YandexUserproxy

Its full user-agent string, exactly as it arrives at the gate:

To check a visitor really is YandexUserproxy, run a reverse DNS lookup on its IP address and confirm the hostname ends in .yandex.ru, .yandex.net, .yandex.com. Then run a forward lookup on that hostname and check it returns the same IP. Anything that fails is an impostor; the zoo checks every visit this way and files the failures in the Trap Room. Read Yandex's documentation.

YandexUserproxy does not read robots.txt, so a polite sign is wasted on it. Refuse it at your web server or firewall instead. User agents are easy to fake, so pair this with rate limiting.

# robots.txt will not stop YandexUserproxy. Block it at the server.
# nginx
if ($http_user_agent ~* "YandexUserproxy") {
    return 403;
}

The same thing on Apache:

# Apache (.htaccess)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} YandexUserproxy [NC]
RewriteRule .* - [F,L]

Requests that use YandexUserproxy's name but fail Yandex's network check are filed separately, as impostors. These are the visits that passed, or that could not be checked at the time:

Networks and countries come from the visitor's IP address, looked up in a local copy of the DB-IP database. The addresses themselves are never stored.