Ukrainian Internet Space ⁢Falls Under Russian Control, Sold to Brokers

Updated June 06, 2025
⁢

As the start ⁢of the conflict in February ‍2022, nearly 20% of Ukraine’s Internet ⁤address space has either fallen under Russian control or been sold off to Internet address brokers, according to ⁤a new study. The analysis reveals ⁣that significant portions of Ukrainian Internet Protocol Version 4 (IPv4) addresses are now managed by proxy and anonymity services,often hosted by major U.S.Internet service providers (isps).

The report by Centic,⁣ an ‍Internet network performance measurement ‍firm, ⁤examined‍ the war’s impact on Ukraine’s IPv4 address supply. While most Ukrainian ISPs have maintained their infrastructure, some have⁤ sold off valuable IPv4 address space to stay afloat.

As a notable example, ⁤UKRTECOM, a major Ukrainian ISP, now routes only 29%⁣ of the IPv4 address ranges it controlled at the war’s outset, according to Centic’s ⁢doug Madory. Ukrtelecom said it sold many address blocks to ensure financial stability and maintain essential services.

Much of the IPv4 space previously allocated to Ukrtelecom is now distributed across more than 100 providers globally, particularly at Amazon, AT&T,‍ and Cogent, Madory found.

Similarly, LVS, another Ukrainian ISP, saw its IPv4 address⁢ space parceled out to over a dozen locations by November 2022, with a significant portion being routed by AT&T.

Tvcom, another Ukrainian ISP, routes nearly 15,000 fewer IPv4 addresses than at the start of the war. Most of these addresses have been scattered to 37 other networks outside of Eastern Europe, including amazon, AT&T, and Microsoft, Madory⁤ said.

Trinity,a Ukrainian ISP that went offline during the siege of Mariupol,saw its address space appear in more than 50 different networks worldwide,with over 1,000 IPv4 addresses appearing on AT&T’s network.

According to spur.us, which tracks VPN and proxy services, nearly all the address ranges ⁤identified by Kentik now map to commercial proxy services. These services allow ⁤users to anonymously route their Internet traffic through other computers.

While proxy services have legitimate uses, they are also frequently exploited to conceal cybercrime activity, making it challenging ⁤to trace malicious traffic.

IPv4 addresses are valuable,⁤ and IPv4⁤ brokers pay ISPs to lease unused address space. Madory said these brokers pay $100-$500 monthly to lease a block of 256 IPv4 addresses, ‍with‍ proxy and VPN providers frequently enough being the most willing to pay.

A review of Internet address blocks routed through AT&T‍ shows a high number of networks originating outside the United States,including Ukraine,Hungary,and Lithuania,according to Hurricane Electric.

AT&T said it recently changed its policy regarding originating routes for network ⁢blocks not owned and⁣ managed by the company. customers have until Sept. 1, 2025, to originate their own IP space from their own autonomous system number (ASN), according to a ⁤February 2025 update to AT&T’s terms of service.

“To ensure our customers recieve the best quality of service, we changed our terms for dedicated internet in February 2025,” an AT&T spokesperson said. “We no longer permit static routes with IP addresses that we have not provided. We have been in⁤ the process of identifying and notifying ⁤affected customers that⁤ they have‍ 90‍ days to transition to Border Gateway Protocol routing using their own autonomous system number.”

The co-mingling of Ukrainian IP address space with proxy providers has resulted in some addresses being used in cyberattacks against Ukraine. The European Union recently sanctioned Stark Industries Solutions Inc., an ISP linked to Russian state-sponsored hacking groups.

Spur’s Chief Technology Officer riley Kilmer said AT&T’s policy change will likely force many proxy services to migrate to other U.S. providers with less stringent policies.

“AT&T is the frist one of the big ISPs that seems to be actually doing something about this,” Kilmer said. “We track several services that explicitly sell AT&T IP addresses, and it ⁢will be ⁣very engaging to see what happens ⁣to those services come september.”

kilmer added that other large U.S. ISPs continue to facilitate⁤ proxy services by allowing them to host IP addresses in ranges that appear to be residential ‍customers. He noted that Cogent Communications has⁢ become an attractive home base ⁣for‍ proxy services because ⁤it ‍is relatively easy to ⁤get an address block routed there.

“In fairness, they transit a lot of traffic,”‍ Kilmer said of Cogent. “But there’s a reason a lot ⁢of this⁢ proxy stuff shows up as Cogent: Because it’s super easy to get something routed there.”

Cogent declined to comment.

What’s next

The migration ⁤of proxy services to other ISPs could shift the landscape of Internet traffic and potentially impact cybersecurity efforts. The long-term effects of Ukraine’s IPv4 address sales⁤ remain to be seen, but the current situation highlights the challenges faced by ISPs in conflict zones.