Between October 7 and October 11, 2026, Ukrainian drone strikes hit three Yandex data centers in the Russian regions of Ryazan, Kaluga, and Vladimir. The attacks forced the company to take the facilities offline, leading to widespread disruptions in email access, taxi services, and the Yandex Pay digital payment system.1

On October 12, during the Warsaw Security Forum, President Volodymyr Zelenskyy suggested that these strikes had provided a brief respite from online disruption. He claimed that across various social media platforms, the air felt clearer, with less hatred, division, and provocation, attributing this change to a reduction in bot activity.3 In the days that followed, graphs purportedly showing a sharp decline in pro-Trump accounts in the U.S. and pro-AfD accounts in Germany gained millions of views online.

What this article covers:
  • An analysis of which software actually generated the viral decline in the so-called bot traffic graph.
  • Evidence showing how traffic previously hosted on Yandex migrated to other servers on the same day.
  • An explanation of why the viral AfD graph featured data for a date that had not yet occurred.
  • The supplementary clarification issued by Zelenskyy’s office regarding his remarks.

Whose traffic dropped to zero during the Yandex outages?

The viral claims were anchored to real data provided by the internet infrastructure company Cloudflare, which publishes traffic analysis on its public Radar dashboard. At 02:00 UTC on October 11, automated requests originating from Yandex's primary network, AS13238, plummeted to 0.3% of their peak levels from previous weeks; one week earlier, the rate had been 88.2%.4 The dashboard labeled this as "bot traffic," and screenshots of this graph were circulated alongside images of burning data centers. However, "bot traffic" in this context refers to any software that automatically sends requests to websites, including legitimate tools like the search engine crawlers used by Google and Yandex to index the web. Automated social media accounts—often referred to as "bots" in political discourse—are not captured by this specific measurement. An analysis published by Cloudflare on October 14 found that 99.5% of requests from AS13238 were automated, with 93.6% originating from verified search engine crawlers.5 Mikhail Klimarev, an independent internet analyst, noted that Yandex’s crawlers map almost the entire internet daily, and it is likely that the company deactivated these crawlers first when their processing power became compromised.6

Where did the bots go after the Yandex servers failed?

Traffic patterns on Yandex’s second network, AS200350, which supports Yandex.Cloud, revealed a different outcome. While 95% of requests were automated, they were not verified search crawlers; instead, they were applications sending data to websites. Following the attacks, bot traffic on this network fell by approximately 40%, including a 90% drop in probes targeting WordPress vulnerabilities.5 The most telling evidence emerged from a gambling site. Nearly all bot requests originating from Yandex.Cloud were directed at a single gambling client and ceased immediately after the October 8 disruption. Simultaneously, identical requests—matching the same TLS fingerprints, specific path structures, and unique user-agent strings—began arriving from other Russian hosting providers like Radist and Selectel. Throughout the week, the total volume of bot traffic directed at gambling sites from Russia actually increased from 167.7 million to 170.1 million requests. The automation had not been neutralized; it had simply relocated to different servers.5

Notes and Sources

  1. Yandex (2026). "What is happening to our data centers, the iron heart of Yandex". Company Statement. yandex.com
  2. Antoniuk, D. (2026). "Ukraine strikes third Yandex data center, disrupting digital services across Russia". The Record. therecord.media
  3. Gilbert, M. (2026). "Fact check: Viral graph suggests drop in alleged Russian bot activity". Deutsche Welle. dw.com
  4. DiResta, R. (2026). "The Russian Bots Went Silent. Or Did They?". Lawfare. lawfaremedia.org
  5. Elmore, M. and Ohlsen, L. Y. (2026). "Yandex outage: Data shows that instead of going dark, malicious bots went on the move". Cloudflare Blog. blog.cloudflare.com
  6. Irvine-Brown, R., Sardarizadeh, S. and Durbin, A. (2026). "Is Zelensky right to say data centre strikes have taken down Russian bots?". BBC Verify. bbc.com
  7. Holnburger, J. (2026). "Sand im Getriebe der Desinfomaschine? Der Angriff auf Yandex und (vermeintliche) Auswirkungen auf Russlands Bot-Netzwerke". CeMAS. cemas.io
  8. Christensen, L. (2026). "Did Ukraine's strikes on Yandex servers take out Russian bots? What we know". Snopes. snopes.com