Photo credits
Photo: WikiFido / cropped; adapted image licensed CC BY-SA 4.0.Did Ukraine’s Yandex strikes stop Russian bot traffic?
Automated traffic observed from one Yandex network sharply declined and then partly recovered after the data-centre attacks. Russia-wide traffic did not show the same collapse.
That is evidence of a network disruption, but it cannot establish that Russian political bots disappeared. Our comparison separates three questions: what stopped, what returned and whether activity moved elsewhere.
Which Yandex data centres were hit?
Reuters reported that Ukrainian attacks shut down Yandex’s Sasovo data centre on 8 October and partly disabled its Kaluga facility on 9 October. Yandex said a drone attack damaged its Vladimir infrastructure on 11 October and suspended that site’s operation. Independent monitor NetBlocks attributed the Vladimir attack to Ukraine.
These were physical attacks on data centres. The reviewed evidence does not identify a single server hosting all Russian propaganda accounts, or establish that the facilities were exclusively bot farms.
What does the matched traffic comparison show?
WDWK inspected Cloudflare Radar’s Yandex LLC network, AS13238, and Russian Federation bot charts for the same 5–12 October period. The Yandex series fell near zero around 11 October, then rose again by 12 October, still below its earlier level. The country series continued its daily cycles.
| Signal | What it shows | What it cannot establish |
|---|---|---|
| Yandex AS13238 bot chart | Sharp fall, followed by partial recovery | Political accounts or absolute bot numbers |
| Russia-wide bot chart | No matching near-zero collapse | Whether a particular influence operation stopped |
| NetBlocks network monitoring | A second Yandex connectivity disruption | The purpose of affected traffic |
Why does “bot” not automatically mean propaganda?
Cloudflare’s bot classification describes likely automation, not political intent. Its measurements reflect requests visible to its network. Yandex’s own documentation identifies AS13238 among networks used by its robots, including its search-indexing crawler.
Disrupted crawling is therefore one plausible contributor to the fall. The public chart does not identify the exact mix.
Did activity recover or move elsewhere? WDWK analysis
The return of observed requests answers the recovery question only narrowly: some automated activity reappeared within the measured network. It does not identify the returning services or show that every damaged facility recovered.
Migration is a separate question. Activity could theoretically resume through another provider or location without returning to the original network. Neither chart tracks the same operator across hosts, so they cannot establish that this happened.
The national comparison weakens the claim of a general shutdown of Russian bots. It still cannot exclude disruption to a particular influence operation. To measure political impact, investigators would need independently attributed coordinated accounts, activity before and after the strikes, and credible links to the affected infrastructure. Continued observations would help distinguish a lasting reduction from a temporary pause or relocation.
What is the confirmed practical impact?
Yandex Cloud’s latest visible update, issued at 09:17 BST on 12 October, said the platform still operated with limited functionality and recommended alternative hosting and recovery resources. Earlier updates showed some components restored, while computing remained partly available.
The immediate business risk is therefore easier to substantiate than a claim about propaganda: affected customers may need to restore services or find capacity elsewhere. The useful next checks are sustained service restoration, traffic recovery and any platform investigation linking specific coordinated accounts to the outage.
How we checked
We compared the solid current-period lines in the two dated public charts and checked Yandex’s incident timeline on 12 October. This is a qualitative comparison, not a statistical estimate. The charts are separately normalised, so their heights cannot be compared as absolute volumes. We did not infer exact losses, account totals or political purpose.
Methodology
We visually compared the solid current-period lines in Cloudflare’s AS13238 and Russia-wide bot charts for 5–12 October, then checked Yandex’s incident timeline and NetBlocks’ monitoring. The comparison is qualitative. The charts use separate normalised scales; no exact loss, absolute account total, migration or political purpose was inferred.
