Let’s be honest: the story sounded amazing. Ukrainian drones flew deep into Russian territory and struck a major Yandex data center, and almost right away, a sharp line on Cloudflare’s charts showed automated traffic from Yandex’s network plummeting. Within hours, social media was buzzing with a very tempting conclusion: Ukrainian bombs had just crippled the Russian troll farms. Some personalities online claimed this was proof that Kremlin-backed disinformation networks were paralyzed. Some users said they had personally seen fewer suspicious posts on X, Facebook, and other social networks. Politicians and historians began speculating that the impact could be felt in German politics and even in the U.S. midterm elections. A few noted what they called bizarre coincidences between the timing of the drone strikes and a sudden drop in online activity around the far-right AfD party in Germany. The plot was irresistible: a hero in the form of drone warfare, a villain in the form of Russia’s propaganda machine, and a happy ending for democracy. But the story, however beautiful, is almost certainly false. The chart that went viral was not a map of Russian influence operations. It was a measure of ordinary web crawling. And the people who study Russia’s actual troll farms say the attack, while real, did not do what the internet hoped it did. In fact, the viral interpretation is a textbook case of confusing one kind of bot with another.
Let’s start with the concrete facts. Yandex is often described as Russia’s Google. It runs search, maps, email, cloud services, self-driving technology, and countless other digital services that millions of Russians rely on every day. It also operates a network of data centers across the country, and Ukrainian drones have now damaged three of them. Yandex has reported that the facilities in Sasovo and Vladimir were shut down completely, and that some equipment in Kaluga was left unusable. These hits were not accidental; they were a deliberate response to Moscow’s ongoing strikes against Ukrainian data centers. Ukrainian President Volodymyr Zelensky acknowledged as much after the Sasovo attack in early October. “You all know, they have been hitting and continue to hit our data centers. We are responding. I can’t share all the details,” he said. The military impact was real. But the digital effect that captured the internet’s imagination came from a Cloudflare Radar chart showing requests from AS13238, the autonomous system operated by Yandex. Automated traffic from that network dropped sharply. For those looking for evidence that Russian disinformation had been hit, that was enough. Tomáš Zdechovský, a member of the European Parliament, wrote: “If confirmed, this is telling: Russian data centers get hit, and online activity around AfD suddenly plummets.” Historian Timothy Snyder also weighed in: “Well, it’s a quick take, and no doubt data will come in, but it sure looks like, based on today’s evidence, that a lot of pro-Trump and pro-AfD bot work depends directly on Russian data centers.”
But the problem is that Cloudflare’s chart does not measure what those commentators thought it measured. Cloudflare Radar does not watch social media conversations. It measures HTTP requests sent from a particular network to websites around the world. When people talk about “bot traffic” on Cloudflare, they are talking about automated programs that request data from websites. Search engine crawlers are a perfect example: they automatically visit pages, read their content, and update indexes. That is exactly what a large portion of Yandex’s automated traffic was doing. The term “autonomous system” simply refers to the underlying network infrastructure—AS13238 belongs to Yandex and carries many types of traffic. Cloudflare’s system estimates whether a request is human or automated by assigning a bot score between 1 and 29 for likely automated traffic and 30 or higher for likely human traffic. A drop in that score means fewer automated requests from Yandex’s network. It does not mean fewer posts on X or Facebook. It does not tell you anything about political propaganda, about who funded the traffic, or about whether the traffic was related to a Kremlin influence operation. As the researcher account @antibot4navalny, which has spent years tracking Russian troll farms, explained, “The Cloudflare chart has nothing to do with social media. Cloudflare measures automated requests to websites (of any kind, among which social media share is negligible).” The account also pointed out that Yandex’s bot traffic began recovering on Sunday. It was not a permanent shutdown. It was a temporary dip in search engine crawling.
Part of the confusion comes from the word “bot.” In technical language, a bot is simply an automated program. It can be useful, like a search engine crawler, or malicious, like a network of fake social media accounts. The bots that Yandex lost when its data centers went down were almost certainly useful, mundane programs. They were not political agitators. There is no reason to assume that all automated traffic is part of a disinformation campaign, and there is no evidence that the specific traffic that vanished was in any way political. Meanwhile, the actual Russian influence operations that we know about operate very differently. They do not run through large, easily identifiable Russian corporate networks. Since 2022, when Russia invaded Ukraine, major platforms such as Reddit and Facebook have generally blocked traffic from known Russian data centers. That forced Russian troll farms to become far more covert. Today, they tend to rely on residential proxy networks, compromised Internet-of-Things devices, commercial VPNs, and Western cloud hosting providers. They disguise their IP addresses and try to look like ordinary local users in the countries they are targeting. This is not speculation; it is the standard operating procedure of modern influence operations. A single drone strike on a Yandex data center might inconvenience a search engine, but it would not shut down a well-designed troll network.
This is why disinformation researchers are now calling the viral narrative a hoax. Not necessarily a single person’s lie, but a collective failure to question a pleasing story. The idea that Ukrainian drones shredded Russian bot networks and saved Western democracy in one stroke is the kind of story that feels too good to check. But that is exactly the problem. Caroline Orr Bueno, a behavioral scientist who specializes in disinformation, put it bluntly: “It sucks to see so many pro-Ukraine accounts spreading disinformation and pretending it’s ok just because it’s an anti-Russia/pro-Ukraine narrative. If you want to defend democracy, you have to be willing to reject disinformation even when it’s telling a story that you want to hear.” That is an uncomfortable message for many people. It is much easier to share a dramatic graph and feel that you are part of the resistance. But in the long run, false narratives harm the very cause they claim to support. They give Russian propagandists ammunition. They distract from the real work of investigating and exposing influence operations. They also encourage a false sense of security: if we believe the trolls are dead, we may stop looking for them. The reality is that Russian disinformation efforts are probably still running, still adapting, and still using proxies that make them invisible to simple Cloudflare charts.
So what is the actual takeaway? The drone strikes were real. The damage to Yandex data centers was real. The temporary drop in automated web traffic was real. But the leap from that evidence to the death of Russian disinformation is not just unproven; it is almost certainly wrong. The troll farms did not disappear because they were never sitting in those server rooms. The people who claim otherwise are either mistaken or, at worst, deliberately pushing a false story. We want to believe that there is an easy answer, that a military strike can solve the problem of foreign interference. The truth is more complicated and more demanding. It requires us to look past viral charts and ask questions. What is actually being measured? Who is making the claim? Does the evidence support the conclusion? That kind of critical thinking is the real defense against disinformation. It is not as exciting as a story about Ukrainian drones taking down Russian bots, but it is the only thing that actually works. As Orr Bueno said, we have to be willing to reject a story we want to hear. That is a hard lesson, especially in a time of war and polarization. But it is the only way to protect the truth, and perhaps the only way to truly defend democracy.