Exodus of IPv4 from War-torn Ukraine#

Doug Madory — Kentik

• Why: A striking data story about IPv4 as a war-driven national commodity, with direct consequences for anyone reasoning about IP address markets, proxy abuse, and routing-table hygiene — it also explains several of the movers in this year's BGP table.
• What: Four years of war produced a ~20% reduction in Ukraine's footprint in the global routing table. Ukrtelecom's AS6849 dropped from 4,728 to 1,377 /24s (−71%), with the space leased via brokers (IPXO) and re-originated by Amazon, Windstream, NTT, Lumen, Orange; sister ASN AS6877 vanished from the table entirely. Mariupol's Trinity (AS43554) space popped up under as many as 54 foreign ASes and was confirmed in use as residential-proxy infrastructure. The second act is AT&T's 2025 BGP housekeeping: AS7018 collapsed from 3,200+ IPv4 routes to 641 via super-aggregation and a new policy requiring customers to originate from their own ASN — which chased out the proxy services; the displaced prefixes scattered across ~150 new origins. Also covers AWS's Dec 2024 move to originating 1,000+ super-aggregates (IPv4 footprint 49M → 157M addresses, absorbing space from Volia and legacy ranges) and similar patterns in Iran (Hetzner as recipient).
• How: Longitudinal BGP/WHOIS analysis; RIPE database version-diffing to document the "Russification" of registrations and subsequent purging of records; proxy-use confirmation via Krebs's investigation.
• Where applicable: Global — this is analysis anyone can replicate with public data, and the lessons (origin-ASN policy as abuse defense, prefix-count consolidation, broker-mediated leasing risks) apply to any large origin AS.