A Russian security researcher tested how many domestic websites would break if foreign service providers suddenly stopped serving Russian clients. The project examined 50 large Russian sites across banking, retail, telecom, aviation, delivery, online education and government sectors.
The motivation stems from real incidents such as Namecheap terminating services for Russian customers in 2022 and foreign certificate authorities revoking or refusing to renew certificates. Additional pressure comes from the March 2023 regulation requiring advance notification to Roskomnadzor for any cross-border transfer of personal data.
The researcher created an open-source browser-based scanner that checks main pages and key internal sections for foreign dependencies. Each detected dependency lowers the site’s score, resulting in a final grade from A to F.
Results showed the following distribution: 19 sites received A, 19 received B, 5 received C, 6 received D and 1 received F. Most infrastructure has moved to Russian servers, yet peripheral services remain exposed.
SSL certificates represent the largest single dependency. 43 of the 50 sites still use foreign certificates, most commonly GlobalSign (29 sites) and Let's Encrypt (12 sites). Only four sites employ the Russian NUC certificate issued by the Ministry of Digital Development. Because major browsers do not trust NUC by default, complete removal of foreign certificates is impractical; rapid replacement capability is the realistic goal.
Other common foreign elements include analytics platforms, font services and CAPTCHA solutions that transmit visitor IP addresses abroad. Many site owners installed these tools years ago and have not reassessed the resulting legal and operational exposure.
