> it was roskomnadzor carpet-blocking whole IP ranges of cloud providers.

Oh yeah, forgot about it. RKN block is usually an SSL error, a timeout, or a page from your ISP saying "this is blocked by the government, sorry". Never a 403.

Thankfully, smaller ISPs are terrifically terrible at complying with this.