Requests from YandexBot, the main indexing robot of Russia's largest search engine, fell to near zero on Cloudflare's network early on October 11, 2026, hours after a drone strike forced Yandex to shut down a data center in the Vladimir region. Cloudflare Radar data shows a crawler that had run at a stable level for three months collapsing in two steps over four days. What the same data cannot show is the claim that spread across X, Reddit and Telegram over the weekend: that Kremlin-linked propaganda bots on social networks disappeared along with it.

In Short

Ukrainian drones hit three Yandex data centers between October 8 and October 11, and the robot Yandex uses to read websites for its search engine almost stopped visiting sites protected by Cloudflare. Many people online concluded that Russian bots on X and Reddit had vanished too, but the Cloudflare chart only counts a search crawler fetching web pages, not accounts posting on social networks. So the crawler drop is measured and real, while the social media bot claim remains a hunch that nobody has backed with platform data.

What the Cloudflare data shows

Cloudflare Radar's "Bot Information for YandexBot" page lists the bot as Verified, in the Search category, operated by Yandex, with Direct access, meaning the operator controls the bot's activity itself rather than through an intermediary. Radar describes it as "The main indexing robot for Yandex search." The declared user agent is "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)".

Radar's charts carry no absolute request counts. Radar plots traffic as a share of the maximum value in the selected window, so a reading of 50% means half of that window's peak, not half of normal Yandex crawling across the web. The figures also cover only requests reaching sites behind Cloudflare.

Radar's three-month view runs from mid-July to October 12 at daily resolution. Its single readable tooltip, for Sunday, September 6, puts YandexBot at 91.6% of the maximum, against 91.7% on the matching day of the previous period, June 14. That near-identical pair illustrates how flat the crawler's baseline had been. Across the window the line oscillates between roughly 60% and 100% of the maximum, with one deeper daily dip around the start of October. The final data points then fall almost vertically toward zero.

The seven-day view, which runs from the late afternoon of October 5 to the afternoon of October 12, has the finer detail. Reading the chart geometry (Radar shows no values without hovering, so these are approximations derived from tick positions), the collapse happened in two distinct steps:

  • From October 6 to the early hours of October 8 UTC, YandexBot ran at roughly 75% to 85% of the window maximum, tracking the previous week's dashed line closely.
  • Around the morning of October 8 UTC, traffic stepped down to roughly half of the window maximum and stayed at that plateau for about two and a half days.
  • At around the start of October 11 UTC, the line fell to effectively zero and remained there for roughly half a day.
  • From the afternoon of October 11, a partial recovery set in, reaching perhaps 10% to 20% of the window maximum by the afternoon of October 12.

The comparison line matters. During the previous seven days, YandexBot traffic also dipped sharply for more than a day, around October 1 and October 2, falling lower than the first step of this week, before recovering. A one-day dip to half capacity is therefore not, on its own, unusual for this crawler. The zero reading on October 11 is a different matter: nothing in either comparison period comes close.

One further detail on the page is easy to misread. Radar's robots.txt panel offers a two-line block, "User-Agent: http://yandex.com/bots" followed by "Disallow: /". That is a snippet Cloudflare generates for site owners who want to exclude the bot, not a statement about Yandex's behavior. The snippet keys on the URL taken from the user agent string rather than a product token, and whether a group written that way matches YandexBot depends on how Yandex parses the line. Radar does not settle that.

How the steps line up with the strikes

Yandex's own account, published on its company news page on October 9 and signed by the Yandex Team, describes two incidents. A drone hit the data center in Sasovo, in the Ryazan region southeast of Moscow, during the night of October 7 to October 8; the company said the facility was seriously damaged and completely shut down. A second data center, in the Kaluga region southwest of Moscow, was attacked on the morning of October 9 and lost part of its infrastructure. Yandex reported no employee injuries at either site and said it could not estimate when equipment would be back in service.

The Vladimir facility, about 180 kilometres east of Moscow, followed early on Sunday, October 11. According to Yandex, as reported by the Moscow Times and by Cybernews, operations there were completely suspended and some services became unavailable. The defence company Fire Point said on Telegram that its FP-1 long-range drones carried out that attack, according to LIGA.net.

Set against the seven-day chart, the timing fits two of the three events. The first step down arrives on the morning of October 8, after the Sasovo strike. The fall to zero arrives around the start of October 11, consistent with the Vladimir shutdown. The Kaluga attack on October 9 leaves no visible step; the line holds its plateau through October 9 and October 10. That gap is worth noting rather than explaining away. It could mean the Kaluga site carried little crawling work, or that the partial damage there did not touch crawl capacity, or something else entirely. Cloudflare does not identify which data center handled a given request, so the chart supports a timing correlation and nothing more granular.

The supercomputer detail adds context. According to Meduza, Sasovo houses two of Yandex's three supercomputers used to train neural networks, named Lyapunov and Chervonenkis, the latter once ranked 19th on the Top500 list in 2021. The third, Galushkin, is located in Vladimir, according to defence-industry.eu. Yandex has not reported on the condition of any of them.

What "destroyed" does and does not mean

The premise circulating since the weekend is that Yandex's data centers were destroyed. The sources reviewed for this article do not establish that. Yandex itself used the language of damage and suspension: Sasovo seriously damaged and completely shut down, Kaluga with part of its infrastructure out of service, Vladimir with operations completely suspended. None of the reports reviewed describes total physical destruction of a facility, and none quantifies how much equipment was lost.

There is also a count discrepancy. Most reporting, including the Moscow Times, RFE/RL and Cybernews, describes three Yandex data centers attacked in four days. A widely shared DEV Community post said two of Yandex's five data centres were hit. Yandex's October 9 statement does not give a total number of facilities, and no source reviewed here confirms the figure of five.

The service picture is clearer. According to defence-industry.eu, users across Russia, including Siberia, reported problems with Yandex Go, Yandex Pay, Yandex Food, Yandex Pro and the Alice assistant, and Yandex advised Yandex Cloud customers to use alternative storage arrangements. Cybernews reported that Yandex described Yandex Cloud as operating with limited functionality and in emergency mode. RFE/RL reported disruptions to Yandex Go in Kazakhstan, Armenia, Belarus, Kyrgyzstan and Uzbekistan, with the Kazakhstan unit resuming service on October 12. Meduza reported that on October 8 the websites of Cian, Russian Railways and several regional administrations also had problems, and that Yandex shares fell more than 3% on the Moscow Exchange during the Sasovo strike.

Collateral effects extended beyond Yandex. Vladimir governor Aleksandr Avdeyev said the attack there destroyed two substations supplying 5,000 residents, according to defence-industry.eu. A Moscow Times report tied to the Kaluga strike cited the regional governor as saying nine people were injured, which does not contradict Yandex's statement that no employees were hurt but does indicate the attack's effects reached beyond the company.

The strikes did not come from nowhere. According to Meduza, data centers belonging to at least eight Ukrainian companies had been damaged or destroyed by Russian attacks since September 23, with Russia's Defence Ministry claiming those sites processed intelligence for Ukraine's armed forces. Ukraine's president Volodymyr Zelenskyy has framed the Yandex attacks as a response in kind. Russia's digital development minister Maksut Shadayev said the defence and digital ministries were discussing ways to protect data centers from drones, according to TASS as cited by RFE/RL.

The viral claim about X and Reddit

Within hours of the Vladimir shutdown, the Cloudflare chart was circulating as evidence of something larger. A Tom's Hardware article reported Yandex bot traffic nearly eliminated overnight; its URL slug still reads "russian disinformation bot traffic nearly eliminated," while its published headline now refers to "Russia's Yandex bot traffic," suggesting the framing was revised after publication (an inference from the two versions, not something the outlet has stated). Pollster Frank Luntz posted on X that Russian bot traffic had plummeted, citing Cloudflare's report that bot traffic from the Yandex network had dropped to 0.4% of its two-week maximum.

On social networks, the claims became specific. According to a Mezha editorial review published today, users said their feeds held fewer supporters of Germany's AfD, the US MAGA movement and Alberta's separation from Canada; a user on the Canadian subreddit r/AlbertaNow remarked on a sudden absence of separatist posts, and users on the US forum Democratic Underground thanked Ukraine. Euronews reported similar claims about Reform UK and about fewer apparently automated pro-conservative replies on X, noting the debate comes weeks before the US midterm elections in early November. Czech MEP Tomáš Zdechovský shared a chart of AfD activity on X while cautioning that the pattern still needed confirmation, according to Euronews and RFE/RL.

Zelenskyy added political weight today. In a video address to the Warsaw Security Forum on October 12, he said that after Ukraine's strikes reached Yandex's data centers, people noticed less hatred and fewer provocations on social media because there were fewer bots, and that it was clear where those bots had come from, according to Ukrinform and RFE/RL.

What the data actually measures

The YandexBot page counts HTTP requests from a single declared crawler to websites that sit behind Cloudflare. It does not see posts, replies, likes or account activity inside X or Reddit. A sockpuppet account posting on X does not send requests that Radar would classify as YandexBot, and Radar does not observe what happens inside a platform's own application traffic. As security writer Davi Ottenheimer put it on his blog flyingpenguin today, the data shows that Yandex stopped crawling; Radar cannot see X, Facebook, Telegram, TikTok, YouTube or VK activity at all.

The broader network figures point the same way. According to Ottenheimer's analysis, YandexBot accounted for 99.8% of Russia's verified-bot requests on Cloudflare in both the week before and the week of the strikes, so Cloudflare's verified-bot chart for Russia is in effect a YandexBot chart. Mezha, citing Cloudflare, said around 99.6% of requests from Yandex's network are classified as automated, much of it routine search crawling. RFE/RL quoted the researcher behind the @antibot4navalny account, which tracks Russian bot campaigns, as saying the chart has little to do with propaganda bots on social media. The Japanese site XenoSpectrum noted that the data reflects HTTP requests from AS13238, Yandex's network, and shows neither total Russian internet traffic nor social media message counts.

Nobody has published figures from inside the platforms. RFE/RL found no statement from X, Reddit or Cloudflare, and neither did Euronews. No research group has yet released account-level data showing a break in Russian-linked posting on X or Reddit at the strike times.

What the counter-evidence shows

Several checks run so far cut against the viral reading, though none is definitive either.

According to Mezha, the Rohtext project compared German-language posts on X across matching 18-hour weekend windows. Mentions of the AfD fell 19.3%, but mentions of the CDU fell 17.8%, the SPD 36.8% and the Greens 28.6%. The AfD showed no unique drop; the pattern looks like an ordinary weekend lull. A viral graphic showing falls of 30% and 56% cited no data source, account list, platform or counting method, and its timeline ran to October 15 even though it was posted on October 11. FactCheckRadar classified the causal link between the strikes and AfD-related activity as unsubstantiated.

Ottenheimer reported that the English version of the circulating AfD chart had been altered from a German original, that an account-level claim of a 90% drop in AfD views was retracted by its author hours later, and that Telegram post counts for named Russian amplifiers showed no break at either strike. His post is openly critical of Cloudflare, arguing the company fronts many of the propaganda domains it was credited with silencing, and his inferences about motive go beyond what his data shows. His traffic findings, though, line up with what Cloudflare's YandexBot data shows on its face.

There is one mechanism by which the strikes could plausibly have touched social media automation, and it deserves a fair statement. Bot operators need servers, and Yandex Cloud rents them. If any operation ran its automation on Yandex Cloud infrastructure in the affected facilities, an outage there would interrupt it. Mezha, citing an analysis by Valdrans, reported Yandex Cloud traffic down 82% on October 11. But no source reviewed has shown that any identified influence operation ran on Yandex infrastructure. Spam operators on Reddit, for one, have been described by moderators as relying on anti-detect browsers and rotating residential proxies, which spread traffic across many networks rather than one provider's cloud. The hypothesis is testable. It has not been tested.

The numbers do not quite agree

Different outlets have produced different headline figures from what is essentially the same Radar data, and the differences trace back to windows and baselines rather than errors:

  • 0.4%: bot-classified requests from AS13238 as a share of their two-week peak, cited by Tom's Hardware, RFE/RL, Frank Luntz and Ottenheimer.
  • 0.5%: automated requests at 01:00 UTC on October 11 as a share of peak, against 86.8% a week earlier, according to Mezha.
  • 94%: the fall on October 11 against the average for the second half of September, according to Euronews; Mezha, citing Valdrans, gives the same 94% for October 11, with drops of about 25% on October 8 and 35% on October 9 and October 10.
  • 99%: the DEV Community post's rounding of the 0.4% figure.

Radar's public YandexBot charts cannot reproduce any of these exactly, because they plot normalised lines rather than values. They are consistent with all of them: a first step of roughly a third, a plateau, and then a fall to effectively zero. The Valdrans step sizes of 25% and 35% also suggest the first decline was spread over October 8 and October 9 rather than happening in a single drop, which the hourly seven-day line partly reflects in a gradual slide before the main step.

Why this matters for marketers and publishers

For anyone managing websites with Russian-speaking audiences, the immediate effect is mechanical. A search engine that is not crawling cannot refresh its index. Yandex held roughly 70% of the Russian search market, according to Cybernews, and the crawler collapse means new pages, price changes and removals on sites behind Cloudflare were not being fetched by Yandex for at least part of October 11. Globally the effect is small: Cloudflare's 2025 review gave Yandex a 2% share of search referrals, behind Google at 89.5% and Bing at 3.1%. Server logs will show the same thing. Site owners who check bot traffic in analytics may see a sudden fall in non-human requests that has nothing to do with their own robots.txt settings or bot-management rules.

The episode also tests how the industry reads bot statistics. Cloudflare reported in early June that bots accounted for 57.4% of HTML traffic against 42.6% from humans, and its chief executive Matthew Prince has since said he expects automated traffic to reach about 1,000 times human levels within five years. An August analysis by Decodo put the Russian Federation 12th by share of global bot traffic at 2.7%, with bots making up 40.5% of its own traffic. Those aggregates combine search indexing, AI training, monitoring tools and malicious automation into one word, "bots." The weekend showed how easily that word slides from "a crawler fetching pages" to "fake accounts shaping elections." A crawler in the same category as Googlebot is not an influence operation, and a chart of one says nothing about the other.

For advertisers worried about inauthentic engagement on X and Reddit, nothing in the weekend's data changes the picture. Reddit said in March that it removes an average of 100,000 bot accounts per day, and its chief executive Steve Huffman said in June that its models block up to 23 million spam views and revoke nearly 2 million inauthentic votes daily. Moderators had earlier warned that Reddit's profile privacy controls let bot farms conceal coordinated activity. On YouTube, Google terminated 18,532 channels in coordinated influence operations in the third quarter of 2025, with Russia-linked operations among the largest. Those are the kinds of platform-side numbers that could show whether Russian astroturfing fell after October 11. None has been published for the strike period.

The Yandex situation has its own history on PPC Land. Yandex N.V. agreed in February 2024 to sell its Russia-based businesses, including the Yandex brand, for RUB 475 billion, and closed the deal in July 2024, keeping international units such as Nebius. The data flows that remained tied to Russian Yandex entities drew a EUR 100 million GDPR fine from the Dutch regulator against the Yango ride-hailing operator, published in May 2026. The company whose data centers were hit this week is the Russian Yandex that emerged from that split.

What remains unknown

Several questions are open as of today. Yandex has not said when Sasovo, Kaluga or Vladimir will return to service, or whether its three supercomputers survived. Cloudflare has not commented on its own data. X and Reddit have not published anything on bot activity for the period. The partial recovery visible at the end of the seven-day chart suggests Yandex is shifting crawl work to remaining capacity, but at 10% to 20% of the earlier peak, the crawler is still well below its baseline. Whether the Kaluga attack had any effect on crawling at all is unclear from the chart.

What can be said with confidence is narrower than what spread online. A search crawler went quiet, in two steps that coincide with two of three strikes. The claim that social media became calmer because Russian bots went offline rests so far on impressions, a doctored chart and a political speech. It may yet turn out to contain some truth. The data needed to prove it has not appeared.

Timeline

Summary

Who: Yandex, Russia's largest search engine and technology company; Ukraine, whose drones hit three Yandex data centers; Cloudflare, whose Radar service publishes the YandexBot traffic data; and social media users, commentators and Ukrainian president Volodymyr Zelenskyy, who linked the strikes to fewer bots on X, Reddit and other networks.

What: YandexBot, Yandex's main search crawler, fell to effectively zero on Cloudflare's network after strikes shut down Yandex data centers in Sasovo and Vladimir and partly disabled one in Kaluga. Cloudflare Radar data shows a two-step decline and a partial recovery. Claims that Russian propaganda bots on X and Reddit disappeared at the same time are not supported by the Radar data, which counts only crawler requests to websites, and no platform has published data to confirm them.

When: The strikes took place on October 8, October 9 and October 11, 2026. The crawler fell to near zero around the start of October 11 UTC. Zelenskyy addressed the Warsaw Security Forum on October 12, 2026.

Where: The data centers are in Sasovo (Ryazan region), the Kaluga region and the Vladimir region of Russia. The traffic data covers websites served through Cloudflare's global network. The social media claims concern X, Reddit, Telegram and others in Germany, the UK, Canada and the US.

Why: Ukraine has described the attacks as a response to Russian strikes on Ukrainian data centers since late September. The episode matters for marketers and publishers because it shows how a single crawler's outage can be read as evidence of something much larger, and because "bot traffic" statistics bundle search indexing with malicious automation. Separating the two is what the available data allows, and what the viral claims skipped.