Ukraine's War: The Shadowy Trade in Internet Addresses

Since the February 2022 Russian invasion of Ukraine, nearly one-fifth of Ukraine's internet address space has fallen under Russian control or been sold to internet address brokers. A new study reveals that large chunks of Ukrainian IP address space are now in the hands of shadowy proxy and anonymity services nested within major US ISPs. Desperate to stay afloat, Ukrainian ISPs have sold off valuable IPv4 addresses. These addresses have ended up in proxy services globally, many of which are used for cyberattacks against Ukraine and Russia's enemies. Some were even used in DDoS attacks and spear-phishing attempts by Russian state-sponsored hacking groups. AT&T, a major US telecom, has changed its policy to prevent the use of static routes with IPs they don't provide, likely forcing many proxy services to migrate to other providers.