↓ Skip to main content
Christoph Kemetmüller
Opinion

Two Kinds of Bot

·2 mins
Opinion Cyber Policy Threat Intelligence Espionage
Table of Contents

Introduction
#

Ukraine struck three of Yandex’s five data centres from 8 October. Within days a Cloudflare chart was circulating as proof that Russian bot networks had gone dark, and President Zelensky1 credited the strikes with “less hate, less division and fewer provocations” online.

Line chart of bot HTTP requests from Yandex's network, 6 to 12 October 2026, against the previous week. Both lines drop sharply early on 8 October; the previous week recovers within about a day, while the current week stays at about half, then drops to zero on 11 October before partially recovering.
Bot HTTP requests from AS13238 (Yandex), 6–12 October 2026, against the previous week. Source: Cloudflare Radar (click to open the live query).

What the line measures
#

The collapse is real. What it measures is the problem: Cloudflare counts every automated HTTP request reaching its network, search crawlers included, not accounts posting opinions. It said1 the drop was “not necessarily bot behaviour on social media platforms”.

Mikhail Klimarev, an independent analyst, told BBC Russian1 that Yandex uses bots to “essentially crawl the entire internet once a day”, and most likely switched them off as its computing capacity degraded. A search engine with three of its five data centres hit stops crawling. That is the likeliest reading of the graph.

What didn’t change
#

dTeam1, which tracks Moscow-linked influence operations, saw no “traffic change from known Russian accounts and bot clusters on any platform”. The claim travelled anyway, and a post by Czech MEP Tomáš Zdechovský2 reached 4.2 million views.

Screenshot of an X post by Tomáš Zdechovský, 11 October 2026, 4.2 million views, reading: If confirmed, this is telling: Russian data centres get hit, and online activity around AfD suddenly plummets. It shows an unsourced German chart titled Tägliche Aktivität über 3 Monate, with annotations of minus 30 and minus 56 percent.
The post that carried the claim, 11 October 2026.

Its chart names no source and never says what “activity” counts. The most-viewed post in the argument about Cloudflare’s data does not contain Cloudflare’s data. Zdechovský has since said1 he “did not present it as a clear fact”. Zelensky’s office later said he was “talking about the atmosphere on social media”.1

Who got it wrong
#

Not the fact-checkers: BBC Verify, Maldita and Mother Jones3 took the claim apart within days. The conflation came from politicians, and from our own feeds. Kevin Beaumont4 was blunt:

People confuse legit search engine bots with social media bots. Russian propaganda operations don’t run from Yandex. They never have.

Eva Galperin5 drew the lesson: “every one of us could be fooled by a story that we really want to be true”.

A crawler stopped crawling. Everything else was what we wanted it to mean.

  1. BBC Verify, “Is Zelensky right to say data centre strikes have taken down Russian bots?”, 13 October 2026. https://www.bbc.com/news/articles/c9y7l0pm8jkko ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

  2. Tomáš Zdechovský (@TomasZdechovsky) on X, 11 October 2026. https://x.com/TomasZdechovsky/status/2109328777452962127 ↩︎

  3. Ground News, “Researchers Debunk Viral Yandex Russian Bot Claims Around AfD and MAGA.” https://ground.news/article/yandex-drones-hit-russian-google-suddenly-it-gets-quieter-in-social-media ↩︎

  4. Kevin Beaumont (@GossiTheDog), Cyberplace, 13 October 2026. https://cyberplace.social/@GossiTheDog/117435047238592484 ↩︎

  5. Eva Galperin (@evacide), Hachyderm, 13 October 2026. https://hachyderm.io/@evacide/117434963703286230 ↩︎