The Yandex outage probably didn’t blitz Russian bots

A wave of Ukrainian drone attacks that disrupted Russian data centers has produced a striking internet chart — and an equally striking misunderstanding. The graphic showed a steep fall in automated traffic associated with Yandex, prompting some social-media users to conclude that Russian disinformation networks had suddenly been knocked offline. Available evidence indicates a narrower explanation: the drop appears to concern Yandex’s own automated web-crawling activity, rather than a nationwide collapse of political bot operations.

The confusion arose after several attacks over the past week reportedly took Russian data-center capacity offline. Yandex, the large Russian technology company often compared with Google because of its central role in search and online services, was among the companies affected. Cloudflare traffic data cited in posts circulating online showed a sharp reduction in bot requests linked to Yandex after the strikes, creating an easy but misleading narrative about a blow to influence campaigns.

The label “bot” covers a wide range of software, and that distinction is central to the case. Automated programs can amplify propaganda, spread conspiracies, send spam, or attempt account intrusions. They are also routinely used for ordinary internet functions, including scanning pages so search engines can catalog them and supporting some customer-service systems. A fall in crawler requests therefore does not, by itself, identify the purpose of the traffic or establish that coordinated social-media accounts have disappeared.

A researcher using the name antibot4navalny, known for examining alleged Russian troll-farm activity, said the figures were unrelated to social media. In an explanation posted on X, the researcher identified the activity as requests from Yandex web crawlers. The relevant Cloudflare view is limited to Yandex-related service traffic, making it a poor basis for broad conclusions about Russian automated activity across the internet.

Cloudflare’s wider country-level bot data points in the same direction. While Yandex-related requests fell around the period of the data-center disruptions, Russia-wide automated traffic did not show a comparably dramatic change. That difference matters because a single company’s outage can interrupt its internal tools and online products without disabling infrastructure used by other operators, services, or campaigns.

A separate visual shared online added to the claims. European Parliament member Tomáš Zdechovský circulated a diagram presented as evidence that online activity concerning Germany’s far-right Alternative for Germany party had collapsed after the attacks. Computer scientist Raphael Wimmer questioned the image’s reliability, citing inconsistencies in its supposed timeline, including an entry dated October 15 even though it appeared before that date.

The provenance of that diagram remains unclear. It appears to have first surfaced in a Threads post by Robin Schlingheider, but the image did not identify a data source and did not originally refer to the AfD. Wimmer said Schlingheider had not answered questions about where it came from. The episode shows how charts can gain authority as they are reposted, even when their source, scope, and method have not been established.

The correction does not mean the strikes had no digital consequences. Yandex’s public status information indicated that most of its operated systems were still unavailable after the latest attack. The disruption included Yandex Pay, leaving customers unable to send money, view balances, or complete purchases. Dima Pirogov, who heads Yandex Fintech, said the company could not provide a firm timetable for restoring the service but was working to bring it back.

What comes next will depend on both the recovery of Yandex infrastructure and the quality of evidence attached to future claims about online influence operations. The outages have demonstrated that damage to data centers can quickly affect payments and other everyday digital services. They have also illustrated a separate vulnerability: incomplete technical data can be recast as a political breakthrough. Until traffic is tied to a verified source and purpose, a dramatic graph alone cannot show that disinformation networks have been taken down.

Source: The Verge