Yandex went dark. The propaganda didn't.

In perspective

On 11 and 12 October, a simple explanation went round the press: Ukraine hit Yandex, and the Russian bots fell silent. The data shows something else, and the difference matters.

1. A search engine fell, not a bot farm. The viral chart showed automated traffic from Yandex's network, mostly YandexBot, the Russian search engine's crawler. Automated traffic from Russia as a whole stayed at 0.94 of normal, and the other Russian cloud networks carried on.
2. The propaganda does not depend on one place. The networks aimed at Romania and Moldova are spread out: Pravda on Cloudflare, the RT mirrors and News Front on Russian telecom networks, the Telegram channels on Telegram. No strike on a single data centre stops them.
3. A wrong conclusion has costs. If the public and decision-makers believe the bots have vanished, a false calm sets in: "the problem solved itself". And if people believe the propaganda depends on Russian servers, the real levers, which are in Europe (sanctions for the RT mirrors, platform duties, data protection), stay unused.
4. What we do not say. We did not measure X or Facebook and cannot say whether some accounts there became less active. Nor do we say the strikes had no effect: they took down a large part of Russia's cloud and AI capacity. We only say they did not stop the propaganda we measured.

antibot4navalny, The Verge, Florian Roth and Dave Troy reached the same conclusion independently. The underlying lesson: to understand an information war you have to follow the infrastructure and measure the activity, not read a single chart.

The story in brief

Between 8 and 11 October 2026, drone attacks knocked out three Yandex data centres (per Yandex's statements; the strikes are widely attributed to Ukraine), and Yandex Cloud went into emergency mode. We asked whether the propaganda networks aimed at Romania and the Republic of Moldova felt it.

They did not. And the reason matters more than the question: the machine does not depend on the data centres that were hit. The Pravda sites sit behind Cloudflare and their Yandex counter arrives through a public CDN; the RT mirrors live on ever-new domains on Russian telecom networks; the automated Telegram channels keep their schedule to the minute. Yandex keeps one thing: the data about the readers.

And part of this machine is not writing for people. Channels with 44 subscribers that post every 19 minutes exist for search engines and for the AI models we all use.

What was hit

The next day, still down. On 12 October at 08:17 UTC the Yandex Cloud status page said the platform "is still operating in a limited mode", and since 11 October, 15:01 UTC, Yandex has been advising its customers to consider alternative platforms for their resources. Everything that depended on Yandex Cloud was still affected; the propaganda networks examined here were not. Yandex Cloud status page.

Ukraine hit Russia's main cloud and AI-training capacity. The networks examined here do not depend on it. Whether that is a deliberate choice by their operators, the data cannot tell: it may just as well be a matter of cost or habit.

We left out unconfirmed figures circulating about these strikes: the mapping between sites and availability zones, power and rack counts, or "2,700 GPUs destroyed".

The viral chart: whose bots fell?

After the strikes, a Cloudflare Radar chart circulated on X as "Russian bot traffic has vanished". The drop is real: automated traffic from Yandex's network (AS13238) fell in steps, to about 57% on 8 October and to roughly 0.4% of its two-week peak at the start of 11 October (Cloudflare Radar, AS13238; Tom's Hardware, t3n, bne IntelliNews).

In the data we queried, automated traffic from Yandex's network falls to about half after Sasovo and collapses at 01:00 UTC on 11 October, exactly when Yandex logs the Vladimir power failure. Traffic that Cloudflare classes as human also drops to zero on the same network: the network stopped, not just the bots. Over the same hours, the publishing curves of the Pravda sites and the Telegram channels do not change. A similar drop, to about 30%, also appears on 1–2 October with no strike: this network's traffic varies for other reasons too.

But the chart counts only HTTP requests that Cloudflare classes as automated and that leave Yandex's network. It does not show who sends them, and it cannot tell "fewer bots" from "fewer working servers". The Yandex network's automated traffic is very likely mostly its own indexing crawlers (YandexBot): when the data centres went down, so did they. This is an inference; Cloudflare does not publish a breakdown by bot type for this network.

antibot4navalny, which has long tracked state-sponsored campaigns and troll farms, reached the same conclusion: the chart measures Yandex's indexing crawlers, not accounts posting on social media, and overall Russian bot traffic stayed about normal (X, Bluesky; reported by The Verge, 12 October 2026).

Automated traffic from Russia as a whole did not vanish. In the same Cloudflare Radar data, automated HTTP traffic from Russia in the Vladimir outage window (01–09 UTC, 11 October) was 0.94 of its usual level for those hours, and the bot share of all HTTP traffic from Russia only moved from 51.4% to 46.8%. Yandex's network went quiet, not Russian bots in general.

Who the traffic that fell was. From Yandex's network, 100% of verified-bot traffic (bots that identify themselves) is YandexBot, the search engine's crawler. Across Russia, YandexBot made up 99.8% of verified-bot traffic on Sunday 4 October and only 79.2% in the 11 October outage window: YandexBot fell, not the rest. Bots that do not identify themselves are not in this statistic.

The rest of Russian hosting carried on. We compared automated traffic from the main Russian hosting and cloud networks, where bot farms would ordinarily run, with their median of the past 14 days, in the same hours:

1.00 = the 14-day median. Only Yandex collapses (0.01). VK and REG.RU have their weakest of the 14 days, but only slightly below the next; the other networks are within their usual range.

What the press wrote and what the data shows

On 12 October, Le Parisien and, republishing it, Digi24 wrote that the strikes had "silenced" pro-Trump and pro-AfD bots. The articles rest on the Cloudflare chart above and on impressions: fewer reactions under posts, a 56% drop in AfD "support", with no source. Similar claims circulated in Romania about Călin Georgescu's supporters, based on reaction counts in a Facebook group, without a comparison with ordinary days.

For the networks we measured, the data says otherwise. The watched Romanian and Russian TikTok accounts, including Georgescu supporters, published 340 new videos from 63 accounts between 11 and 12 October, after the Vladimir outage, against 328 from 52 accounts the day before. The Pravda sites and the Telegram channels published normally in the outage window. We did not measure X or Facebook, so we cannot say anything about bots there; we can only say that the explanation "Yandex went down, so the bots vanished" fits nothing we measured.

Florian Roth (@cyb3rops), a cybersecurity researcher, made the same point on X on 12 October: bot traffic from Russia "does not automatically mean Russian propaganda bots"; and Dave Troy (@davetroy), who researches disinformation networks, called the claims about the strikes' effect "somewhere between misstated and false" and warned that spreading them "only serves to help the adversary".

Similar assessments were published on X by political scientist Branislav Slantchev (@slantchev), investigative journalist Ilya Lozovsky (@ichbinilya) and Alex Boge (@alexboge). Florian Roth asked the key question: where is the data showing that the propaganda accounts stopped posting too? For the networks aimed at Romania and Moldova, the data in this report shows they did not.

Our data answers the confusion directly: on the same days, the Pravda sites, the automated Telegram channels and the watched TikTok accounts kept publishing. What fell were Yandex's search crawlers, not the propaganda automation we examined.

What Cloudflare sees

Cloudflare serves a large share of the web and runs the 1.1.1.1 DNS resolver. Through Cloudflare Radar we asked three things: how often these domains are looked up, where the lookups come from, and what happened to other Russian networks' traffic during the outage.

Where the domains are looked up from

Lookups for the Pravda network come mainly from the United States and Singapore, two major hubs of data centres and crawlers. Romania and the Republic of Moldova do not appear among the top countries, not even for romania.news-pravda.com and md.news-pravda.com. The control outlets (Digi24, HotNews) are looked up mainly from Romania and Moldova. It is a sign that much of these domains' "audience" is automated. 1.1.1.1 lookups are a sample, resolver use differs between countries, and volume for the Romanian and Moldovan subdomains is low.

Across all 79 domains in the three clusters for which Cloudflare has data, the top country is: US for 40, SG for 13, DE for 11, RU for 3, CA for 2. Romania or the Republic of Moldova appear among the top five countries for only 1 domain(s), on very few lookups.

Popularity

news-pravda.com sits in the same bucket as Agerpres (the world's top 50,000 domains) and above Digi24 and HotNews. The ranking is built on DNS lookups, so it counts automated traffic too; read with the geography above, it shows a large volume of lookups, not a large human audience.

Only Yandex's network went down

The three strikes, network by network

Automated traffic relative to each network's 1–7 October mean (1.00 = normal). At Yandex, the Sasovo strike shows between 07:00 and 08:00 UTC on 8 October; Kaluga adds no visible drop. In the hours after Sasovo (08–15 UTC), the Pravda sites published 15% less than a week earlier and the Telegram channels 14% less; Pravda drops of the same size occur on days without outages, and the Telegram history is too short for a comparison. A popularity ranking over time is not available: Cloudflare keeps it only for the world's top 100 domains.

In the Vladimir outage window, automated traffic from the Yandex and Yandex.Cloud networks collapsed, while Rostelecom, MegaFon, MTS and Net By Net, where the RT mirrors sit, ran normally, and StormNetworks, News Front's host, even carried more. The propaganda networks did not stop because they do not depend on Yandex. (Values relative to each network's own 14-day maximum.)

The pages, loaded by Cloudflare

We asked Cloudflare's URL Scanner to load the pages in its own browser, independently of our test.

Only the Pravda network loads the Yandex.Metrica script through jsDelivr. The RT mirror (rtde.tech), News Front and Sputnik Moldova, all on servers in Russia, load it directly from mc.yandex.ru; they use jsDelivr only for other libraries (Swiper, hls.js). No site received a "malicious" verdict from Cloudflare: propaganda is not malware.

Cloudflare scanned 81 sites. All 48 Pravda sites sit behind Cloudflare; 4 answered with error 522, meaning Cloudflare could not reach their real server at the time of the scan. The RT mirrors sit on Rostelecom, RTTV, MegaFon and DDoS-Guard, all in Russia, and nearly all load Yandex.

Cloudflare's scanner is an automated browser; the Pravda code switches the Yandex counter off for such visitors, so missing Yandex requests here do not contradict our capture.

Cloudflare Radar and Cloudflare URL Scanner data, queried by us on 12 October 2026.

Where the readers' data goes

We opened the pages as an ordinary reader would (clean browser, no account, no login) and recorded every request sent to Yandex. The result, for our own visits on 12 October 2026:

• The Pravda network does not load the counter from Yandex but through jsDelivr (cdn.jsdelivr.net/npm/yandex-metrica-watch/tag.js), a public CDN. Ad blockers usually stop mc.yandex.ru; a general CDN gets through. The data still ends up at mc.yandex.ru/watch/97376635, on Yandex servers.
• The visit leaves Yandex cookies, including the yandexuid identifier, on mc.yandex.md, mc.yandex.ru, yandex.md, yandex.ru; the ID is synchronised between the Russian and the Moldovan domain.
• Sputnik Moldova goes further: 25 requests to Yandex, 22 cookies and the Yandex ad system.

On the Pravda pages for Romania and Moldova, the Yandex identifier is also synchronised with mc.webvisor.org, the domain of Yandex Webvisor, Yandex's tool for recording visitors' sessions. The Pravda code starts the counter with webvisor: false, so session recording itself appears to be off; the identifier sync with that domain still happens. On Sputnik Moldova, the RT mirror and News Front we saw no requests to Webvisor.

The counter hides from robots

The Pravda code switches the counter off for automated visitors: agents containing "bot", "crawl", "Parser" or "Scrapy", automated browsers (navigator.webdriver), exactly Chrome 126, a permission state typical of headless browsers, and a screen of exactly 3840×2160 with no referrer. The first are ordinary filters. The last two are very specific and appear to keep a particular automated traffic out of the statistics. This is an inference, not a finding.

Our test browser's identifiers were removed from the published data; we kept only the destination, the server and the page address sent.

Captures

The pages as they looked on 12 October 2026, loaded by us as an ordinary reader would. The originals (HTML, the full request record, checksums) are preserved, and the key pages also have copies on archive.org.

Shared Yandex.Metrica counters

We checked 204 domains that appear as web sources in the pro-Russian material we monitor for Romania and the Republic of Moldova. 161 responded. at least 107 load Yandex.Metrica (under our test conditions: one homepage visit), 16 use Yandex-hosted email, and 1 is hosted on Yandex's network (u-f.ru). A counter ID sits in the page's public code (ym(ID, "init", …) or mc.yandex.ru/watch/ID), so anyone can check it with "View page source".

A Metrica counter belongs to one account, which can grant access to other users. When the same ID appears on dozens of domains, their audience analytics are administered jointly. That links the sites to each other; it does not show how many people or entities control them.

Business Gazeta and Ridus are ordinary Russian publications using their counter on their own subdomains; we kept them as a reference point. What matters is what links domains with no visible connection, like the RT mirrors.

Three infrastructure clusters

We traced 100 domains through TLS certificates (crt.sh), registrations (RDAP), name servers, verification codes published in the pages, and analytics IDs. 90 fall into three separate infrastructure clusters, with no identifiers in common between them; the other 10 stand alone (including the control and the suspended domains).

The RT group comprises the official sites de.rt.com and actualidad.rt.com and 35 mirror domains and subdomains. All are linked by the LiveInternet account "RTNEWS" or the shared verification codes; 17 of them also show the shared Metrica counters on their homepage.

There is earlier research on the Pravda network: in February 2024 VIGINUM, the French agency for foreign digital threats, documented the "Portal Kombat" network of at least 193 automated portals and identified the role of TigerWeb, a Crimea-based company, in creating and administering it, while leaving open that it may work for another operator. Our October 2026 data does not test that attribution; it shows only that the current network has common technical administration.

Where they are hosted

The RT, Sputnik and News Front operations run openly on servers in Russia. The Pravda network, the largest and the one aimed most directly at Romania and Moldova, hides behind Cloudflare. Its real server could be found from DNS history before May 2024, or by Cloudflare itself at the request of an authority.

A lead: news-pravda.com's public DNS records contain two verification codes for the TikTok developer platform (tiktok-developers-site-verification). The operator therefore registered the domain with that platform, which is used, among other things, by apps that publish automatically through TikTok's API. It does not prove automated posting on TikTok; it shows only that the domain was verified for the developer platform.

The RT mirrors come in waves

The first wave starts days after the EU ban on RT (2 March 2022). Each wave seems to replace blocked domains. The link to the blocks is an inference from the dates, not a finding.

Suspended domains

sputnik.md and gagauznews.md no longer respond: the .md registry lists them as "ServerHold" (a registry-level suspension). Sputnik Moldova moved to md.sputniknews.com (Rossiya Segodnya, behind Qrator) and to the backup channel t.me/sputnikmd_2.

Control: unimedia.info, an independent Moldovan outlet since 2008, shares no identifier with the networks above.

Automated Telegram channels

From the public t.me/s/ pages we rebuilt the time of every post from 1 to 12 October for 23 Romanian-, Russian- and Bulgarian-language channels in the pro-Russian ecosystem we monitor. Four signs separate an automated feed from a channel with editors: high volume for a tiny audience, posting at any hour, regular intervals, and posts sent in batches within the same minute.

The clearest cases: TOT_Moldova and InfodefBULGARIA send over 95% of their posts in same-minute batches; pravdarocom and pravdabgcom publish day and night, every 20–30 minutes, for fewer than 50 subscribers.

TOT_Moldova: a program with fixed times

Each dot below is a minute in which the channel published at least two posts at once. The batches fall in the same six windows every day (around 01:00, 07:30, 09:00, 15:30, 17:00 and 23:30 UTC), and the night batch moves from 00:57 (1 Oct) to 01:21 (12 Oct): about two minutes a day, like a timer that reschedules itself after each run. On the day of the Vladimir outage (shaded), the program ran as usual.

Who feeds the channels

From the last five pages of each channel (about 100 posts) we extracted the source of every forward ("Forwarded from").

• rusputnikmd_2, a backup channel of Sputnik Moldova, feeds MoldovaPolitics (12) and grajdaninmoldovi.
• boris_rozhin (Colonelcassad, a Russian military blogger) is the main source of bulgariaz.
• The Bulgarian channels bulgariazov, druschbafm_bulgaria, zovbulgaria and efir_info forward each other's content: a closed loop.

Written for machines?

A channel with 44 subscribers that publishes 496 posts in 12 days has no readers to persuade. It has another target: search engines and the language models that learn from the web. In February 2025 the American Sunlight Project described the Pravda network as built to flood AI models with pro-Kremlin content ("LLM grooming"). In March 2025 NewsGuard tested 10 leading chatbots: they repeated the Russian false narratives in 33.55% of answers, and seven cited Pravda articles directly.

Our data fits that picture: the relay channels around Romania and Moldova have the volume of a news agency and the audience of a group of friends, and the Pravda sites scrub robots from their statistics.

What the chatbots answer today

On 12 October 2026 we asked two OpenAI models 24 questions about Romania and the Republic of Moldova (in Romanian, English and Russian; half neutral, half phrased like the Russian narratives), with and without web search. Of the 12 narrative questions, 10 state a false claim and are scored below; the other two ask "why" (why some say Russia is not Romania's enemy, why Gagauzia wants independence) and have no true/false answer to score. Among 177 cited sources there is not one Pravda, Sputnik, RT or News Front site; the only domain from our list is rbc.ru, a Russian business outlet.

The models refuted the narratives (a NATO attack on Transnistria, "rigged" elections, the "annexation" of Moldova, drone "false flags"), and the newer model often named them as disinformation outright. The result differs from NewsGuard's 2025 test, so something has changed: either the models or the way they pick sources. Three weak spots remain:

• The older model hedges more often, especially in Russian: asked about "rigged" elections, it answered that "opinions differ".
• With search on, the models also cited questionable sources: rbc.ru, vspmr.org (the unrecognised Transnistrian parliament) and unofficial copies of the BBC (bbc.com.im, a proxy on workers.dev).
• We tested only OpenAI. Gemini, Copilot, Grok, Perplexity and the Russian chatbots (GigaChat, YandexGPT) remain untested.

The labels (refutes, hedges, asks to clarify) are our reading; the answers are published (first 1,500 characters) so anyone can check them.

The outage test: did anything slow down?

Drone attacks took three Yandex data centres out of service: Sasovo (8 October), Kaluga (9 October) and Vladimir (11 October, full shutdown; Yandex Cloud went into emergency mode from 01:11 UTC, with zones ru-central1-a and -b unavailable for hours). If the networks above ran on the infrastructure that was hit, their activity should have dropped exactly then.

The Pravda sites against the Romanian press

We compared each day with the same weekday a week earlier, for 9 Pravda language versions (from the sites' public sitemaps) and, as the control group, for the Romanian publications in a continuously collected press archive that had published at least 20 articles on the same weekday a week earlier (90–158 titles a day, out of 369 tracked). We then ranked all 48 days, from 24 August to 10 October, by the difference between the two.

On 8 October all 9 Pravda versions published less, and the day ranks 2 of 48. But 4 and 3 October, with no outage, rank 1 and 4. The Kaluga day (rank 12) is an ordinary one. The drop is not specifically associated with the outage: days with no outage show equal or larger drops. The ranking is descriptive; we did not apply a formal statistical test.

Accounts and channels, minute by minute, in the Vladimir window (01:00–11:30 UTC, 11 October)

No group went silent together. The TikTok accounts that did not post in the window came back spread over five hours, not at once. The channel tirdea was silent for 58 hours (9 October 18:49 – 12 October 05:07 UTC), against its usual pause of about 11 hours a night, but the silence began before the Vladimir outage. It is a lead, not proof.

Lessons

1. Follow the infrastructure, not the outage. A shared counter ID proved more than any timing test could.
2. Strikes on Russian tech do not touch the information war. The Pravda network runs on a Western CDN; the RT mirrors on Russian telecom networks. Neither depends on Yandex Cloud.
3. High volume, tiny audience = red flag. It is the signature of channels that feed search engines and chatbots.
4. The levers are in Europe, but each has a different legal basis (policy analysis, not legal advice):

   Problem	Lever	Who can act	Limits
   RT mirrors	EU sanctions: Regulation 833/2014, Art. 2f, bans RT broadcasting in the EU, so the content is illegal; DSA notices (Art. 16) to the EU intermediaries that distribute it	national sanctions authorities, domain registries, internet providers, trusted flaggers (DSA Art. 22, designated in Romania by ANCOM)	the servers are in Russia, outside DSA jurisdiction
   The Pravda network in search engines and on platforms	DSA systemic risks (Arts 34–35) and the Commission's 2024 election guidelines: very large platforms and search engines must assess and mitigate foreign manipulation	the European Commission; Google, Bing, TikTok, Meta	Pravda is not sanctioned, so its content is not illegal in itself
   Readers' data sent to Yandex	GDPR (Chapter V, transfers outside the EU) and ePrivacy rules (cookies without consent)	data-protection authorities (in Romania, ANSPDCP)	the sites' operator is unknown and outside the EU
   Pravda's hosting behind Cloudflare	Cloudflare's abuse process and requests from authorities; not a DSA obligation	Cloudflare	without illegal content, Cloudflare is not obliged to act
   Automated Telegram channels	DSA basic obligations (notice and action, an EU representative); Telegram's terms of service; sanctions, for RT and Sputnik content	Telegram	Telegram is not designated a very large platform
   Republic of Moldova	national law (domain suspensions, as with sputnik.md) and cooperation with the platforms	the Moldovan authorities	the DSA does not apply: Moldova is not in the EU

5. Say what is not proven. The outage hypothesis failed, and we say so. That is where credibility comes from.

What this shows and what it does not

The conclusion: the information war aimed at Romania and Moldova does not depend on the infrastructure that was hit. It depends on Western services and ordinary Russian networks, while Russia, through Yandex, keeps the data on who reads it. That is why the real levers are in Europe.

Method, data and limits

• Infrastructure: for each domain, one HTTPS request to the homepage (Metrica counters, yastatic, Yandex ads, Dzen, Google Tag Manager, LiveInternet), DNS (A, MX, NS) and the network operator (Team Cymru). Public data only, no logins. 12 October 2026.
• Web activity: the Pravda sites' public sitemaps, with the time of each article. Control group: 369 Romanian publications from a press archive collected every 30 minutes.
• Telegram: the public t.me/s/<channel> pages, with the exact time of each post; forwards from the last five pages of each channel.
• TikTok: a sample of public posts collected daily (1–12 October, 4,086 posts, 68 accounts). Private individuals' accounts are not named; they are reported only in aggregate.
• Limits: Cloudflare hides the real hosting of many sites; Telegram does not show which server a bot publishes from; 11 October is a Sunday, and the press data for that day was still incomplete at the time of analysis; the weekly test treats the Pravda sites as separate series although they belong to one network.
• Sources for the outages: NewsGuard (2025); Techdirt, despre American Sunlight Project; Yandex Cloud status page; Al Jazeera; The Moscow Times; Meduza.
• Independent copies: the key pages were saved on archive.org on 12 October 2026: romania.news-pravda.com; md.news-pravda.com; news-pravda.com; md.sputniknews.com; rtde.tech; t.me/s/pravdarocom; t.me/s/pravdamdcom; t.me/s/TOT_Moldova; t.me/s/rusputnikmd_2; t.me/s/MoldovaPolitics; t.me/s/grajdaninmoldovi; t.me/s/InfodefBULGARIA. news-front.su refused archiving; we hold a local copy, with checksums.
• Data: the files behind the tables and charts are available on request to researchers, journalists and institutions, through the Qriton contact form.

About this report

Author: Qriton. Qriton develops software for detecting coordinated campaigns; the methods used here are close to that work. Comments and corrections are welcome at the contact address on qriton.com.

Data checksums

Version 26101202. The data files behind each table and chart, with their SHA-256, so they can be verified after a request:

The data files are not published for download. Researchers, journalists and institutions can request them through the Qriton contact form.