In October 2026, Ukrainian drone strikes hit three Yandex data centers in Russia's Ryazan, Kaluga, and Vladimir regions. Within hours, a chart from Cloudflare Radar began circulating on X and Facebook showing automated web requests from Yandex's network dropping by as much as 99%. The internet erupted. "Russia's bot army has been silenced," users declared. Comment sections suddenly felt quieter. Timelines seemed cleaner. It was, for many, proof that the troll farms had been unplugged.

It was also completely wrong.

The data was real. The interpretation was not. And the gap between what actually happened and what millions of people believed happened reveals something deeply uncomfortable about the modern internet: we don't agree on what a "bot" even is, and the companies best positioned to fix the problem have every financial reason not to.

What Actually Happened

Cloudflare Radar, a public platform that tracks global internet traffic, monitored incoming HTTP requests from Yandex's Autonomous System network, identified as AS13238. Following the strikes, automated requests from that network collapsed from their typical baseline to just 0.3–0.4% of peak volume.

The metrics were dramatic. They were also narrowly specific.

Cloudflare's Bot Score system, which rates requests from 1 to 99, classifies anything scoring 1–29 as "likely automated." These scores are calculated through browser fingerprinting, machine learning models analyzing request patterns, JavaScript detection of headless browsers like Puppeteer or Selenium, and heuristic checks for missing headers or mismatched configurations. When Yandex's infrastructure went down, the automated requests that vanished were overwhelmingly web crawlers—search engine indexers and site scrapers that scan public websites to update search results.

They were not social media bots. They were not troll farm accounts. They were not political influence operations.

As The Verge reported, disinformation trackers were quick to draw the line. The Yandex outage, they noted, "probably didn't blitz Russian bots." Cybernews was more direct: "Yandex bot traffic fell, but the troll farm story does not hold."

The Terminology Problem

The confusion stems from a single word: "bot."

To network engineers, a bot is any software script that performs automated tasks. The internet is saturated with them—search engine crawlers, feed fetchers, uptime monitors, price scrapers. These are infrastructure tools. They read text on public websites. They don't have social media accounts. They don't argue about politics.

To everyday users, a bot is exclusively a fake social media profile designed to manipulate, provoke, and spam. This is the definition that dominates public discourse, and it's the definition that made the Yandex chart go viral.

When people saw "bot traffic plummeted," they assumed it meant the trolls had been unplugged. They lacked the technical context to understand that Yandex's search engine had simply stopped indexing websites. As BR Faktenfuchs, a German public broadcaster's fact-checking unit, documented, users fell victim to a digital placebo effect—expecting cleaner feeds because they believed the narrative, then interpreting random algorithmic shifts as confirmation.

The behavioral placebo was powerful. Hundreds of users reported quieter timelines. Some ran "bot tests"—posting trigger words or riddles to bait suspected automated accounts—and when threads seemed quieter, attributed it to the Yandex strike. But the accounts they were testing never had anything to do with Yandex's infrastructure to begin with.

Where Social Media Bots Actually Live

The infrastructure that powers social media manipulation is deliberately, structurally separate from corporate search engine networks like Yandex.

Coordinated inauthentic behavior operates through residential proxy networks—millions of IP addresses assigned to real households, often harvested via malware, compromised smart-home devices, or free VPN apps. When a bot in St. Petersburg posts on X, its traffic routes through a router in Ohio or London. To the platform, it looks like a standard home user.

The physical operations are equally distributed. Russia's infamous Internet Research Agency ran out of ordinary office buildings in St. Petersburg, with paid workers manually managing dozens of profiles per shift. Law enforcement raids in Ukraine have uncovered regional "bot farms" hidden in rented apartments, packed with SIM boxes—hardware units holding thousands of cellular SIM cards used to bypass phone verification.

The software layer runs on cheap Western virtual private servers from providers like DigitalOcean or AWS, purchased with cryptocurrency and registered under fictitious business names.

None of this infrastructure touches Yandex's AS13238 network. None of it was affected by the drone strikes.

The Proof That Nothing Changed

If the Yandex strike had actually silenced social media bots, global traffic to platforms like X, Facebook, and Instagram would have shown a corresponding drop. It didn't. Analysts cross-referencing domain traffic data found that while Yandex's automated requests plummeted by over 95%, user traffic and request volumes to major social platforms remained completely steady.

The drop was isolated entirely to general websites that Yandex regularly crawls for its search engine.

When researchers traced the IP footprints of known coordinated bot networks, they found they almost never originated from Yandex data centers. Instead, the data showed traffic routing through residential proxy networks and Western VPS providers. Because the footprint never matched Yandex to begin with, destroying Yandex data centers couldn't stop them.

Timeline and volume analysis confirmed it. Disinformation researchers tracking political spam hashtags and state-media amplification during the exact hours of the Yandex outage found no corresponding 94% drop. The noise continued at its usual baseline.

Perhaps the strongest evidence came from a natural control group. Users on X—where the Yandex rumor trended heavily—claimed their feeds were suddenly clean. Meanwhile, users on platforms like LinkedIn or Threads, where the rumor never caught on, reported no change in their daily experience or spam levels. The disparity confirms the effect was psychological, not technical.

The Platforms' Conflicting Incentives

Even if social media companies could eradicate bots, they face intense financial pressure that deeply disincentivizes them from doing so completely.

Social media business models are built on proving continuous growth to Wall Street and advertisers. Bots scroll, view, like, and click. To an automated ad platform, a bot viewing a video registers as a "page view" or "impression." If a platform aggressively purges 15–20% of its account base, its Monthly Active Users will plummet. For a publicly traded company, a sudden drop in user metrics can trigger an immediate stock price collapse.

Algorithms are also optimized for user retention, and bots excel at creating hyper-polarized, inflammatory content. A single bot leaving a provocative comment can trigger hundreds of organic human replies. The platform profits from the ad space served to all the real humans who rushed into the comment section to fight the bot.

Over the last few years, the strategy has shifted from aggressively deleting bots to monetizing the ecosystem through premium verification. By allowing users to buy verification or pay to amplify visibility, platforms have created a tax. Professional bot operators, state-backed troll farms, and commercial spam networks simply build the cost of these premium tiers into their operational budgets. The platforms generate direct subscription revenue from the very networks they claim to be fighting.

The Danger of the Narrative

The real danger of this viral misunderstanding is that it gave people a false sense of security. Believing that a military strike "turned off" the bots makes users let their guard down. It creates the illusion that the problem has been solved by external forces, when in reality, the platforms hosting the manipulation have little incentive to solve it themselves.

The Yandex strike was a real event with real consequences for Russia's digital infrastructure. Search engines stopped indexing. Cloud services failed. Food delivery and navigation apps went down for ordinary Russian citizens.

But the bots that manipulate social media—the ones that spread disinformation, amplify polarization, and poison public discourse—never stopped. They are still out there, running on residential proxies and Western cloud servers, hiding behind the same infrastructure that platforms have every financial reason to tolerate.

The next time a chart goes viral claiming the bots have been defeated, it's worth asking a simple question: which bots are we actually talking about?