On this page
Three Yandex data centers in Russia were hit in drone strikes between October 7 and 11: Sasovo, then Kaluga, then Vladimir. Yandex said the Vladimir data center "has been completely shut down", and it reported power supply disruptions in Yandex Cloud's ru-central1-a zone, which sits in Vladimir, at about 04:00 local time on October 11, 01:00 UTC (Ukrainska Pravda).
Cloudflare measured the traffic: requests from Yandex Cloud's network fell 90% below baseline on October 11, and the bot traffic it had sent to one gambling site, with the same TLS fingerprint and user agents, started arriving from other Russian hosting networks, Selectel among them.
That's requests. We counted the servers. SSH IP holds every host that completed an SSH handshake on TCP port 22, with its host key's fingerprint. Our SSH scans of the IPv4 internet ran on September 26 to 29, before the strikes, and on October 9 to 13, across the Vladimir one.
62% of Yandex Cloud's SSH hosts stopped answering
| Network | SSH hosts, Sep 26-29 | Oct 9-13 | Change |
|---|---|---|---|
| Yandex Cloud | 62,954 | 23,760 | -62.3% |
| Selectel | 66,494 | 58,382 | -12.2% |
| Other Russian hosting | 565,784 | 523,869 | -7.4% |
| Hosting outside Russia | 12,648,226 | 12,066,914 | -4.6% |
Yandex Cloud is the three networks registered to Yandex.Cloud LLC, AS200350, AS210656 and AS215013. Selectel is AS49505, AS50340 and AS61976.
When each block went dark
Most Yandex Cloud ranges were still answering on October 13, the scan's last day, as was every Selectel range with more than 13 hosts. These Yandex Cloud ranges, each with 35 or more hosts in September, weren't:
| Yandex Cloud range | SSH hosts, Sep 26-29 | Oct 9-13 | Last answer, UTC |
|---|---|---|---|
| 62.84.112.0/20 | 1,554 | 447 | Oct 11, 01:42 |
| 46.21.244.0/22 | 395 | 172 | Oct 11, 01:46 |
| 37.230.168.0/23 and 37.230.172.0/22 | 288 | 15 | Oct 11, 01:20 |
| 217.28.224.0/20 | 67 | 16 | Oct 11, 00:23 |
| 193.32.216.0/22 | 35 | 11 | Oct 10, 23:56 |
| 213.165.192.0/19 | 512 | 12 | Oct 10, 22:14 |
| 46.243.209.0/24 and 46.243.210.0/23 | 248 | 1 | Oct 10, 02:24 |
| 89.232.188.0/23 | 125 | 0 | none in October |
Three of them gave their last answers between 01:20 and 01:46 UTC on October 11, and none in the 57 hours of scanning after, which ended at 11:00 UTC on October 13. The ranges that stayed up did so at fewer hosts: 158.160.0.0/16 went from 21,076 to 10,451, and 51.250.0.0/17 from 10,529 to 3,442.
The servers didn't move
A host key stays with its server. Move a machine to another address, or restore it from a backup, and it answers with the same key. So we followed every Yandex Cloud and Selectel host whose key was held by one address in each scan. A key shared by many addresses can't be followed that way.
| Where September's hosts were in October | Yandex Cloud | Selectel |
|---|---|---|
| Same address | 19,942 | 49,196 |
| Another address, same network | 251 | 22 |
| Another network | 3 | 7 |
| Key now on several addresses | 11 | 22 |
| Not seen anywhere | 41,313 | 11,794 |
| Hosts followed | 61,520 | 61,041 |
67.2% of Yandex Cloud's hosts weren't seen anywhere in October, against 19.3% of Selectel's. 3 turned up on another network. The servers went dark where they stood, so whatever moved, like the bot traffic Cloudflare followed, moved onto machines with new keys.
What it means for blocking
- A list of Yandex Cloud addresses from September is now mostly addresses with nothing behind them, and holds none of the addresses the moved workloads use.
- A rule on Yandex Cloud's networks stopped matching those workloads the day they moved.
- The kind of network didn't change. Every Yandex Cloud SSH host in both scans is in Hosting IP at
highconfidence, and so are 99.2% of Selectel's October hosts. In the other Russian hosting networks, 99.9% of October's SSH hosts are in Hosting IP, 86.0% athigh(Hosting IP of October 21). A workload that left Yandex Cloud for another Russian host is on hosting space either way.
Checking it in the file
SSH IP's last_seen is the last day a host's port 22 was seen open, so the October 17 build shows the drop on its own. We joined its 23,688,209 rows to IP ASN of October 13 and counted the hosts seen on or after October 11:
| Network | Rows | last_seen on or after Oct 11 |
|---|---|---|
| Yandex Cloud | 80,469 | 19.3% |
| Selectel | 79,136 | 73.8% |
| Other Russian hosting | 673,711 | 73.0% |
| Hosting outside Russia | 16,611,319 | 62.9% |
The file covers 90 days, so it holds more hosts than any one scan.
How we counted
A host is an IPv4 address that completed an SSH handshake on port 22. Each address is matched to the network that announces it with IP ASN of October 13. "Hosting" and "Russian" are that network's type and country in our free ASN database. Following by key uses host_key_fp, and only keys held by one address in a scan.
Getting access
SSH IP is a weekly gzipped CSV, and IP ASN is free. To license SSH IP or Hosting IP, see pricing or talk to us.
