches about propaganda at Sciences Po: a fabricated story from the Russian operation Storm-1516 about the French candidate Raphaël Glucksmann, launched October 9, drew only tens of thousands of views in its first three days, while one the network launched on September 24 drew millions in the same span (X). It compares two stories, which can differ in topic, target and who picks them up, and the October 9 story came before the largest outage. It is worth testing across many stories.
What would make the case: posting or engagement counts for known network accounts that dip after all three strikes, more after the biggest outage, and not just on weekends. We will add such data here if it appears.
It is easy to see why the claim spread. The strikes are a real blow to Russia's largest technology company, and many people want them to have hurt the Kremlin's online operations too.
But believing it before the evidence is in has costs. If people think the troll farms have gone quiet, Russia's operations can carry on with less scrutiny. Policymakers, platforms and the public come away with the wrong picture of how these operations work: as servers that can be bombed, rather than paid people and contractors spread across many countries and tools. And a misread chart, repeated by officials and newsrooms, becomes faulty intelligence. It distorts judgments about what the strikes achieved and what still needs doing.
Ukraine and its supporters need accurate situational awareness more than good news. The strikes' documented effects, on Yandex's services, on payments and on a sanctioned stablecoin, are real and significant. Claiming effects the evidence does not show only makes the real ones harder to see.
Research on Russian influence operations describes a decentralized business: scholars write of "entrepreneurs of influence" competing for Kremlin favor (Laruelle and Limonier, Post-Soviet Affairs, 2021) and of a disinformation labor market (Poliakoff and Kling, New Media & Society, 2026). Much of the work is done by people paid to meet quotas: the Senate Intelligence Committee documented Internet Research Agency staff with daily targets for posts and comments (Senate report, Vol. 2), in an operation researchers called "industrial" (Linvill and Warren, Political Communication, 2020). Some of it runs outside Russia: in 2020 an operation linked to former IRA associates paid people in Ghana to post for American audiences (Graphika). The trade also runs on plain profit: Leslie Iwerks' documentary Selling Lies follows young people in North Macedonia who earned large sums in 2016 running fake political news sites aimed at American readers (Selling Lies). Human-run accounts are hard to tell from real users; even research tools built to detect bots misclassify in both directions (Rauchfleisch and Kaiser, PLOS ONE, 2020). Operations that used a Yandex service, such as payments, translation or the YandexGPT model, would lose it for a time. Swapping in another provider, or a model run on their own machines, is usually quick.
That is why the data that matters is posting data from known networks. Traffic from a search company's servers cannot tell us whether those networks went quiet.
If you have a validated study, a news report or credible analysis that measures Russian online activity before and after the Yandex strikes, email us at editor@america2.news with the subject “Russian Bot Tracker.” Posting or engagement counts for known network accounts are the most useful. Please include a link and say how the data was gathered. We check each submission against its source. If it holds up, it goes on this page, whichever way it points.