Kherson’s Internet: Outage, Then a Routing Shift Through Russia

Internet connectivity has become a strategic asset in conflict zones, and the recent situation in Kherson, Ukraine, illustrates how quickly control over that asset can change. Following a multi-day outage, traffic from at least one local network was briefly rerouted through Russian infrastructure before returning to Ukrainian providers.

A Significant Disruption

On Saturday, April 30, 2022, the Russian-occupied city of Kherson—home to roughly 280,000 people—lost Internet connectivity starting just after 16:00 UTC. The outage was the most severe disruption for the region since the invasion began, surpassing the 43% traffic drop observed on February 23-24. Service began returning around 04:30 UTC on Wednesday, May 4. While overall traffic had dipped at the start of the war, this weekend’s incident marked a complete break in service.

Ukrainian officials attributed the restoration to "backup power channels," citing "interruptions of fiber-optic trunk lines and disconnection from the power supply of equipment of operators in the region." However, they also accused occupying forces of a more deliberate act: switching fiber-optic lines and communication stations to connect Ukrainian users to the Russian network. This move was described as a gross violation of international law, with an appeal filed with the International Telecommunication Union to sanction Russia.

Change in Upstream Providers

Data from Border Gateway Protocol (BGP) routing confirms that the network landscape shifted during the outage. Prior to the disruption, the IPv4 prefix announced by AS47598 (Khersontelecom) reached the Internet through multiple Ukrainian providers, including AS12883, AS3326, and AS35213. About a day into the outage, its routing path began showing a Russian network, AS201776 (Miranda), as the upstream provider. That path also included AS12389 (Rostelecom), a major Russian digital services provider. This aligns with the Ukrainian government’s claims of forced reconnection to Russian infrastructure.

The consequences of this shift were visible at the application layer. Cloudflare’s Anycast routing normally directs requests from Khersontelecom to data centers in Kyiv, Ukraine, and Frankfurt, Germany. On May 1, after the Russian network took over routing, those requests were instead handled by the Moscow data center. This pattern persisted for roughly three days.

Around 06:00 UTC on May 4, traffic began flowing to the Kyiv and Frankfurt data centers again, with Moscow dropping out of the path. This coincided with the routing table updates showing that Khersontelecom’s prefix had returned to Ukrainian upstream providers.

The Strategic Role of Internet Control

The events in Kherson highlight a growing reality: controlling physical infrastructure is no longer enough in modern conflict. The ability to route, restrict, or sever Internet traffic has become a parallel front. The precedent was set after the 2014 annexation of Crimea, where the region’s connectivity was similarly absorbed into Russian networks. The brief routing change in Kherson, and the content blocking and limitations that could accompany it, underscore how Internet resources are now as contested as roads or power lines.