Russia’s invasion of Ukraine has not only redrawn national borders; it is reshaping the Internet itself. Since February 2022, roughly 20 percent of Ukraine’s IPv4 address space has migrated into the hands of third parties, including Russian-aligned proxy and anonymity services that lease those addresses from financially stressed Ukrainian ISPs. Kentik research shows entire /24 blocks once routed by Ukrtelecom, LVS, TVCOM and Trinity now surfacing at major U.S. carriers such as Amazon, AT&T and Cogent.
Investigative reporting from Brian Krebs details how those “orphaned” Ukrainian ranges are being monetized by commercial proxy networks, some of which have been linked to Russian state-sponsored spear-phishing and DDoS campaigns. To curb abuse, AT&T updated its dedicated-Internet terms of service in February 2025, giving customers until 1 September 2025 to originate non-AT&T IP space from their own ASNs . The EU has already sanctioned Stark Industries Solutions for weaponizing leased Ukrainian addresses in attacks on European critical infrastructure.
For organizations subject to U.S. sanctions rules, the compliance stakes are high. OFAC can impose civil penalties on a strict-liability basis: if your network inadvertently communicates with a sanctioned IP, intent does not matter. Yet IP ownership and geolocation are now fluid, changing far faster than manual allow-lists can keep up.
OFAC-Managed Targets
Our Security, Intelligence and Research team continuously reconciles global BGP route changes, WHOIS transfers and sanctions updates to maintain an authoritative list of IP ranges controlled by restricted entities. The moment a Ukrainian block is advertised from Russian territory—or vice-versa—it is re-classified in our OFAC targets within minutes.
Protective DNS
DNS Defense Cloud and DNS Defense stop sanctioned command-and-control domains, phishing sites, data-exfiltration tunnels and spam before a single packet reaches your endpoints. Because DNS is queried before any TCP or TLS handshake, Protective DNS provides the earliest possible enforcement point, regardless of where the underlying IP address roams.
IP Defense
When traffic must be blocked at layer 3 or layer 4, IP Defense pushes the same OFAC-aligned intelligence to firewalls, routers, IPS, AWS WAF and more. Dynamic route updates ensure you remain compliant even as adversaries hop between carriers, continents or compromised residential hosts.
Why Automation Matters
Manual Geo-IP databases lag fast-moving hijacks and leases.
Cloud-only proxies masquerade as residential broadband, evading static filters.
Strict-liability enforcement means there is no safe grace period for outdated lists.
With ThreatSTOP, every DNS query and every packet is checked against the freshest possible intelligence, closing the window attackers exploit when IP ownership flips overnight.
When Trinity’s Mariupol network went dark, more than 1,000 of its former IPv4 addresses re-appeared inside AT&T’s backbone and were promptly rented to a proxy service used in Russian phishing operations. ThreatSTOP flagged the ASN change in real time and added the range to our Russia-controlled list, ensuring customers blocked the traffic even before public attribution emerged.
Zero infrastructure changes. Deploy Protective DNS via simple resolver settings or host-based agents.
Consistent policy everywhere. The same OFAC ruleset protects cloud workloads, branch offices and on-premise gear.
Verifiable reporting. Per-query and per-packet logs prove your controls matched each sanction list version at the time of enforcement.
For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers! Get started with a Demo today!
Connect with Customers, Disconnect from Risks
|
ATT&CK Tactic |
Technique ID |
Technique Name |
ThreatSTOP Mitigation |
|---|---|---|---|
|
Reconnaissance / Resource Development |
T1583.001 |
Acquire Infrastructure: IP Addresses |
OFAC-managed targets identify newly registered or transferred ranges tied to adversary control, preventing use for staging. |
|
Command and Control |
T1090 |
Proxy |
Protective DNS blocks domains that brokers use to rent residential proxies; IP Defense blocks the underlying IP ranges. |
|
Exfiltration |
T1041 |
Exfiltration Over C2 Channel |
DNS tunneling and HTTP-based exfiltration domains are denied before data leaves the network. |
|
Impact |
T1498 |
Network Denial of Service |
IP Defense null-routes IPs associated with botnets leveraging leased Ukrainian space for DDoS amplification. |
|
Initial Access / Credential Access |
T1566 |
Phishing |
Malicious domains hosted on repurposed Ukrainian IP blocks are intercepted at the resolver. |