Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks

An independent researcher ran an automated security scanner across 284 major Russian domains belonging to banks, retailers, universities, clinics, developers and government agencies. The tool checked email authentication, outdated JavaScript libraries, abandoned subdomains, transport security headers and cross-border data transfers.

DMARC records were readable for 275 domains. Of these, 66 (24 %) had either no record or the policy value p=none, allowing spoofed messages to land in recipients’ inboxes. Another 108 domains used p=quarantine, sending fakes to spam, while only 101 enforced p=reject. Forty-two domains protected the apex domain but left subdomains open with the sp=none setting.

Pages could be fetched from 170 sites. Twenty-four percent of them included old versions of libraries with known vulnerabilities, most commonly jQuery 1.10, 1.11, 1.12 and 2.2 released between 2013 and 2016. Eleven sites also contained Google API keys left in client-side code, although the scanner correctly classified them as non-issues because the keys are intended to be public.

Five dangling subdomains were discovered. Four pointed to unused AWS and DigitalOcean endpoints; the fifth resolved to a cloud storage bucket belonging to a financial company. An attacker who registers the same bucket name could serve phishing pages under the legitimate company domain.

Transport security was weak on many hosts: 57 % lacked HSTS, 31 % still accepted the deprecated TLS 1.0 and 1.1 protocols, and only two sites had a properly configured CSP header. Twelve certificates were due to expire within two weeks.

Visitor data left the browser immediately on page load. Fifty-one percent of sites sent IP addresses and cookies to foreign services, predominantly Google Analytics. Thirty-one percent of privacy policies contradicted actual tracker usage, stating that no cross-border transfers occur while the scanner observed Google Analytics, Meta Pixel and other foreign pixels.

Government domains fared no better: ten of 18 could be spoofed via weak or absent DMARC, none had an effective CSP, and half lacked HSTS. Only one government site used Google Analytics.

The researcher published the scanner as open-source software under the AGPL license. It performs more than one thousand standardized checks against RFCs, OWASP guidance and Russian Federal Law 152-FZ, producing reports in HTML, PDF, Word and SARIF formats suitable for CI pipelines.