Drone strikes on Yandex.Cloud, seen through public internet data

I wanted to see whether the recent Ukrainian 🇺🇦 drone strikes on Russian data centers (October 8, 9 and 11) would be observable from the outside, using only public internet measurement data.

I focused on Yandex.Cloud (AS200350), whose Sasovo, Kaluga and Vladimir sites were reported hit, and looked at two open, non-commercial sources:

🔹 RIPEstat (RIPE NCC): every BGP routing update for Yandex.Cloud's address blocks
🔹 IODA (Georgia Tech): how many of those address blocks still answer active probes, every 10 minutes

Here's what the data shows (video above):

🔹 Yandex.Cloud's reachability dropped in two sharp steps, overnight into the Sasovo and Vladimir strike days: from ~519 to ~340, then ~112 responding /24 blocks, with no recovery as of October 16.
🔹 The routes never went away: all 858 /24 blocks stayed announced in BGP throughout, so the machines went silent while the network still claimed the addresses.
🔹 BGP churn rose about 40x between October 7 and 12, but it started about 17 hours before the first drop, which I don't have an explanation for (yet).

Caveat: this is routing and reachability, not traffic volume. AFAIK traffic data (byte counts in and out of a network) isn't available without reaching out to commercial data providers.

Let me know if you have any questions or ideas to expand this simple experiment 🙃

Sources for the strike dates: Moscow Times, CNBC, The Register, Bloomberg.