A Czech MEP posted a chart of AfD online activity with data points dated after he posted it, and it showed 232,000 views inside two hours. By Sunday night Frank Luntz, Garry Kasparov and Timothy Snyder were spreading the news: drones hit Yandex, and Russia’s bot armies went silent. The strikes are real, and the following bot silence reports beg a deeper analysis of what is being measured and how.
The physical evidence is the easy part. Three Yandex data centres were hit in four days. Yandex confirmed that Sasovo was heavily damaged and fully shut down overnight on 7 to 8 October and that Kaluga lost part of its infrastructure on 9 October. Reuters reported the full shutdown of a third site in the Vladimir region on 11 October. The Sasovo facility sits inside a machine-tool plant that has been under UK sanctions since 2024, according to The Record. Zelensky called the campaign a symmetrical response to a month of Russian strikes on Ukrainian data centres, which Russia’s Defence Ministry had cynically boasted was a forced digital detox (like how Molotov’s “bread baskets” were actually cluster-bombs dropped on civilians in Finland by the Soviet Union).
The digital damage to Russia is harder to assess, yet still measurable. And it certainly can be done using instruments that have nothing to do with an infamous malicious bot-spreading company Cloudflare. The IODA project at Georgia Tech probes the internet continuously and counts the /24 blocks that answer. Yandex Cloud, AS200350, answered from about 518 blocks a day through the first week of October. At 23:30 UTC on 7 October the count started falling and reached 341 by 00:30. At 02:00 UTC on 11 October it fell again, to 117. By the morning of 12 October it stood at 112, a 78 percent loss of reachable address space. Both Yandex networks kept announcing every prefix throughout. The machines went dark and the routes stayed up.
| Signal, AS200350 Yandex Cloud | Reading |
|---|---|
| Responsive /24 blocks, 1 to 7 Oct daily mean | 518 |
| First drop begins | 7 Oct 23:30 UTC |
| 8 to 10 Oct daily mean | 341 |
| Second drop begins | 11 Oct 01:30 UTC |
| 12 Oct | 112 |
| Prefixes announced in BGP, every day | 858, unchanged |
That is the basic summary of what happened, according to reports so far. Now comes a discussion of the statistical chart that produced speculation about the social impact of a datacenter outage. Remember, as we go through this, that Russia called their own operations of bombing datacenters as “digital detox”. So we are looking for evidence that Ukraine bombing Russian datacenters had the effect that Russia claimed.
What spread on Sunday was a screenshot of Cloudflare Radar showing bot-classified HTTP requests from AS13238, Yandex LLC, falling to 0.4 percent of their two-week peak. Tom’s Hardware ran it under a URL slug that still reads russian-disinformation-bot-traffic-nearly-eliminated.
Some may remember that I wrote in June how the Cloudflare CEO misrepresented his own bot data: the company publishes an HTML-only figure as a fact about the whole internet, search crawlers are the largest bot category by a factor of two, and the number functions as a sales pitch for pay-to-crawl. The Yandex chart is the same series read the same wrong way, in reverse. Radar counts a request as a bot when Cloudflare’s bot score falls between 1 and 29, and it filters by default to HTML responses. Russia’s largest search crawler lives in that bucket. When Russia’s largest search crawler stops crawling, the Cloudflare bucket for Yandex’s network empties.
Cloudflare’s own API confirms what the bucket held. Pulled on 12 October, the verified-bot breakdown for Russia is just one bot. YandexBot was 99.8 percent of verified-bot requests from Russia in the week before the strikes and 99.8 percent in the week of them. Cloudflare’s verified-bot chart for Russia is a YandexBot chart. It begs the question why Cloudflare does this, but that’s perhaps another post.
The country-level series is where the story gets far more interesting.
Bot-classified requests from all of Russia averaged 86 percent of their monthly peak from 1 to 7 October and 83 percent from 8 to 11 October. That is a four percent move. Human-classified requests from Russia went from 76 percent of peak to 95 percent, with 9, 10 and 11 October the three highest days of the month. The bot share of Russian traffic did fall, from 49 percent on 7 October to 43 percent on 9 October, and the screenshots of that figure were accurate. The share had already been sliding for two weeks, from 58 percent on 24 September to 47 percent on 5 and 6 October, before any drone flew. The further drop came because Russians went to Cloudflare-fronted sites in the highest numbers of the month while Yandex was down. Cloudflare’s resolver rankings for Russia, which count lookups for every domain, show the same move away from Yandex: facebook.com rose from ninth to seventh, instagram.com from nineteenth to fourteenth, YouTube’s video domain from sixteenth to eleventh, telegram.org from twenty-third to twentieth, while yandex.ru slid from eighth to tenth. Meta’s properties are designated extremist in Russia. For three days the “digital detox” story was that bombing Russian datacenters pushed Russians onto the foreign websites that their own state designates extremist.
The four percent is Yandex itself. Across 1 to 7 October, AS13238 was 8.8 percent of Russia’s bot-classified requests and Yandex Cloud 1.4 percent. Across 9 to 11 October, 4.6 percent and gone from the top twelve.
| Share of Russian bot requests | 1 to 7 Oct / 9 to 11 Oct |
|---|---|
| Rostelecom, consumer ISP | 13.7% / 14.0% |
| Yandex LLC | 8.8% / 4.6% |
| Cloudflare | 4.1% / 3.6% |
| MTS, mobile | 3.6% / 3.6% |
| Vimpelcom, mobile | 3.1% / 3.4% |
| Yandex Cloud | 1.4% / off the list |
| T2 Mobile | 1.1% / 1.4% |
Residential and mobile networks are where automation that imitates people is to be expected, since it has to come from addresses that look like people. Rostelecom, MTS, Vimpelcom and T2 moved between zero and three tenths of a point. The largest single source of bot-classified requests from Russia is a consumer ISP whose share actually went up instead of down.
The hourly data also helps paint this picture. AS13238 rode through the Sasovo night at 88 to 100 percent of peak, eased during 8 October to a 72 percent daily mean, held at 62 percent on 9 and 10 October, and went from 61 percent at 23:00 UTC on 10 October to 0.6 percent at 01:00 on 11 October. So the screenshot in the social media posts shows the Vladimir strike. The earliest posts credited Sasovo, which left Yandex’s crawler running near full volume overnight.
Germany, where the AfD (Nazi party) lives, shows nothing on any Cloudflare series: bot volume averaging 94 percent of peak before the strikes and 96 percent during them, human volume flat, bot share at 52 percent every day of the window. Nonetheless, the earliest known copy of an AfD chart appeared on 11 October at 17:02 UTC. The account of Tomáš Zdechovský, a Czech MEP, posted German axis labels, red markers at minus 30 and minus 56 percent, and the words “if confirmed.” A Bluesky screenshot of his post followed at 18:38 UTC with the caption “none of these far-right movements are organic” and 16,781 likes. Jarosław Wolski, a Polish defence journalist, recaptioned it in Polish that evening with MAGA and “Polish” and “Ukrainian” incitement accounts added to the list of things it supposedly showed, and Andrei Illarionov reposted him. The English translation of Wolski, carrying an English-labelled version of the chart, is what most of the Fediverse saw. Rohtext noticed on Sunday evening that the x-axis runs to 15 October and the second red low sits at about the 13th.
Careful analysis of the two images tells its own story.
Zdechovský’s original is German throughout: the title “Tägliche Aktivität über 3 Monate”, a y-axis with European thousands separators, and every date tick in German format down to “1. Okt. 2026” and “15. Okt. 2026”. The English copy that travelled with Wolski’s caption was made by editing that image. The title and axis words were replaced. The three month names spelled the same in both languages, Jul., Aug. and Sep., were left in German format. The two that differ were retyped as “Oct 1, 2026” and “Oct 15, 2026”, in a smaller font that matches nothing else on the axis. In both versions the line runs past 11 October with an uptick at the end, and three months of daily values show no weekly cycle at all. Measured German political activity on X fell 18 to 37 percent from Saturday to Sunday across all four main parties on the one weekend Rohtext counted by the hour. A 90-day series without a weekend is a peculiar chart with unknown origins, and the version most people saw was a doctored translation of it.
The one account-level number in circulation didn’t last very long. Gabriele Svelto, a Mozilla engineer, posted at 19:03 UTC that he had checked “a couple of Xitter stat sites” and that average views of the main AfD account had dropped 90 percent and engagement 60 percent. At 22:33 UTC he edited the post: he had checked a few random accounts, they were also down a lot, and he must be misreading the data. The original sentence had 651 boosts by Monday morning, and its Bluesky copy, still unedited, 5,008 likes. It kept travelling as social media tends to function. Rohtext’s measured series, German-language posts on X by the hour from 7 to 11 October, shows AfD generic mentions (no sentiment analysis) were rising 9 percent from Thursday to Friday, then falling 19 percent on the weekend, in line with the CDU at 18 percent and less than the SPD at 37 or the Greens at 29.
So I went looking for the Yandex dependency directly. On 12 October I checked 75 domains: the federal AfD, the Bundestag group, twenty-five state party and Landtag group domains, Weidel, Chrupalla, Höcke, Bystron and Krah, the European Parliament delegation, the party foundation and youth wing, fourteen AfD-friendly outlets, fourteen alternative outlets in Germany, Austria and Switzerland, and eleven German-language Kremlin properties. For each: hosting network, mail exchangers, nameservers, and the homepage source searched for Yandex.Metrica, Yandex ads, yastatic, the yadro counter, Mail.ru and VK trackers.
| Layer | Yandex or Russian dependency |
|---|---|
| AfD party, groups, politicians, foundation (36 domains) | None. Hetzner, IONOS, Strato, Netcup, Cloudflare. Mail at Hornetsecurity, Microsoft and IONOS. |
| AfD-friendly media (14) | None. Seven behind Cloudflare, four on Hetzner. |
| Alternative DE/AT/CH outlets (14) | None. |
| RT DE and its four mirrors | Full Yandex and VK tracker stack, DNS at MegaFon. It is RT. |
| anti-spiegel.ru, Thomas Röper | Mail on Yandex: MX mx.yandex.net, SPF _spf.yandex.net. Front door Cloudflare. |
| anonymousnews.org | Hosted at RU-CENTER, DNS at nic.ru. |
The covert operations are another angle to consider here. VIGINUM’s Storm-1516 report places the hundred-plus German-targeting domains registered before the 2025 election on American hosting ranges, on WordPress, and increasingly behind Cloudflare since January 2024, with Dzen and Telegram for amplification. The Swedish Psychological Defence Agency’s Doppelgänger assessment names Voentelekom addresses, a Russian registrar, Proton Mail and Struktura. Qurium’s 2024 map put Doppelgänger’s servers in Frankfurt and in Moscow via Aeza. Yandex appears in none of it. A Yandex dependency would be an attribution giveaway, which is why the professionals build on GoDaddy, Namecheap, Cloudflare and German shared hosting. The operations that do run on Yandex, RT DE and Anti-Spiegel, are the overt ones.
I’ll say it again. Storm-1516 runs behind Cloudflare.
The Pravda network runs behind Cloudflare.
Seven of fourteen AfD-friendly outlets run behind Cloudflare.
The amplifiers kept amplifying. Telegram publishes channel previews with timestamps, so I counted daily posts from 28 September to 12 October for Alina Lipp and Simeon Boykov, whom VIGINUM names, and for Rybar, Compact, Deutschland Kurier and Thomas Röper. Alina Lipp posted 4.7 times a day before the strikes and 4.2 during them. Simeon Boykov went from 21.4 to 26.8. Rybar held between 15 and 21. Compact held at 16. Deutschland Kurier went from 21.5 to 19.5. Thomas Röper, the one operator in the sample with a Yandex dependency, went from 3.4 to 5.0. No channel shows a break at either strike timeline. The only pattern in the table seems to be taking a break for the weekend.
Cloudflare is the wrong instrument in most cases, but not every case.
Cloudflare Radar sees the fifth of the web that Cloudflare fronts, such as all the Nazi and Russia propaganda they want to enable for Cloudflare reasons. X, Facebook, Telegram, TikTok, YouTube and VK run on their own networks, and Radar sees none of their traffic, only DNS lookups through its resolver. An account posting to X from a residential proxy touches Radar at no point in its life. The question Radar can answer is which Cloudflare customers lost their Yandex crawl, and the answer is all of them. The question it holds the data for and will never publish is per-zone traffic to pravda-de.com, pravda-en.com, pravda-fr.com, pravda-es.com and news-pravda.com, the Portal Kombat network that NewsGuard found published 3.6 million articles in 2024, with the ten leading chatbots repeating its claims a third of the time. All five resolve to Cloudflare’s AS13335. So do readovka.news and anti-spiegel.ru. Cloudflare can tell you Yandex stopped crawling.
Cloudflare fronts the propaganda it was credited with silencing.
It begs the question why nobody is bombing Cloudflare. Or perhaps more to the point, who has plans for putting sanctions or drones on Cloudflare?
One more thing worth mentioning is that Yandex’s front-end prefixes, the blocks that host yandex.ru and cloud.yandex.ru, are originated by two networks at once. Yandex’s own AS13238 is seen by about 70 to 76 full-feed peers in RIPE’s collection. AS208398, registered in January 2023 to Edge Technology Plus d.o.o. Beograd, originates the same prefixes and is seen by 250 to 270. The Serbian network has three to four times the route visibility of Russia’s largest internet company and has had it since before the strikes. On 8 October, the day after Sasovo, it carried its 28-day peak of bot-classified traffic, about 40 percent above its weekday norm.
Who owns Edge Technology Plus and under what agreement?
The strike on Yandex is perhaps most notable because it once again exposes Cloudflare for being on the wrong side of history. When the Russian crawler stopped hitting Cloudflare, Cloudflare welcomed the Russians themselves and kept serving the Russian propaganda sites that never went down.
In September I wrote that fragmented attribution is the Russia hypothesis: presence, attribution and tasking are each degraded on purpose, and the operation succeeds when the case stays open. The Dutch rail sabotage of 15 September has a tractor group, a farmers’ secretary who ruled nothing out and coordinated nothing, and silence. The German cable fires have a communique signed with the name of a mobile game. France has two years and a trespass conviction. Yandex has Ukraine’s avowal, Yandex’s own confirmation of each site within hours, and IODA’s probes timestamping both outages to the half-hour. Russia hands out cash to loners for the “simpler job” in NATO countries so that others will carry a flag. Ukraine flies drones at Russian cloud and says so. Russian Railways, MegaFon and 84 Yandex Cloud services fell over as a side effect, which is what both sides are digging into right now.
The herd spent the weekend debating a Cloudflare chart, while rail investigations in three countries stayed open instead of landing on a likely perpetrator. Yandex lost its index, Russians scrambled for three days on the Cloudflare service, while Russian troll farms kept their hours on American hosting. That is what the data says, so far.
