Ukrainian Internet address Space Falls Into Shadowy Hands

Since the onset of the Russian invasion in February 2022, nearly one-fifth of Ukraine’s Internet address space has either fallen under Russian control or been sold off to Internet address brokers. A recent study reveals that important portions of these Ukrainian IP addresses are now controlled by proxy and anonymity services, some of which are hosted by major U.S. Internet service providers (ISPs).

The Exodus of Ukrainian IPv4 Addresses

A report by kentik, a network performance monitoring company, examined the impact of the Russian invasion on Ukraine’s supply of Internet Protocol Version 4 (IPv4) addresses. The research indicates that while most ukrainian ISPs have maintained their infrastructure, some have been forced to sell their valuable IPv4 address space to stay afloat.

As an example, Ukrtelecom, a major Ukrainian ISP, now routes only 29% of the IPv4 address ranges it controlled at the start of the war. The company stated that selling address blocks was necessary “to secure financial stability and continue delivering essential services.”

Did You know? The value of IPv4 addresses has surged in recent years due to their scarcity, with some blocks fetching millions of dollars on the open market.

distribution Among Global Providers

Much of the IPv4 space previously allocated to ukrtelecom has been distributed among more than 100 providers globally, notably at three large American ISPs: Amazon, AT&T, and Cogent.

Similarly, LVS, another Ukrainian Internet provider, saw its IPv4 address space parceled out to over a dozen different locations, with a significant portion being routed by AT&T. Tvcom, another Ukrainian ISP, has also seen a reduction in its IPv4 address space, with most of those addresses now scattered across 37 networks outside of Eastern Europe, including Amazon, AT&T, and Microsoft.

Trinity, a Ukrainian ISP that went offline during the siege of Mariupol, had its address space reappear in more than 50 different networks worldwide, with over 1,000 IPv4 addresses showing up on AT&T’s network.

The Rise of Proxy Services

According to Spur.us, a company that tracks VPN and proxy services, many of the address ranges identified by Kentik now map to commercial proxy services. These services allow users to anonymously route their Internet traffic through rented IP addresses, masking their true location.

While proxy services have legitimate buisness uses, such as price comparisons and web scraping, they are also frequently abused to hide cybercrime activity, making it difficult to trace malicious traffic to its source. According to a 2023 report by Cybersecurity ventures, cybercrime is projected to cost the world $10.5 trillion annually by 2025, highlighting the growing need for robust security measures Cybersecurity Ventures.

Pro Tip: When evaluating a VPN or proxy service, prioritize providers with transparent privacy policies and a proven track record of security.

AT&T’s Policy Change

AT&T has recently changed its policy regarding the routing of network blocks not owned and managed by the company. The new policy, outlined in a February 2025 update to its terms of service, requires customers to originate their own IP space from their own autonomous system number (ASN) by September 1, 2025.

An AT&T spokesperson stated that this change aims to ensure customers receive the best quality of service. Though, this policy shift may force many proxy services to migrate to other U.S. providers with less stringent policies.

Riley Kilmer, CTO of Spur, noted that AT&T is the first major ISP to take action on this issue. He anticipates that many services selling AT&T IP addresses will need to find alternative solutions by September.

Cogent’s Role

Kentik’s report also identified former Ukrainian IP ranges being routed by Cogent Communications, a tier-one Internet backbone provider. Kilmer suggests that Cogent has become an attractive option for proxy services due to the relative ease of getting address blocks routed through their network.

Cogent declined to comment on Kentik’s findings.

What steps should ISPs take to prevent the misuse of IP addresses by proxy services?

How can individuals protect themselves from cyber threats originating from anonymized IP addresses?

disclaimer: This article provides general information and should not be considered legal or financial advice. Consult with a qualified professional for specific guidance.

Share your thoughts in the comments below and subscribe for more updates on cybersecurity and Internet governance!