Digital Fallout: Ukraine’s IPv4 Market Disrupted by War

The war in Ukraine has devastated the country since Russia’s initial attack in 2022. After more than three years with little to no end in sight, major cities in Ukraine, such as Kyiv, Donetsk, and Kharkiv, have suffered infrastructure and human losses. Civilians caught in the conflict are greatly affected as they cope with these losses and damages.

Unfortunately, losses in Ukraine reached beyond the physical, as its online resources were also affected. According to Kentik, a significant percentage of Ukraine’s IPv4 addresses no longer originate from the country as ISPs have been greatly affected by the invasion. Curiously, many of these IPv4 addresses are now originating from the West and owned by large online companies.

Significant Decline in IPv4 Space

A striking example of the significant decline in IPv4 space in Ukraine is the current state of Ukrtelecom, the country’s largest Internet Service Provider. According to Kentik’s report, the ISP has experienced a sharp reduction in its IPv4 allocation after three years of invasion.

“AS6849 is the primary ASN for Ukrtelecom, which has experienced a marked decline in the amount of IPv4 space it originates in the past three years. AS6849 went from originating the equivalent of 4,728 /24s to only 1377 — a decline of 71%.”

It should be noted that Ukrtelecom is only one of the many ISPs in the country. But their situation is also the same in terms of IPv4 use. With the rising cost of the invasion, these ISPs opted to monetize their IPv4 addresses. IPXO announced its partnership with Ukrtelecom as the chosen platform for IPv4 address monetization, signaling an aggressive move to lease or sell its IPv4 assets.

New Lessees and Owners of IPv4 Addresses

Ukraine ISPs often lease their IPv4 addresses, and a large percentage of these assets are now under the jurisdiction of various online companies and brokers. ISPs operating in areas that were completely devastated during the invasion have to sell their IPv4 holdings.

Big online companies such as Amazon and AT&T have been noted to have leased IPv4 addresses from Ukraine. There are also smaller companies taking advantage of this virtual fire sale to acquire IPv4 addresses for later use. Unfortunately, the use of these IPv4 addresses, especially in smaller companies, is putting internet users at risk.

VPN (Virtual Private Network) companies or proxy providers are relatively small companies that lease and own IPv4 addresses. Their purpose in acquiring these assets is to mask their users' real IP addresses by routing their connection to a Ukraine-based IP address. ISPs that have acquired IPv4 addresses also use these properties for residential proxies.

The use of these IPv4 addresses for legitimate purposes is accepted. However, there will be individuals who may take advantage of these VPNs and proxy services to mask their identity as they conduct online attacks. Spur.us also reported on the dangers of residential proxies:

“Residential proxies are largely used for gray-market purposes and cybercriminal activity. While gray-market activity may only violate various terms-of-service agreements, many proxy service providers will turn a blind eye to much more nefarious (and illegal) use-cases, including those involving banking and financial services.”

Conclusion

The invasion of Ukraine is not just an attack on the country. Its worldwide implications should not be underestimated, as the lease and sale of their IPv4 addresses could end up in the hands of individuals with nefarious purposes.