Yandex outage and Russian bot farms: the measurements

Companion to the editorial. Every figure here is the desk’s own pull or count from 15 October 2026, with the request and the SHA-256 of each raw Cloudflare Radar response.

Cloudflare Radar: Yandex network volume and bot share by day

AS13238 is Yandex’s main network and AS200350 is Yandex.Cloud. Volume is Radar’s HTTP request series, normalized to each series’ maximum in the window. Bot share is the share of requests Radar classes as automated. Radar’s outage annotation 1684 (start 2026-10-07 22:30 UTC, cause MILITARY_ACTION, ASNs 13238 and 200350) names the Sasovo and Vladimir closures.

Hourly, 7 to 12 October (every third hour)

Hourly, 1 and 2 October: the earlier dip

AS13238 fell at 05:00 UTC on 1 October and recovered at 07:00 UTC on 2 October. Radar carries no outage entry for it and the desk did not find a cause.

Top networks by automated requests from Russia

Before: 2026-09-24 to 2026-10-07. After: 2026-10-11 12:00 UTC to 2026-10-14 23:59 UTC. Top 15 each. The arithmetic in the editorial (49.3 percent to about 47.3 if only Yandex’s share fell) assumes nothing else changed.

Before

After

Hosting check: 100 names from four pre-registered lists

Frame A: names in the FBI affidavit of 4 September 2024 (Doppelganger). Frame B: Pravda network. Frame C: CopyCop / Storm-1516. Frame D: Russian state media. Lookups at 2026-10-15T03:00:17Z. SERVFAIL on both resolvers is the usual signature of a registry hold; the desk did not investigate each one. Cloudflare-fronted rows hide the origin server.

Trump Truth Social posts, before and after

Source: the public CNN archive, Eastern-time days. The baseline is the 100 days before 8 October. This measures one account and the engagement on its posts.

Posts per Eastern day, 1 to 14 October

Bluesky phrase counts

Posts per UTC day containing the exact phrase, from the public AppView search with no login. Counts only where the first page of results was not followed by more; high-volume phrases cannot be counted because the endpoint refuses deeper pages. “n/a” marks a day the endpoint refused. The pre-registered controls (“good morning”, “football”) could not be counted; “kayak” was added after that as a low-volume control.

Pre-registration

# PREREG: Yandex outage and Russian influence operations (written 2026-10-15 UTC, before any domain was resolved and before any Bluesky count)

## Check A: were known influence-operation properties hosted on struck infrastructure?
Frames (every name listed, no sub-sampling):
- A: all 32 domains named as seizure subjects in the Attachments A-1 to A-9 of the FBI affidavit published by the US Justice Department on 2024-09-04 (Doppelganger / Social Design Agency). frameA.txt
- B: the 36 pravda-XX.com language-portal domains in the table of VIGINUM Part 3 (April 2024), plus news-pravda.com (named by DFRLab, Feb 2025) and pravda-us.online (named by FDD, Dec 2024). frameB.txt. The VIGINUM PDF could not be fetched from the DGX (connection reset by the host); the table was read through Firecrawl search output on 2026-10-15.
- C: 22 domains named in the text of the Recorded Future Insikt CopyCop report of September 2025 and the FDD December 2024 report (Storm-1516 / CopyCop). frameC.txt
- D: eight fixed Russian state-media domains. frameD.txt
For each name: A and AAAA records from a public resolver (8.8.8.8), NS records, MX records; origin ASN of each address via Team Cymru DNS; a direct HTTP GET now (15 s timeout, no proxies, no evasion; a block page counts as a block, not as up). Question answered: does any address, nameserver or mail host sit in a Yandex ASN (13238, 200350, 210656, 215013, 44534, 215109, 207207)? Sites fronted by Cloudflare (AS13335) hide their origin; they are reported as origin-hidden, not as not-Yandex. Seized domains are expected to resolve to seizure servers or not at all, which cannot show where they were hosted before; they are reported as such. Public uptime evidence for Oct 8-11 is attempted through the archive.org availability API (timestamp 20261009) with a limit of one request per two seconds; if it rate-limits, that is stated.

## Check C: Bluesky keyword counts, public AppView only
Endpoint: https://api.bsky.app/xrpc/app.bsky.feed.searchPosts, no login, no cookies. Windows in UTC days: before = 2026-09-24 to 2026-10-07 (14 days), after = 2026-10-08 to 2026-10-14 (7 days). Terms, exact phrases, fixed now: "zelensky must go", "zelensky dictator", "stop funding ukraine", "nato provoked", "proxy war", "ukraine corruption", "biolabs", "denazification". Controls: "good morning", "football". Count of posts per UTC day per term, paging up to 20 pages of 100 per day-term; a day-term that hits the cap is marked capped. The test: ratio of the mean daily count after to the mean before, per term, next to the same ratio for the controls. A reading counts as a drop only if a term falls by more than the controls move and by more than its own day-to-day range before Oct 8. Limits stated in advance: Bluesky is not where Russian operations concentrate; search is capped and not a census; keyword counts measure talk, not accounts.

abffaa52c198a25b0f6ab9509730514990ccade00f0cdf50ed3cf242042c9335  PREREG.md
c734d1299c279d480c0aa8193ac8b0d627b8050d262afc2ab2d0cc830bf28f55  frameA.txt
57b5de02273abcba9b2d8fb288104e7cf911be60f8ab3e19982b984551dd772f  frameB.txt
e5a868a1ed1b0c42ac956998a0a5895ba1bdc3fea1822455e097ab807138ede5  frameC.txt
09de811c89037bbaed35010cb84813d772f0f714d990e4896807e156cc502aea  frameD.txt

Receipts: every Cloudflare Radar response