Since last Wednesday, two claims have been everywhere: that Russian bot networks went quiet, and that inboxes are getting less spam. Both trace back to Ukraine's drone strikes on Yandex, Russia's largest internet company. We pulled the data behind both claims. The strikes were real and the damage is serious. The bot chart measures Yandex's search crawler, and spam did not fall because of the strikes in any way we can measure.

The short version
  • Drones hit Yandex data centers in Sasovo (night of October 7 to 8), Kaluga (morning of October 9) and Vladimir (night of October 10 to 11). Yandex confirmed all three. Its cloud platform has been in emergency mode since October 11.
  • The chart behind "Russian bots went silent" counts Yandex's own search crawler, the program that indexes websites. It does not count social media accounts or email.
  • Spam's share of scanned email is at a 12-week low. It was just as low the week before the first drone arrived.
  • The internet's routing system barely noticed. Of the 101 address blocks Yandex was announcing when the first drone hit, 100 stayed online through all three strikes.

What happened

Late on October 7, Cloudflare's monitoring flagged a disruption on Yandex's two main networks, its core network and Yandex Cloud. Within a minute, Yandex Cloud's status page reported a power loss in the availability zone hosted at Sasovo, southeast of Moscow. Residents described a fire at the old machine tool plant that houses the site. On October 9, Yandex said a drone attack had seriously damaged Sasovo and shut it down completely, that its Kaluga data center had been hit that morning with several modules knocked out, and that no employees were hurt. It could not say when Sasovo would be restored.

The third strike came two nights later. Around 4 a.m. Moscow time on October 11, the Vladimir data center lost power and was suspended. Yandex Cloud moved to "emergency mode," described its remaining configuration as unstable, and told customers to fall back on their own disaster recovery plans.

The fallout reached well beyond Russia's tech crowd:

Kyiv framed the strikes as a response in kind. Russia had hit data centers and internet providers in Kyiv in late September, leaving about 100,000 households offline according to Ukraine's government. President Zelenskyy said on October 8 that Ukraine responds "in mirror-like fashion." No Ukrainian military unit has formally claimed the attacks. The Kremlin has not commented. Russia's digital development minister called them "unprecedented" and said his ministry is now working with the Defense Ministry on protecting data centers.

The chart everyone shared

The viral evidence is a Cloudflare Radar chart for AS13238, Yandex's main network. In Cloudflare's four-week view, 99.5% of HTML requests from that network were classified as automated. That is the traffic mix, not a 99.5% fall. The trend line is normalized to the selected period's peak. Cloudflare's bot registry identifies YandexBot as Yandex's main search-indexing crawler. None of these measures counts social media accounts, posts, reach or engagement.

Here is what that crawler did, in Cloudflare's own bot data:

Line chart: YandexBot crawl activity, September 1 to October 12, 2026. It fell to 7 percent of peak on October 11, after the Vladimir strike.
Cloudflare Radar verified bot data, pulled October 13, 2026. Dashed lines mark the Sasovo, Kaluga and Vladimir strikes.

YandexBot activity, where the busiest day equals 100:

The crawler did not collapse after Sasovo. It fell off a cliff between 00:15 and 00:45 UTC on October 11, which is 3:15 to 3:45 a.m. Moscow time, the same night Yandex says Vladimir lost power. In plain terms, Yandex's search engine mostly stopped reading the web. Anyone whose audience finds them through Yandex Search should expect slower indexing for a while.

Claim check: Zelenskyy said it
  • Confirmed. In his October 12 Warsaw Security Forum address, President Volodymyr Zelenskyy said social platforms had less hate, division and provocation because there were fewer bots, and linked that change to Yandex going offline.
  • Unverified. The causal claim is not established. Cloudflare measured automated HTTP requests from a Yandex network and YandexBot crawl activity, not social media accounts or propaganda output.

Independent checks have not found the claimed social media effect. CeMAS reported no decline in inauthentic likes or reposts and noted that Russian disinformation activity normally falls on weekends. CAT-UA found no significant decline across roughly 10,000 daily mentions beyond normal variation. Those findings do not prove zero effect. They show that the claimed causal link remains unverified.

So is there less spam?

Nobody had published spam data for the strike window, so we pulled it. Cloudflare Radar reports the share of email its security service flags as spam, every day.

Line chart: daily share of email flagged as spam, July 15 to October 12, 2026. The decline began before the first strike.
Cloudflare Radar email security data, pulled October 13, 2026. Share of scanned mail, not total spam volume.

Share of email flagged as spam:

If your inbox feels quieter, you are not imagining a dip. October 9 and 10 matched the lowest days of the past 12 weeks. But the five days before the first strike were just as low. The decline started weeks earlier, and the strikes did not change its direction.

There is also no plausible path from these data centers to your inbox. Russia does send a lot of spam: Kaspersky attributed about a third of 2025's spam to Russia, though its sensors skew toward Russian users. Spam is sent mostly from hijacked home computers and cheap hosting, not from a major company's data centers. Where Yandex shows up in spam is as the bait. Criminals have used Yandex Forms and Yandex surveys as links inside scam and malware emails. When those services break, some scam emails arrive with dead links. They still arrive.

Two more things worth knowing. October 12 was Columbus Day, so many people simply got less mail of every kind over the long weekend. And "less spam" makes a satisfying story, which is exactly when people start noticing what fits it. We will run the numbers again next week while Yandex is still degraded.

*A note on the data: this is the share of mail scanned by Cloudflare's email security customers, mostly businesses. It is not total spam volume and not your personal inbox.*

Why the routes stayed up

Routing is how networks tell each other which addresses they can reach. When a country shuts its internet off, the routes usually disappear. Not this time.

A burning building does not withdraw its routes. The routers at the edge of Yandex's network kept announcing addresses whose servers were dark, damaged, or being moved elsewhere. A monitor that watched only routing would have reported a quiet week at Russia's largest internet company.

This is why Signal Atlas never reads one signal alone. Traffic, routing, and the operator's own account told three different stories here, and the truth needed all three.

What other coverage missed

  1. The third strike explains the crawler collapse. Most viral posts credited Sasovo. The sharpest drop lines up with Vladimir.
  2. Not every Russian outage that week was Yandex. A wave of outages on October 8 at T-Bank and news sites including RBC, RIA and Kommersant was blamed by Kommersant on a configuration error at the DDoS protection provider Curator. Several outlets folded them into the Yandex story.
  3. Data centers are now targets in both directions. Kyiv lost data centers and providers in late September; Russia lost three Yandex sites in four days. Anyone running infrastructure near a conflict should plan for physical attack, not only cyberattack.
  4. Recovery is measured in months. Kommersant reports replacement could take up to six months, with large server orders "virtually impossible" before year end. That is a single reporting chain, but Yandex has already rewritten its user agreement to treat drone and missile attacks as force majeure.
  5. The supercomputers are an open question. Sasovo houses Chervonenkis, one of the machines Yandex uses to train its AI models. Nobody has said whether it was damaged.
What this means for you
  • Multiple zones are not multiple risks. Yandex Cloud lost availability zones in two different cities within about three days. If your resilience plan assumes regions fail one at a time, test that assumption.
  • Know your quiet dependencies. Businesses in Central Asia lost delivery and ride apps because of servers in Russia. Map where your critical services actually run.
  • Read the axis before you share the chart. The most shared chart of the week was real data with the wrong label on it.

Routing desk

When Russia hit Kyiv, the routes did vanish. Two weeks before the Yandex strikes, Russian attacks damaged data centers and providers in Kyiv. One of them, Omega Telecom, sells internet transit to other Ukrainian providers. Our check of RIPE's public routing collectors shows all 18 of its IPv4 address blocks dropped out of global routing tables on September 27 and stayed out for about a day and a half. Three were still missing on October 2. Same kind of attack, opposite routing signature. In our assessment the difference is where the routers sat: Omega's were in the building that was hit, while Yandex's network edge was not in the data centers that burned. Neither company has confirmed that.

A valid padlock did not stop a hijack. In late August, attackers announced a narrow slice of Hetzner's address space and used it to impersonate a hosting software vendor's update servers. Kentik's analysis shows the route passed RPKI checks, the main routing security tool, because Hetzner's records allowed slices that small. The fix is simple and still rare: authorize only the route sizes you actually announce.

One cable, a whole country. On October 2 a subsea cable between the Philippines and Singapore was cut. PLDT reported nationwide impact while carriers rerouted traffic, and repairs are expected to take weeks. The Philippine ICT department has not ruled out sabotage. If you pay for two "diverse" internet paths, ask whether they share a cable or landing station.

The scoreboard. As of October 12, 68.25% of routed address blocks are covered by RPKI records, according to Hurricane Electric's adoption report. ASPA, the newer defense built to catch faked paths like the Hetzner case, is published by 3.54% of networks, up from 2.54% in late July. It is still not a finished standard: the IETF draft is waiting on its final write-up. FRR, open source routing software that many networks run, opened a pull request to add ASPA on September 28. In the US, the FCC's 2024 proposal on routing security is still a proposal.

Elsewhere this week

What we still don't know

How we checked

Measurements come from Cloudflare Radar (traffic, bot, outage and email security data) and RIPEstat (routing), pulled on October 13 at about 05:00 UTC. Operator statements are labeled as Yandex's account. Reporting is attributed to the outlet that published it. Anything only one outlet reported is marked as such.

Sources