Everyone Says Russia’s Bots Went Quiet After the Yandex Strikes. Here Is What the Traffic Shows.

01 The claim, and the chart behind it

On 12 October President Zelensky told the Warsaw Security Forum that “it suddenly became a little easier to breathe on many social media platforms”, with “less hate, less division and fewer provocations because there were fewer bots” [ Euronews 2026 ] . A Czech MEP shared a graphic linking the strikes to a fall in online activity around Germany’s AfD. The historian Timothy Snyder speculated that pro-Trump and pro-AfD bot work depends on Russian data centres [ Cybernews 2026 ] . Users on X ran their own “bot tests” and reported fewer automated replies.

Almost every version of the story pointed to the same evidence: Cloudflare Radar’s chart for AS13238, the network Yandex operates. Here is that network’s daily traffic, as a share of the highest day between 28 September and 12 October.

The collapse is genuine, and it lines up with the strikes. The first step down came between 07:00 and 08:00 UTC on 8 October, and the low point on 11 October matches the Vladimir shutdown. One earlier dip does not fit: on 1 October the same network fell to 49% for a day, a week before any strike. Nobody has explained it, which is a fair warning about reading too much into one line on a chart.

The problem is what the line measures. Cloudflare classes more than 99% of traffic from AS13238 as automated, on every day of the period. Yandex’s network sends out its search crawler, its cloud customers’ servers and its own service calls. People using Yandex reach the internet through their mobile operators and home broadband, on other networks. Antibot4Navalny, a group that tracks Russian troll farms, put it bluntly: “The Cloudflare chart has nothing to do with social media.”

02 What bot traffic from Russia actually did

If Russian bot farms had gone dark, the drop would show up in Cloudflare’s figures for Russia as a whole. It barely does.

Bot volume from Russia was drifting down slowly through the whole fortnight, and the strikes did not change its course. The bot share of Russia’s traffic fell from 56% to the low 40s, but most of that decline happened in the week before the first drone arrived. Globally, the bot share of all HTTP traffic on Cloudflare stayed between 39.0% and 39.7% every day.

This fits how influence operations work. Researchers quoted by Cybernews point out that covert networks usually run through residential proxies, compromised home devices, commercial VPNs and Western cloud hosts. Since 2022, platforms such as Reddit and Facebook have often blocked traffic from known Russian corporate data centres. A troll farm that depended on Yandex Cloud would have been easy to block long ago.

To be fair to the other side: none of this proves that no bot network was hit. Euronews notes that no independently verified figures exist for the AfD claims either way [ Euronews 2026 ] . Nobody has published a measurement of propaganda accounts on X or Telegram before and after the strikes. The honest summary is that the claim is unproven, and the chart people are sharing cannot prove it.

03 Traffic throughout our network

We run 14 websites on Cloudflare, most of them for Swiss businesses in healthcare and services. Together they take 32,000 to 54,000 requests a day. We pulled every request whose user agent identified it as YandexBot, Yandex’s search crawler, and every request from Russia, from 28 September to midday on 13 October.

The last YandexBot request across all 14 sites arrived in the 19:00 UTC hour on 8 October. Nothing since. Requests from Russia did not fall: 315 to 333 a day after the strikes, inside the range of the week before. On our network, exactly one kind of automated visitor disappeared, and it was the one belonging to the company that lost its data centres.

The numbers are small, about 15 crawler visits a day across 14 sites, and we present them as a sample. They point the same way as Cloudflare’s national data and as Antibot4Navalny’s reading. For the businesses behind those sites, the practical effect is that their pages will go stale in Yandex search, which sends them almost no visitors. A business selling into Russian-speaking markets would see the same gap as lost search traffic within weeks.

04 What the strikes did take down

The propaganda story pulled attention away from the damage that is documented. Yandex runs about six data centres, and the strikes took out roughly half its capacity in four days [ Meduza 2026 ] .

Yandex Mail, Pay, Disk, Go, Taxi and Yandex Cloud failed. So did the businesses that had built on Yandex Cloud: Russian Railways, T-Bank, Avito, MegaFon, Pulkovo airport, Russian media sites, and the cloud behind continuous glucose monitors used by people with diabetes [ UNITED24 2026 ] . Taxi and food ordering stopped working in Kazakhstan, Kyrgyzstan and Uzbekistan, and users in Armenia, Belarus and Serbia reported the same.

Yandex moved customer data and services onto three competitors, VK Cloud, Selectel and K2Cloud. It told its taxi drivers to navigate with Google Maps or Waze. It added a force majeure clause covering drone attacks to its user agreement. Replacing the equipment is expected to take about six months.

05 The question for every business on one provider

Swap the drones for a flood, a fire, a power failure, a ransomware attack on the provider or a sanctions decision, and the outage looks the same. Russian Railways and a glucose monitoring service did not choose to be in a war zone. They chose a cloud provider, and the provider’s buildings became targets.

EU financial firms already have to think this way. DORA’s Article 29 requires them to assess concentration risk before they sign an ICT contract, including whether a provider is easy to replace [ DORA Art. 29 ] . Every other business can borrow the same questions.

• Which customer-facing services share one provider or one region? Include what your suppliers run for you: payments, booking, email, maps, identity.
• How long would each be down if that region disappeared tonight? Get a number in hours, from the people who would do the work.
• Where would you move to? Yandex found room at three competitors because it is large. A smaller business needs its second provider chosen, contracted and tested in advance.
• Do your backups and recovery tools live with your production? If the data centre goes, they go with it.
• Would you notice a supplier going quiet? Alert on missing webhooks, missing partner traffic and stalled queues, alongside your own errors.

Yandex’s customers found out how much they depended on one provider on the morning it failed. You can find out now, in a test, and leave with the list of services that would go dark, how long each would stay down, and the order to fix them in. Enterprise-grade. Not enterprise-priced. Start with your Threat Map.