London Economic: Did Yandex Strikes Silence Reform UK’s Bots?

Overview

On October 12, 2026, The London Economic published “Reform figures see social media engagement drop as bot accounts ‘fall silent.’“^[1] The article makes four distinct claims: that Ukrainian drone strikes “completely decimated Yandex”; that per Cloudflare Radar data cited by Tom’s Hardware, bot traffic from the Yandex network fell to 0.4% of its two-week peak; that “activity from automated, Russian-hosted accounts has been virtually eliminated on social media”; and that lower engagement on X posts by Reform UK figures Richard Tice, Zia Yusuf, and Nigel Farage on what the article calls “Monday, 11 October” constitutes evidence that the same bot silencing is happening in the UK.

The first two claims describe real events with some accuracy. The third makes a leap the evidence does not support. The fourth compounds the leap with flawed methodology and a factual error about the day of the week.

The article also cites Ukrainian President Volodymyr Zelenskyy, who said after the strikes: “When we started responding to Russia’s operation … it suddenly became a little easier to breathe on many social media platforms. There was less hate, less division and fewer provocations because there were fewer bots.”^[2] This is not a measurable claim — it is Zelenskyy’s characterisation of a situation his own government has an interest in framing favourably. Ukraine’s own Center for Countering Disinformation (CCD) subsequently reached a more cautious conclusion (see below).

The frame-lock in this article: the headline asks “did Russian bots go quiet?” The more precise question is: “What does a drop in automated HTTP requests from Yandex’s network tell us about covert influence operations that deliberately route through external proxies?” That question has a clear answer, and it differs sharply from the article’s conclusion.

The Strikes: What Actually Happened at Yandex

Three Ukrainian drone strikes hit Yandex data centres between October 8 and 11. The Sasovo facility in the Ryazan region, one of Yandex’s largest and housing two of the company’s three AI supercomputers, was struck overnight on October 7-8. Yandex confirmed that operations there were “fully suspended while emergency teams worked to contain the damage.”^[3] A second strike hit part of the Kaluga facility on October 9, disabling some infrastructure there. A third struck the Vladimir data centre on October 11; Yandex Cloud notified customers it had entered “emergency mode” and advised them to activate their own disaster-recovery plans.^[4]

This was a significant and sustained infrastructure attack. Yandex acknowledged that replacing damaged equipment could take approximately six months, citing components subject to Western export controls.^[5] Yandex shares fell more than 3.4% on the Moscow Exchange on October 8 alone. Other companies relying on Yandex Cloud, including Magnit and M.Video, reported disruptions.^[3]

What the article’s phrase “completely decimated” obscures: Yandex is not a single data centre. Core consumer services (search, maps, ride-hailing) remained partly operational through the first strike, with Downdetector logging over 1,300 user reports for cloud services specifically, not the broader consumer products.^[3] Some services had been partially restored by Monday, October 12. The infrastructure damage is serious; whether it amounts to “complete decimation” of a company that operates data centres outside Russia and whose non-cloud services continued is a stretch the facts do not warrant. Misleading — the strikes caused severe damage to three facilities, but the company was not completely disabled and recovery was under way.

The Cloudflare Number: What It Measures

The 0.4% figure is real. Cloudflare Radar tracks automated HTTP requests from every autonomous system (AS) to websites protected by Cloudflare’s network. After the third strike at Vladimir (approximately 00:30 UTC on October 11), Cloudflare’s own account on X posted that traffic from AS13238 (Yandex’s registered network) “fell 99% vs. last week.”^[6] Tom’s Hardware translated this to “0.4% of its two-week peak,” which is consistent with the Cloudflare data at the lowest point.^[7] Mostly True as a standalone number.

What the article does not explain, and what changes the claim’s meaning entirely, is what AS13238 traffic actually represents. Yandex operates one of the world’s largest web search engines. The automated traffic from its network to Cloudflare-protected sites is dominated by Yandex’s own search crawler, which continuously indexes public web pages for the Yandex search engine. Cloudflare’s own post-incident analysis found that 93.6% of AS13238 requests it scored were “Verified” bots, of which 78.1% were YandexBot, 11.5% YandexRenderResourcesBot, and 1.9% YandexImages — the Yandex search infrastructure, not social media automation.^[22] When Yandex’s data centres went offline, the crawler stopped sending requests to websites. That is what the Cloudflare chart shows.

Social media posts on X, TikTok, and Telegram are sent directly to those platforms’ own servers. They do not pass through Cloudflare-protected websites. A drop in Yandex crawler traffic to Cloudflare says nothing, by construction, about whether accounts on X or Telegram changed their posting behaviour. Hadi Ghanbari of Aalto University stated plainly: “a bot is any automated web request coming from a software program, not a fake social media account.”^[8] Renee DiResta of Georgetown University identified the same confusion: the word “bot” refers to both web crawlers and inauthentic social media accounts, and conflating the two drives the rest of the article’s argument.^[9]

Traffic from AS13238 had also partly recovered before the article was published. By 15:00 UTC on October 11, traffic had rebounded to approximately 17-19% of its two-week peak, suggesting either partial data centre restoration or traffic rerouting through alternative infrastructure.^[10] The article presents the 0.4% floor figure without noting this recovery.

Social Media and Influence Operations: The Evidence

The article’s central analytical leap, from Yandex crawler traffic to social media account activity, is not supported by any of the researchers who actually measured it.

Richard Schwenn of the German research group Polisphere monitored nearly 10,000 accounts on TikTok, Telegram, and X identified as associated with disinformation actors, AfD-affiliated networks, and pro-Russian sources. Using data collected with the Hasso Plattner Institute, Schwenn found “no statistically significant declines in activity in German-speaking regions” and “no comparable reduction in existing bot activity or new bot creation.”^[11]

Poland’s NASK monitoring centre tracked disinformation accounts between September 30 and October 11 and detected “no significant decrease in activity.” Only “isolated cases of individual accounts becoming inactive” were found, with no link established to the strikes.^[12]

Ukraine’s own Center for Countering Disinformation (CCD), which has the strongest institutional interest in the claim being true, released findings that were notably narrow. The CCD confirmed no evidence of a broad reduction in Russian bot-network activity. It reported a temporary, partial disruption: within identified clusters (specifically the Pravda, InfoDefense, and Nod of Time networks), posting volume in some clusters halved for approximately 12 hours before recovering.^[13] That is the most favourable evidence the article’s thesis has, and it describes a brief, partial, and already-recovered disruption in a handful of identified clusters, not a broad elimination.

Roman Osadchuk of LetsData Threat Intelligence said: “No reliable graph can consolidate bot and troll activity across multiple social media platforms without their internal data that measures telemetry, traffic, and behavior.”^[12] Valedmar Osted of Common Consultancy examined 76 AfD politicians and 136 MAGA accounts and found engagement variations of negative 8% to positive 10% — “ordinary day-to-day noise.”^[9] Vatnik Soup, a group monitoring Kremlin-backed disinformation, concluded: “There is no solid evidence that Russian bot farms have become inactive due to the Yandex data centre strikes.”^[9]

Mother Jones reported that following the strikes, a known Russian disinformation network called Matryoshka remained active — it had recently posted fake videos using Mother Jones’ own branding.^[9]

Why the structural argument doesn’t hold

Covert troll farm operations are specifically designed not to depend on domestic Russian infrastructure for their social media activity. Researchers Dave Troy and Hadi Ghanbari each noted that influence operations “disguise their accounts by routing them through internet connections in other countries, for example using commercial proxies or foreign servers,” and often “rely on crowdsourcing to spread their propaganda through a distributed network of users, who can post from anywhere around the world.”^[8] Disabling a Yandex data centre in Ryazan has no direct effect on an account posting from a rented European server or a compromised device in Germany.

The steelman: David Colon’s Storm-1516 observation

French researcher David Colon noted something worth taking seriously. A Storm-1516 fabricated narrative about French politician Raphaël Glucksmann, launched October 9, drew only tens of thousands of views in its first three days. A comparable Storm-1516 narrative launched on September 24 drew millions of views in the same span, measured from screenshots taken three days after each posting.^[14] Colon’s observation is interesting and deserves further investigation. It is, however, one before/after pair with no control for topic, virality, or audience. A single data point cannot establish causation, and it sits against the weight of systematic tracking studies cited above.

Taken together, the available evidence does not merely fail to support “virtually eliminated” — it actively contradicts it. Multiple independent teams tracked thousands of actual influence accounts and each found no significant decline. When Yandex Cloud went offline, Cloudflare documented that identified malicious bots migrated to alternative Russian hosting providers (Radist, Selectel) within hours, verified by matching TLS fingerprints, request paths, and User-Agent strings across the network change — they relocated, they did not cease.^[22] The most favourable primary source, Ukraine’s CCD, recorded a 12-hour partial disruption in specific named clusters before full recovery. That is not a failed search for evidence; it is positive counter-evidence. False — every research team that measured actual social media account activity found it continued at essentially normal levels; the claim’s premise that covert operations depend on Yandex network IPs is also wrong structurally.

The Reform UK Engagement Evidence

The article presents screenshots of posts by Richard Tice, Zia Yusuf, and Nigel Farage dated to what it calls “Monday, 11 October,” showing low engagement relative to screenshots of older posts by the same figures. The article attributes the low engagement to the disappearance of Russian bots. The evidence is not credible on several independent grounds.

The day is wrong. October 11, 2026 was a Sunday. The article’s screenshot filenames, visible in the published piece, are dated 2026-10-12, which was a Monday.^[1] Whether the article intended to label Sunday posts or Monday screenshots, it got the day-of-week wrong. This is not a dispositive objection on its own, but it illustrates the carelessness of the method.

The comparison is invalid. The article compares engagement counts measured “at the time of writing” or “after three hours” against prior posts showing full lifetime counts accumulated over days or weeks. A post three hours old will always have dramatically lower engagement than an identical post a week old. This is not evidence of any change in bot activity; it is arithmetic. No baseline was established for what early-stage engagement on these accounts typically looks like at the same elapsed time after posting.

No researcher measured Reform accounts. The article does not cite any disinformation researcher who examined Reform UK’s follower or engagement profile for bot activity. The article applies, by assertion, a finding about Yandex crawler traffic to accounts it has not tested. Tice has approximately 400,000 followers on X; Farage has 2.3 million. Low engagement on individual posts is a common feature of social media and requires no exotic explanation.

Topics differ. The screenshots compared are not controlled for subject matter. A post on a high-salience topic will routinely outperform one on a lower-salience topic regardless of any infrastructure change. No attempt is made to hold topic or expected organic reach constant.

There is also no established causal link between Yandex’s crawler traffic and engagement on any UK political figure’s posts. The article provides none. Misleading — the evidence presented does not support the inference drawn from it, and the method contains a basic flaw that would produce the same result on any day.

Background: What Is Known About Russian Information Operations

The absence of evidence for this specific claim does not mean Russian influence operations are absent or insignificant. The documentary record on Russian information operations is substantial, and the specific operations cited in this context are real and documented.

The U.S. Senate Intelligence Committee’s 2019 bipartisan report on the Internet Research Agency (IRA) found that Russia targeted both sides of the US political spectrum, with African Americans the largest single demographic focus. The IRA operated “Left Troll” and “Right Troll” account types simultaneously, often from the same computers.^[15]

A 2023 study by Eady et al. in Nature Communications examined actual exposure to IRA accounts during the 2016 election. The findings: exposure was concentrated in 1% of users who accounted for 70% of total exposures, concentrated among strong Republicans. The researchers found no measurable relationship between exposure to IRA content and changes in attitudes, political polarisation, or voting behaviour.^[16]

In Romania in November 2024, intelligence documents declassified by the outgoing president described over 800 coordinated TikTok accounts linked to external interests supporting far-right candidate Călin Georgescu. Romania’s Constitutional Court annulled the presidential election result in December 2024 — the first documented case of a democratic election annulled on grounds that included coordinated social media manipulation.^[17]

Storm-1516, a documented Russian disinformation operation, was active in the run-up to Germany’s February 2025 federal elections. It created deepfake videos and fake news sites to spread false claims about German politicians and parties. French intelligence service VIGINUM tracked at least 20 operations targeting candidates and electoral integrity.^[18] The article cites an AfD engagement chart attributed to Czech MEP Tomáš Zdechovský; that chart was criticised by Ilya Lozovsky of the Organised Crime and Corruption Reporting Project for containing “obvious errors.”^[19]

The London Economic article does not claim that these operations do not exist. Its claim is that they were “virtually eliminated” by infrastructure damage. That specific claim is what is unsupported.

Precedent

Compared against: the highest confirmed disruption to documented Russian influence-operation account activity measured before the Yandex strikes. Ukraine’s Center for Countering Disinformation reported posting volume in some identified clusters halved for approximately 12 hours before recovering — the most favourable documented case. Polisphere’s tracking of 10,000 accounts found no statistically significant decline. Poland’s NASK found only isolated individual account inactivity. The claim “virtually eliminated” has no precedent in the data: no researcher tracking actual social media accounts has recorded a broad, sustained elimination of Russian-attributed influence accounts at any point, including after the Yandex strikes.

What the Article Implies

Implied: The Cloudflare “bot traffic” metric counts social media influence accounts. False. Cloudflare Radar’s bot traffic figure for AS13238 counts automated HTTP requests from Yandex’s registered IP ranges to Cloudflare-protected websites. This is dominated by Yandex’s own search crawler. Social media posts are sent to X’s, TikTok’s, and Telegram’s own servers and do not appear in this data. The metric does not count posts, accounts, or any social media activity.^[6][8]

Implied: Reform UK’s social media engagement depends to a material degree on automated Russian-hosted accounts.

Unrated. No researcher has measured the proportion of engagement on Reform UK accounts attributable to any category of bot activity, Russian or otherwise. The article does not cite one. This is a voting-relevant inference (asserting that a political party’s apparent popularity is substantially bot-generated) that no source reviewed here can settle. It is not rated because it is not checkable with available evidence, not because it is unlikely to be wrong.

Implied: Ukraine’s strikes have materially degraded Russia’s capacity for social media influence operations. Unproven. Every independent research team that measured social media account activity after the strikes found no significant degradation. The CCD’s own finding — 12-hour partial disruption in some clusters, then recovery — is not consistent with material degradation. The longer-term effect on Russia’s AI development capacity (a distinct question from influence operations) is plausible but not yet measurable.^[11][12][13]

What This Finding Changes

The Yandex strikes represent a serious military action against Russia’s civilian digital infrastructure. Their real significance — damage to AI model training capacity, disruption to cloud services for thousands of Russian businesses, a months-long equipment replacement problem — is considerable and does not require embellishment.

The bot narrative adds nothing to that genuine significance and introduces a specific risk. If researchers, policymakers, and the public believe that a single infrastructure attack has “virtually eliminated” Russian social media operations, they are less likely to fund and attend to the unglamorous work of tracking actual influence accounts, which continued unabated. Dave Troy, a disinformation researcher, put the risk precisely: “The threat lies elsewhere and must still be assessed and fought.”^[12]

The article’s treatment of Reform UK engagement is a separate concern. Attributing a political party’s social media metrics to Russian bot activity, without any measurement of those accounts and against the weight of the evidence, is a claim about electoral legitimacy. The verdict here is about the article’s evidence, not about whether Russian operations target UK politics (there is documented evidence they do, in general terms). The leap from “Yandex crawler is down” to “Reform UK’s engagement is bot-inflated” skips several layers of evidence that do not exist.

What to Watch

• Yandex infrastructure recovery — 6-month equipment horizon Kommersant sources cited a six-month estimate for replacing damaged server equipment subject to export restrictions. Whether Yandex manages to restore full capacity, and through what means, will determine whether the infrastructure damage has lasting operational effects on Russia’s AI and cloud sector.
• Systematic post-strike research on social media accounts The data collected in the days immediately after the strikes is preliminary. More rigorous longitudinal studies covering a longer window before and after the attacks could either strengthen or finally rule out any disruption to influence account activity. Polisphere and the Hasso Plattner Institute have the monitoring infrastructure to produce this. Watch for peer-reviewed results.
• Storm-1516 activity in the 2026 UK midterm environment VIGINUM’s documentation of Storm-1516 operations during the German 2025 elections establishes a precedent for targeting European electoral cycles. Whether similar operations are documented in the UK context — and whether Yandex’s infrastructure damage has any measurable effect on them — is the right question the article was trying to ask.

Parties Affected