We measured the path from a Moscow server to eighteen public addresses and broke time to first byte into its parts. Russian networks answer in 40–72 ms, foreign ones in 65–133.
So the east–west gap is real but amounts to a few tens of milliseconds rather than a multiple: the TLS handshake fits in 15–27 ms for everyone. Two outliers in the table were sharp, though — and neither is about the network.
Free online tool — IP geolocation lookup: instant results, no signup.
On 27 August 2026 we measured the path from our server (Moscow, Selectel network) to eighteen public addresses. Five attempts each; the table shows the best. Time to first byte is broken into its parts:
| Provider | Address | DNS | Connect | TLS | Time to first byte |
|---|---|---|---|---|---|
| Yandex | yastatic.net | 21 | 1 | 15 | 40 ms |
| Mail.ru | mail.ru | 18 | 2 | 18 | 46 ms |
| VK | sun9-1.userapi.com | 15 | 11 | 16 | 55 ms |
| VK | vk.com | 18 | 10 | 16 | 63 ms |
| fonts.gstatic.com | 19 | 13 | 18 | 65 ms | |
| Cloudflare | cloudflare.com | 19 | 14 | 19 | 71 ms |
| Selectel | selectel.ru | 18 | 0 | 15 | 71 ms |
| Yandex | yandex.ru | 17 | 8 | 16 | 72 ms |
| CloudFront | d1.awsstatic.com | 21 | 15 | 20 | 73 ms |
| DDoS-Guard | ddos-guard.net | 19 | 11 | 16 | 75 ms |
| storage.googleapis.com | 17 | 16 | 21 | 76 ms | |
| Fastly | www.fastly.com | 18 | 19 | 24 | 82 ms |
| Cloudflare | cdnjs.cloudflare.com | 21 | 20 | 26 | 133 ms |
| Akamai | www.akamai.com | 67 | 19 | 27 | 155 ms |
| Microsoft | azure.microsoft.com | 19 | 39 | 83 | 1,264 ms |
Russian addresses answer in 40–72 ms, foreign ones in 65–133. So the difference between a domestic and an international delivery network, seen from Moscow, is a few tens of milliseconds rather than a multiple.
The breakdown shows why: the TLS handshake fits in 15–27 ms for everyone, and connection setup in 0–20. The network path from Moscow to Cloudflare, Google and CloudFront nodes is short — these networks keep points of presence in or near the region, and traffic does not cross an ocean to reach them.
What this means for a site owner: choosing between a Russian and an international delivery network is not a choice between fast and slow. Thirty to sixty milliseconds on the first byte is visible in a measurement and near-invisible to a person. Decide on other grounds — support availability, payment methods, data residency requirements.
The one component where the spread is real is DNS: 15–21 ms for everyone, 67 for Akamai. That is a third of its total, and it is where its resolution visibly travels further than the rest.
Azure at 1,264 ms — and it is not the network. We repeated the measurement four times in succession: 2.2, 2.3, 3.2 and 3.3 seconds. Meanwhile DNS takes 28–68 ms, connection 67–100, the TLS handshake 152–170. We reach the server faster than most others, and it then thinks for two to three seconds before returning a redirect. The problem is in the application, not the link.
That distinction generalises: if TLS is fast and the first byte is slow, the link is not at fault — look at the server. We described the same technique in our response-time breakdown: the gap between ping and HTTP on one host separates network from application.
aws.amazon.com does not answer at all — code 000 on every attempt. Yet neighbouring addresses from the same provider work fine: d1.awsstatic.com returns its first byte in 73 ms, docs.aws.amazon.com in 124.
We could not establish the cause, and will not invent one. We tested the IPv6 hypothesis — the address publishes AAAA records and our server has no IPv6 — but a forced IPv4 request fails too. So that is not it. Of our fourteen addresses carrying AAAA records the other thirteen work without complaint, meaning the fallback to IPv4 generally behaves correctly.
To measure the path to your own server, use the route trace; for the response time breakdown, the header check.
IP geolocation identifies the location of a server, user, or traffic source. Essential for CDN configuration, GeoIP rules, and security anomaly analysis.
Country, region, city, postal code, and timezone by IP.
Provider, autonomous system name, and network range.
VPN, proxy, Tor, and hosting flags — protection against fraud and bots.
Save checks and compare IP geolocation across multiple lookups.
server IP check
threat origin ID
CDN node check
geo-block debugging
IP check history, API access and geolocation change monitoring.
Sign up freeYes. If < 100k visitors/mo — one CDN is enough. Multi-CDN setup complexity isn't justified.
Yes, but edge nodes are only in Russia. International users get latency through Russia backbone (not optimal).
CDN is always faster on cache hit. First request (cache miss) ≈ origin. Second+ — always faster on CDN.
Enterno HTTP checker measures TTFB from RU+EU+US in one click. Or ping for network layer.
Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.