After Russia invaded Ukraine in early 2022, many Ukrainian internet service providers started selling or losing large parts of their IPv4 address ranges just to stay afloat. Services like Ukrtelecom now only manage around 29% of the IP addresses they originally owned, with the rest ending up being routed through companies around the world—mostly concentrated at big American internet providers like IBM, Amazon, AT&T, and Cogent.

Who’s buying these addresses? A surprising number have gone to proxy and VPN operators—services that let people mask their location or automate web tasks. These proxies often use Ukrainian IPs to make traffic look like it’s coming from there, even though it’s actually hiding behind someone else. This setup is handy for scraping websites, managing ad placements, or even carrying out cyberattacks.

Because IPv4 space is scarce and pricey, brokers now pay hundreds of dollars each month for blocks of addresses. Then proxy companies rent them out to other clients. The result is that IPs originally belonging to Ukraine are now fueling a market of anonymizing services based out of the U.S.

This inflow of Ukrainian IPs into proxy pools has real security implications. Some of these addresses have actively been used in attacks, including phishing, DDoS, and other malicious campaigns—sometimes surprisingly used against Ukraine itself. This kind of misuse shows how Ukrainian network resources are being weaponized in cyberspace, trading sovereignty for quick cash.

Some U.S. providers are starting to push back. AT&T recently updated its policies, warning customers that starting in September 2025 they must announce their own autonomous IP space rather than re-use others'. This may pressure proxy services to leave AT&T for more permissive networks like Cogent, highlighting how routing rules can impact cybercrime dynamics.

In short, the invasion has triggered a shift: Ukrainian ISPs, under financial strain, have shed IP resources that are now feeding global proxy networks—networks that both power benign business tools and cloak cybercriminals. It's a vivid example of how war reshapes not only land and politics, but also the hidden fabric of the internet.

Source: https://krebsonsecurity.com/2025/06/proxy-services-feast-on-ukraines-ip-address-exodus/