A Striking Lack of Evidence: Did Ukraine’s Bombing of Russian Data Centres Wipe Out Kremlin Bots?

Key Takeaways

• Ukrainian strikes on Yandex infrastructure coincided with a dramatic decline in automated web traffic from Yandex servers classified by Cloudflare as “bot” activity, which users mistook for social media bots rather than normal search engine activity.
• Online, users claimed that Alberta separatism and right-wing movements in Germany or the UK were undergoing a crash in online activity, triggered by the disappearance of “Russian bots.”
• We find no evidence of the collapse in posting or attention toward prominent pro- or anti-separatist accounts that the viral narrative would predict. Claims of Russian bot interference fit existing patterns of debate over Alberta separatism, where allegations of foreign involvement are often used to critique and delegitimize the movement.
• Claims connecting the Yandex disruption to Alberta separatism spread quickly on X. Posts endorsing the claim generated 73% of views, while posts disputing it received only 14%, despite rebuttals representing a substantial share of the conversation.

Context

Ukrainian Drone Strikes on Yandex

From 8 to 11 October, Ukraine conducted drone strikes in Sasovo, Kaluga, and Vladimir, targeting Russian data centres operated by Yandex, one of Russia’s largest technology and internet services companies. Reports following the strikes indicated damage to computing infrastructure at the facilities, while Cloudflare subsequently recorded a 94% decline in automatic traffic associated with affected Yandex servers.

Online Fallout

Following the reduction in traffic, Cloudflare, a large web security company, observed that bot activity originating from presumably affected Yandex servers dropped to just 0.4% of its recent levels. On social media, users assumed this referred to political bots, commonly understood to operate on social media for propaganda or foreign influence, and used this as evidence to suggest that ‘Russian bot activity’ had collapsed. On October 11, Czech politician Tomáš Zdechovský shared a chart that showed AfD-related online activity collapsed. Similar claims about Reform UK and pro-Trump accounts ahead of the American midterm elections were also made. President Zelensky stated that it has become ‘easier to breathe’ with ‘fewer bots’. In Canada, posts on X and Instagram claimed that pro-Alberta separatism accounts and Conservative MPs have lost engagement or stopped posting after the strikes, likewise attributing it to the reduction in Russian bot activity affiliated with Yandex.

What We Know With Our Current Data

What a reduction in ‘bot’ activity means

The link between a crash in bot activity from affected Yandex servers and the purported reduction in political bots on social media most likely stems from a misunderstanding of what the term ‘bot’ refers to when measuring internet traffic. While political bots exist and are used to manipulate users online, bots refer to any form of automated activity online, and also perform essential functions such as indexing websites so that search engines are able to retrieve relevant information for a user. In doing so, they generate vast volumes of requests in order to frequently fetch content on as many websites as possible.

Yandex is the largest search engine in Russia and, like other search engines, runs a family of these indexing bots. Cloudflare is a popular service used by approximately 21% of all websites to process a website’s traffic. In doing so, it classifies whether a request is likely made by a bot or by a human. The crash in bot activity coming from Yandex servers was, according to Cloudflare’s own analysis, due to the search engine’s indexing bots no longer being able to crawl websites using Cloudflare services, rather than a reduction in the number of fake accounts on social media platforms. Furthermore, political influence operations are likely run on multiple servers located outside Russia. Putting Russian servers out of use would likely not affect the infrastructure used to run their operations. Finally, they are generally designed to resemble ordinary user traffic. Cloudflare’s measurement of automated requests from Yandex infrastructure therefore cannot be interpreted as a direct measure of political bot activity on social media.

Did attention towards Alberta separatism collapse?

The claim that political bot activity had crashed since the strike subsequently morphed into claims that attention towards accounts popular in the Alberta referendum declined sharply (see Exhibit 1). Those endorsing the view claim that engagement and view count of these accounts is heavily amplified by Russian bots, that this attention has seen a dip since the strikes, and that their presence online is large enough to cause a meaningful decline in attention directed towards these accounts. In a recent report we put out in September, we find no evidence of impactful effort by the Russian government to influence social media discussions in Alberta and, in the previous section, we argue it’s unlikely the infrastructure responsible for running Russian bot farms was affected.

We first show that since the Ukrainian strikes, there has not been a meaningful drop in attention directed towards top voices in the Alberta separation movement. Drawing from a dataset of posts from 113 leading voices on X about the referendum, we show in Figure 1 the evolution in the number of likes, reposts, and replies received by pro- and anti-separatist accounts between September 14th and October 11th 2026, their medians up to October 7th, the day before the strikes, and then compare them to engagement metrics on posts after the strikes.

We find that engagement received by posts published after the strikes is within expected levels, and we don’t note a meaningful dip in the attention directed towards leading pro- and anti-separatism accounts in discussions around the referendum in Alberta. While this doesn’t prove there isn’t bot activity in promoting posts from top accounts, we find no evidence attention dropped following the strikes.

How Did the Claim Spread in Discussions Around the Alberta Referendum?

We also investigated the spread of the narrative. From a large dataset of tweets discussing the referendum, we found 622 posts between October 8th and October 13th mentioning Yandex or Cloudflare and classified them according to whether they endorsed, disputed, questioned, reported on, or were unrelated to the claim.

From Figure 2 we find that claims endorsing the narrative that the strikes reduced chatter on X around Alberta separatism were refuted within hours. However, disputing posts had much less visibility, receiving only 14% of total views among posts about Alberta discussing the strikes, compared to posts endorsing the claim, which received 73% of total views. Thus, while posts endorsing and refuting the claim are comparable in volume, the most visible narrative among X posts around the Alberta referendum is that the strikes impacted the number of Russian bots online.

What This Could Mean

This story is a clear-cut case of misinformation, and an example of the impact that established voices, like politicians, academics and influencers, can have in legitimizing, and subsequently spreading, a false narrative whose only evidence rested on a misunderstanding of the term “bot”, and was kickstarted by a dubious graph showing an alleged reduction in what was vaguely labeled “AfD activity”. We don’t have reason to believe the story was pushed with the wilful intent to deceive the public, but argue that it likely spread quickly because it fits existing beliefs about which discussions are targeted by online bot networks, and who may benefit from them. In Canada, claims of Russian bot interference fit existing patterns of debate over Alberta separatism, where allegations of foreign involvement are often used to critique and delegitimize the movement.

The impact that the strikes had on Yandex servers was real; some of Russia’s largest data centres were badly damaged and it significantly reduced internet traffic originating from them. However, it had no measurable impact on the large amount of daily attention received by leading voices in the Alberta referendum. Even if we had noticed a change, variations in social media engagement can arise through many mechanisms and cannot by themselves be treated as evidence of bot amplification. Claims of foreign bot activity should therefore be evaluated using multiple indicators of online behaviour rather than engagement shifts alone.

Why This Matters

Conflating automated web traffic with organized propaganda on social media, and falsely claiming the presence of significant foreign manipulation, distorts public understanding of how online influence and ‘bot activity’ actually operate, and undermines our understanding of genuine support for movements like Alberta separatism. This can also undermine the credibility of real and documented accounts of foreign interference, obscuring public understanding of real threats in the Canadian information ecosystem.

Data and Method

Timeline data

The timeline counts the engagement received by the X posts of MEO’s Alberta referendum seeds, from 14 September to 11 October 2026, pulled through the MEO API. The seed collection holds 113 accounts. Each account’s side comes from MEO’s stance coding of the seedlist: 62 accounts are pro-independence, 27 anti-independence, and 18 take no side. The accounts with no side are left out.

Over the window these accounts posted 81,064 times on X. We excluded the accounts’ own reposts (35,459), because a repost carries the counts of the original post rather than the seed’s own. The figure therefore rests on 35,638 original posts and replies: 22,988 pro and 12,650 anti. For each post we took the likes, reposts and replies it received, and summed them by side and by the day the post was made. Together these posts drew 5.3 million likes, 997,000 reposts and 481,000 replies.

Claim data

We searched MEO’s Alberta referendum keyword sweep on X for posts about the claim, from the first strike on 8 October to midday on 13 October. A post was included if it mentioned Yandex or Cloudflare, or mentioned a data centre together with bots. That rule found 622 posts, retweets excluded. Almost all of them are replies and quote posts inside Alberta referendum threads, so the set shows how the claim travelled inside the Alberta conversation, including global posts that were pulled into it.

Each post was coded by a large language model (Claude Opus 5.5) against a fixed codebook, in any language, into one of five frames. A post endorses the claim if it asserts or celebrates that bots went quiet after the strikes, taunts a group for losing its bots, or shares the Cloudflare traffic chart as proof. It disputes the claim if it questions or corrects it, for example by noting that the chart measures Yandex’s search crawler rather than social media bots. The other three frames are posts that ask whether the claim is true without taking a side, posts that report the strikes or outages as news, and posts unrelated to the claim; the figure groups these as “news / other”. We checked the coding by hand on 30 posts, and 28 were coded correctly. Reach is measured as views, counted when MEO collected each post.