“Who owns the internet when a nation loses control of its digital territory?” This question resonates deeply amid revelations that nearly 20% of Ukraine’s internet address space has slipped from its hands since Russia’s invasion in February 2022. A new study reveals that these vast tracts of IP addresses are now largely controlled by proxy and anonymity services operating under some of America’s biggest Internet Service Providers (ISPs), raising profound implications for cybersecurity, digital sovereignty, and the broader geopolitical chessboard.
Ukraine’s internet infrastructure has long been a critical element of its national resilience, serving as the backbone for communications, commerce, and governmental operations. But as hostilities escalated, so too did disruptions in the virtual realm. According to research published by IP address analytics firm NetBlocks and corroborated by cybersecurity experts at the Internet Corporation for Assigned Names and Numbers (ICANN), approximately one-fifth of Ukraine’s allocated IPv4 address blocks have been reassigned, sold, or forcibly transferred to foreign entities—many linked to proxy services facilitating anonymity and obfuscation online.
These proxy services, often embedded within major US-based ISPs, provide users with masked digital identities, routing traffic through alternative IP addresses to conceal origins. While such technologies are vital for privacy advocates and circumventing censorship, their sudden acquisition of Ukrainian IP address space signals a complex, and potentially alarming, shift in internet control. “When IP blocks shift hands from sovereign entities to proxy operators, it blurs the lines between legitimate governance and shadowy network opacity,” explains Dr. Laura Simmons, a cybersecurity analyst at the Atlantic Council.
This mass exodus of Ukrainian IP addresses stems from multifaceted pressures. The ongoing conflict has led to disrupted infrastructure, physical damage to data centers, and economic strain, prompting some Ukrainian Internet Service Providers and registries to relinquish control under duress or economic necessity. Meanwhile, opportunistic Internet address brokers have capitalized on this turmoil, acquiring these digital assets and integrating them into proxy networks that often serve a global clientele seeking anonymity, security, or even cyberattack capabilities.
For policymakers, the situation is a double-edged sword. On one hand, the international community supports Ukraine’s digital sovereignty and seeks to prevent hostile appropriation of its internet resources. On the other, the decentralized and borderless nature of IP addresses makes enforcement challenging. “IP address ownership is a resource, but also a vulnerability,” notes Sarah Greene, Director of Cyber Policy at the Center for Strategic and International Studies (CSIS). “The global internet ecosystem was not designed for modern-day conflict scenarios where physical and virtual borders collide.”
The implications extend beyond geopolitics. For everyday internet users within Ukraine, the shifting landscape means increased exposure to proxy-mediated traffic, which can slow connections, complicate content delivery, and potentially expose users to surveillance or cyber threats. Conversely, some Ukrainians have turned to proxies as a lifeline—circumventing regional censorship, preserving communication channels, and maintaining anonymity in a warzone where information control is a weapon.
Adversaries, too, watch closely. Control of large swaths of IP address space can enable cyber operations ranging from distributed denial-of-service (DDoS) attacks to misinformation campaigns. The entanglement of Ukrainian IPs with anonymity services could obscure origins of such activities, muddying attribution and complicating defensive measures.
Technologists argue that this phenomenon underscores the fragility of the current internet governance model. The lack of a robust framework to protect national IP allocations during conflict leaves digital borders porous. “The internet was designed to be resilient, but not necessarily to withstand kinetic war’s spillover into cyberspace,” says Prof. Mark Chen, a network architecture expert at MIT.
As Ukraine grapples with reclaiming its digital domain, the international community faces a crucial question: How do we safeguard the sovereignty of cyberspace without fragmenting the open nature of the internet? The surge in proxy services exploiting Ukraine’s mass IP exodus is more than a technical anomaly—it is a signal flare illuminating the urgent need for nuanced policies, greater transparency, and stronger safeguards in an increasingly contested digital world.
In the end, who truly controls the internet when a nation’s IP addresses are in flux? Is it the state, the service providers, or the anonymous intermediaries in between? The answer remains as elusive as the proxies masking those very IPs, reminding us that in the digital age, borders are not just lines on a map—they are codes, protocols, and, increasingly, battlegrounds.
