Proxy Services Feast on Ukraine’s IP Address Exodus

A Kentik study finds that since Russia’s 2022 invasion, nearly one-fifth of Ukraine’s IPv4 space has been sold or leased and is now widely routed by major U.S. ISPs (notably AT&T, Amazon, and Cogent), where it is monetized by proxy/VPN services and abused for cyberattacks. The report details how address blocks from Ukrainian ISPs (e.g., Ukrtelecom, LVS, TVCOM, Trinity) have dispersed globally, often appearing as commercial proxies (e.g., IPRoyal), and notes EU sanctions against Stark Industries Solutions for enabling Russian operations. AT&T updated its terms in Feb 2025 to stop originating third-party IP space by Sept 1, 2025, while Cogent remains relatively permissive, making it attractive for proxy routing.