“`html

Since February 2022, Ukraine has witnessed approximately one-fifth of its Internet domain come under Russian dominance or sold to Internet address brokers, according to a recent study. The assessment reveals that significant portions of Ukrainian Internet address domains are presently controlled by obscure proxy and anonymity services affiliated with some of the largest American Internet service providers (ISPs).

The results emerge from research that investigates how the Russian invasion has influenced Ukraine’s domestic availability of Internet Protocol Version 4 (IPv4) addresses. Analysts at Kentik, a firm that evaluates the efficiency of Internet networks, discovered that while most ISPs in Ukraine have not modified their infrastructure significantly since the commencement of the war in 2022, several have resorted to liquidating parts of their crucial IPv4 address domains merely to maintain operations.

For instance, the established Ukrainian ISP Ukrtelecom is currently managing only 29 percent of the IPv4 address ranges that it held at the onset of the war, according to Kentik’s findings. Although a significant portion of that earlier IP domain remains inactive, Ukrtelecom informed Kentik’s Doug Madory that they had to sell a considerable number of their address blocks “to achieve financial stability and continue offering essential services.”

“Leasing out a segment of our IPv4 resources enabled us to tackle some of the remarkable challenges we have encountered since the escalation of the invasion,” Ukrtelecom conveyed to Madory.

Madory discovered that a large quantity of the IPv4 domain once assigned to Ukrtelecom is now dispersed among over 100 providers globally, prominently at three major American ISPs — Amazon (AS16509), AT&T (AS7018), and Cogent (AS174).

Similarly, another Ukrainian Internet provider — LVS (AS43310) — was routing around 6,000 IPv4 addresses across the country in 2022. Kentik found that by November 2022, much of that address space had been distributed to more than a dozen separate locations, with most of it being routed through AT&T.

In a similar vein, the Ukrainian ISP TVCOM presently routes nearly 15,000 fewer IPv4 addresses than at the beginning of the conflict. Madory noted that most of those addresses have been distributed to 37 additional networks beyond Eastern Europe, including Amazon, AT&T, and Microsoft.

The Ukrainian ISP Trinity (AS43554) went offline in early March 2022 amidst the violent siege of Mariupol, but its address space eventually began surfacing in more than 50 distinct networks globally. Madory identified that over 1,000 of Trinity’s IPv4 addresses abruptly appeared on AT&T’s network.

What accounts for the routing of all these former Ukrainian IP addresses by U.S.-based networks like AT&T? As per spur.us, a corporation that monitors VPN and proxy services, nearly all the address ranges highlighted by Kentik currently correspond to commercial proxy services that enable users to anonymously guide their online traffic through alternate computers.

From a website’s viewpoint, the traffic generated from a proxy network user appears to come from the leased IP address rather than from the customer utilizing the proxy service. These services can serve various business objectives, such as price assessments, sales analytics, web scrapers and content-extraction bots. However, proxy services are also rampantly exploited to obscure cybercriminal activities since they complicate the tracing of malicious traffic to its original source.

IPv4 address domains are always in considerable demand, which renders them quite precious. There are now numerous companies willing to pay ISPs to lease out their unwanted or unused IPv4 address spaces. Madory mentioned that these IPv4 brokers typically pay between $100-$500 monthly to lease a block of 256 IPv4 addresses, with proxy and VPN providers often being the entities most inclined to meet those rental rates.

A brief examination of all Internet address blocks currently routed via AT&T — as evidenced in public records maintained by the Internet backbone provider Hurricane Electric — reveals a majority of country flags other than the United States, featuring networks originating from Hungary, Lithuania, Moldova, Mauritius, Palestine, Seychelles, Slovenia, and Ukraine.

When inquired about the notable prevalence of proxy services routing foreign address blocks through AT&T, the telecommunications giant stated that it has recently revised its policy regarding originating routes for network blocks not owned and managed by AT&T. This new guideline, detailed in a February 2025 update to AT&T’s terms of service, provides those customers until September 1, 2025, to originate their IP space from their own autonomous system number (ASN), a distinctive number allocated to each ISP (with AT&T’s being AS7018).

“To guarantee our customers receive the highest quality of service, we amended our terms for dedicated internet in February 2025,” a representative from AT&T stated in an emailed response. “We no longer allow static routes with IP addresses that we have not provided. We are in the process of identifying and notifying affected customers that they have 90 days to transition to Border Gateway Protocol routing using their own autonomous system number.”

Ironically, the blending of Ukrainian IP address space with proxy providers has resulted in many of these addresses being utilized in cyberattacks against Ukraine and other adversaries of Russia. Earlier this month, the European Union imposed sanctions on Stark Industries Solutions Inc., an ISP that emerged two weeks before the Russian invasion and swiftly became the source of extensive DDoS attacks and spear-phishing attempts perpetrated by Russian state-sponsored hacking groups. An in-depth analysis of Stark’s extensive address space revealed that some of it was sourced from Ukrainian ISPs, and most of it was linked to Russia-based proxy and anonymity services.

Spur’s Chief Technology Officer Riley Kilmer noted that AT&T’s policy amendment will likely compel many proxy services to shift to other U.S. providers with less stringent regulations.

“AT&T is the first among the major ISPs that appears to be taking actual steps regarding this matter,” Kilmer remarked. “We monitor several services that explicitly sell AT&T IP addresses, and it will be intriguing to see what happens to those services by September.”

Nevertheless, Kilmer mentioned there are multiple large U.S. ISPs that continue to facilitate proxy services in bringing their own IP addresses and hosting them in ranges that create the illusion of residential users. For example, Kentik’s report observed former Ukrainian IP ranges appearing as proxy services routed by Cogent Communications (AS174), a tier-one Internet backbone provider based in Washington, D.C.

Kilmer commented that Cogent has turned into an appealing base for proxy services because it is relatively straightforward to have Cogent route an address block.

“In fairness, they do transit a substantial amount of traffic,” Kilmer explained regarding Cogent. “But there’s a reason much of this proxy activity is routed through Cogent: because it’s exceedingly easy to have something routed there.”

Cogent declined to comment on Kentik’s findings.

“`