Exodus of IPv4 from War-torn Ukraine

Summary

In this post, we discuss how the ongoing war in Ukraine has led to a significant decline in the amount of IPv4 address space announced by Ukrainian Autonomous Systems (ASes), and why those addresses are often now being announced by western ISPs and major public clouds.

The internet of Ukraine, noted for its resilience in the initial months following the Russian invasion, has been profoundly affected by three years of war. One notable change has been the exodus of a vital national commodity: IPv4 addresses.

In this blog post, we highlight several cases in which large amounts of IPv4 space, formerly originated by prominent Ukrainian ASes, have moved out of the country (often with the help of IPv4 brokers) to dozens of new origins, including major cloud providers, hosting operations, and international telecoms. The result is a dramatic reduction in Ukraine’s footprint in the global routing table — a new consequence of a protracted war in the digital age.

IPv4 Departures

Using the top 100 retail providers in Ukraine listed in Kentik Market Intelligence, we observed an 18.5% decline in the amount of announced IPv4 space between February 2022 and May 2025.

But before we get into the various examples of Ukrainian providers leasing out their IPv4 resources around the world, we should mention up front that there are many providers that have not participated in this practice and are originating exactly the same (or very nearly the same) routes as they did before the Russian invasion in 2022.

The top Ukrainian providers that did not change are listed below, ranked in descending order by the equivalent number of /24s of IPv4 they originated in February 2022:

Ukrtelecom: AS6849 and AS6877

Ukrtelecom (Укртелеком) is the incumbent telecommunications company of Ukraine and is represented in the global routing table by the ASNs 6849 and 6877. In the past three years, the amount of IPv4 address space announced by these ASes has dropped dramatically, with much of the lost IP space migrating out of the country, if not the region entirely.

AS6849 is the primary ASN for Ukrtelecom, which has experienced a marked decline in the amount of IPv4 space it originates in the past three years. AS6849 went from originating the equivalent of 4,728 /24s to only 1377 — a decline of 71%.

While much of the decline in originated address space is no longer routed at all, a significant portion of the decline is now originated by various companies outside of Eastern Europe. In fact, there are currently over 100 ASNs that originate IPv4 space announced by AS6849 three years ago.

Who is announcing Ukrtelecom IPv4 space? 92 /24s of IPv4 space are now originated by AS174 (example 91.124.96.0/22), 77 /24s are announced by AS16509 (ex: 91.124.133.0/24) and even AT&T (AS7018, example 91.124.2.0/24) announces 29 /24s. Below is a screenshot from the bgp.tools web utility showing the address range originated by AS7018 and registered to Ukrtelecom. Even passive DNS for this prefix echoes a previous life with the Ukrainian incumbent.

If we do a whois on this range, we can see that it is currently registered as “ATT-CT.” The highlighted fields indicate that IPv4 broker IPXO (AS834) had a hand in leasing this IPv4 space to a new customer, who is now getting the route originated by AS7018.

Pictured below, Ukrtelecom’s sister ASN (6877) experienced an even more dramatic decline over the past three years. On Feb 1, 2022, AS6877 originated 38 prefixes equivalent to 616 /24s of IPv4 space. Now, AS6877 has all but disappeared from the global routing table (except as the contents of an AS-SET for a couple of prefixes).

In November 2024, this IPv4 space began getting originated by numerous ASes outside of Ukraine. At present, there are over 50 unique origins for these IPv4 ranges including familiar ASNs like 7018 (ex: 46.203.225.0/24), 3356 (ex: 46.203.68.0/22), 174 (ex: 46.203.81.0/24), 5511 (ex: 46.203.86.0/24), 6461 (ex: 46.202.84.0/24), 3257 (ex: 46.202.56.0/24), and 7029 (ex: 46.203.6.0/24).

In response to an inquiry about the leasing of IPv4 space, a representative of Ukrtelecom confirmed to me that this was an action taken to raise funds during an ongoing war.

Dear Doug,

Yes, this was a necessary step taken during wartime to secure financial stability and continue delivering essential services to our customers.

Leasing out a portion of our IPv4 resources allowed us to mitigate some of the extraordinary challenges we have been facing since the full-scale invasion began.

At the same time, Ukrtelecom remains committed to maintaining and expanding internet infrastructure across Ukraine, especially through fiber rollout, which remains our strategic priority.

We appreciate the attention to this issue and are open to further dialogue on how Ukrainian telecoms are adapting in these unprecedented times.

Best regards,

Olena Shramko
PR Director
Ukrtelecom

According to published rates from IPv4 brokers, a /24 (256 addresses) can be leased for $100–$150 per month. Based on the analysis above, Ukrtelecom is leasing the equivalent of 1500 /24’s (~1000 from former AS6849 IPv4 space and another ~500 from AS6877). If we assumed the low end of that price range, that would be US$150,000 (or ₴6,288,00) of additional revenue per month for the country’s national operator.

And Ukrtelecom is not alone…

LVS: AS43310

In another example, AS43310 began 2022 originating 3 prefixes equivalent to 24 /24s of IPv4: 91.225.224.0/22, 91.197.4.0/22, and 188.191.96.0/20. By November 2022, things had begun to change as this address space began to be parceled out to over a dozen new origins, with AS7018 currently the primary origin for these former Ukrainian IPv4 ranges.

TVCOM: AS34092 and AS57033

At the beginning of 2022, AS34092 was originating 6 IPv4 prefixes equivalent to 58 /24s of IP space until the beginning of March that year, when it disappeared from the routing table. Some routes were shifted to sister AS, 57033, but by June 2022, the address space was being farmed out to numerous ASes.

AS57033, for its part, began 2022 by announcing 21 IPv4 prefixes equivalent to 48 /24s of IP space (some overlapping with AS34092). But by December 2024, AS57033 disappeared as well and now all of IPv4 space originated by these two ASNs in 2022 is now originated by 37 ASNs including AS8075 (ex: 81.22.128.0/24), AS7018 (ex: 81.22.129.0/24), AS3320 (ex: 109.72.116.0/24), and AS16509 (ex: 31.43.161.0/24).

Providers in Contested Regions

Online Technologies LTD: AS45025, Donetsk

In my blog post from February 2023 about the Russification of IP registrations, I highlighted a route (151.0.0.0/20) originated by AS45025, which had its country field updated from “UA” to “RU” in July of 2022 as part of a larger effort to assimilate newly Russian-held territories.

In fact, the RIPE database has been altered as well. Below is the output of a whois command I ran in 2023 that was featured in the blog post.

If you were to run the same command today, you would get a message saying that the object was deleted on April 4, 2024. The evidence of the prior existence as a prefix of Ukraine has been purged from the records.

Well, AS45025 no longer exists in the global routing table. The IPv4 space it was originating in 2022 has been divvied up among providers in the Russian-held region of Donetsk, as well as a few global telecoms such as AS7018 (ex: 93.89.216.0/24), AS5511 (ex: 91.193.252.0/24), and AS2914 (ex: 93.89.218.0/24).

Byte-SD: AS42430, Lugansk

Depicted below, AS42430 was a service provider based in the Lugansk region of Ukraine, along the front lines of battle between Ukrainian and Russian forces. The ASN disappeared from the global routing table in March 2022, and with it, the seven prefixes equivalent to 37 /24s of IPv4. In September 2022, parts of these ranges began to be originated by new origins, including Bursabil Teknoloji (AS60721), a Turkish IPv4 broker.

In 2023, IPv4 broker IPXO, and US telecom icons Sprint and AT&T were among the origins for the former Lugansk IPv4 space. Still, the primary origin that emerged for these IPs was Paltel (AS12975) of the Palestinian Territories, which currently originates nearly all of it. According to RIPE NCC’s published transfer statistics, 188.0.112.0/20 and 188.0.96.0/20 were transferred from Byte-SD to Paltel on January 6, 2023.

Trinity: AS43554, Mariupol

AS43554 was a service provider operating in Mariupol, originating the equivalent of 259 /24s of IPv4 at the beginning of 2022. Trinity went offline in early March of 2022 during the bloody siege of the city.

Just like with the previous example, IPv4 space previously originated by AS43554 started to be originated by as many as 54 ASes outside of Ukraine. This phenomenon continued until the beginning of 2024, when a large portion of the address space was consolidated into Ukrainian content provider Sweet (AS204384).

During the summer of 2023, I noticed some of Trinity’s IPv4 space being originated by AT&T (screenshot below).

In fact, one of the address ranges had been registered as “AT&T Services, Inc.” in a likely attempt to use it for a residential proxy.

Cyberintelligence firm Spur summarizes the problems posed by proxy services this way:

Residential proxies have long been used for illicit activity on the internet, including web scraping, scalping tickets to your favorite concerts, pushing spam to forums and social media, new account fraud and account takeovers. It involves hijacking what otherwise is legitimate infrastructure, allowing bad actors to mask their actual IP addresses with those associated with genuine customers your business would otherwise welcome.

“Residential proxies” are so named because they utilize IP addresses that an Internet Service Provider has assigned to a household, as opposed to a business or datacenter. This makes them appear more legitimate and allows them to evade detection by legacy geolocation and fraud services or IP quality score providers like MaxMind or Transunion (formerly Neustar).

I brought this to a contact at AT&T and within a few weeks it was gone.

Interphone: AS24881, Mariupol

Also based in Mariupol, AS24881 was originating six prefixes equivalent to 76 /24s of IPv4 back in 2022. As illustrated below, AS24881 and the IPv4 space it originated disappeared from the global routing table in March of that year.

AS24881’s IPv4 space wouldn’t be seen again until February 2023 when it was originated by Linknet (AS57460), a service provider based in the Donetsk People’s Republic (DPR) in the Russian-occupied parts of eastern Ukraine’s Donetsk Oblast. During 2023, this address space was originated by as many as 20 different origins, as is illustrated below.

By 2024, the address space returned to being originated by AS24881, but this time with Russian transit, marking another instance of the Russification of the Ukrainian internet. At present, the small amount of IPv4 space not originated by AS24881 is announced by other service providers based in the DPR.

SkyNet: AS47598, Kherson

In May 2022, Russian forces rerouted internet service to the occupied southern city of Kherson through Miranda-Media (AS201776) in Russian-occupied Crimea. I detailed the switchover in a blog post and in a collaboration with The New York Times that landed on the front page of the newspaper.

The first provider in Kherson to make the switch to Russian transit was SkyNet (aka KhersonTelecom, AS47598), whose owner took to Facebook to explain his rationale for reconnecting his service through Russia. “On April 30, EVERYTHING fell!” he said, adding that he had no choice but to “turn on the circuit of the Crimean operator Miranda.” While some local residents thanked him, others accused him of using “enemy internet”, a decision he defended in the post.

In November 2022, Ukrainian forces retook Kherson Oblast above the Dnieper River, and most providers switched back to using Ukrainian transit to connect to the global internet. It was at that time that AS47598 disappeared from the global routing table. In April 2024, the one prefix (91.206.110.0/23) that had been originated by AS47598 in 2022 reappeared as originated by NTT (AS2914), where it continues to be announced today.

In April 2025, KhersonTelecom transferred its three IPv4 ranges (including 91.206.110.0/23) to a new owner. All three are hosting proxy services according to cyberintelligence firm Spur.

Conclusion

In the spring of 2015, I published the first analysis of the emerging private market for IPv4. The analysis was the basis for our talk at RIPE 70 in Amsterdam that year. Following years of debate on the matter, the RIPE NCC created a process for facilitating the sale of IPv4 space, creating a new player in the internet ecosystem: the IPv4 broker.

One of the first IPv4 brokers to emerge was a Romanian outfit so prolific that roughly half of the transfers recorded by RIPE that year were from that country alone. In fact, the footprint of the Romanian internet in the global routing table shrank by a quarter in 2015 as every bit of the country’s IPv4 space that wasn’t being actively used was sold off — mainly to Saudi Arabia and Iran, which was the subject of my collaboration with the Washington Post later that year.

Something similar has been happening to Ukraine’s footprint in the global routing table, but for different reasons. Weary from years of missile strikes and aerial bombardment, conditions are tough in many parts of the country. If leasing out parts of their IP resources keeps the business afloat and employees paid, who can blame these providers?

But questions arise. Are IPv4 brokers taking advantage of the situation by leasing out so much of Ukraine’s IPv4 space? Or are the brokers vital “to secure financial stability” for Ukrainian ISPs? Who is responsible when these ranges are used for various proxy services that cause problems on the internet?

At APRICOT in 2024, APNIC Chief Scientist Geoff Huston asked whether we have reached peak IPv4, citing a recent decline in the amount of routed IPv4. In another talk (slide 6), he cited the decline in the market price for IPv4, theorizing that perhaps demand was waning as IPv6 was utilized more (or NAT was becoming more acceptable). But another reason could be that the market is being flooded with supply from Ukraine.