The IP was a new one on me; looks like 18.104.22.168/19 belongs to Yandex. The other one is the human, in one of those newly settled RIPE regions. Came through as Russia, as it should.
In logs it's pretty much the same pattern as google translate: Page request comes from search engine IP, blank referer, "Translate" at end of human UA. (For Russia I am fully prepared to believe Opera 9.80. Heck, I've met humans from northern Canada using every edition of Firefox back to 3.0.) All subsidiary pages come from the human IP and UA, with "translate" as part of the referer.
:: now back to irritable grumbling because G### Preview started running from 66.249 some time last month when I wasn't paying attention, and this appears to have some connection with all those referer-less iPad image hits ::
I blocked 22.214.171.124/17 (VECTRANET Broadband Poland), 126.96.36.199/23 (Bergdorf Group NL – BVI) and 188.8.131.52/23 (IzydorSymanski-net StP RU) as undesirables but not because of Yandex Translate. I posted the information due to a similar and unusual UA on a variety of WP login attempts.