Fighting IP Hijacking: Interview with Stat Proxies

By Nicholas St. Germain —

Overview

Proxyway interviewed our co-founder Nicholas St Germain in September 2024 about his efforts to combat IP hijacking - the unauthorized theft and misuse of IP address assets. This post summarizes that conversation; the full interview is on Proxyway.

Nicholas's Background

Nicholas has worked in the proxy space since 2017. He began as a sneaker botter purchasing proxies before deciding to build his own to reduce costs. His journey progressed from data center proxies to ISP proxies, eventually leading to the creation and expansion of Stat Proxies' B2B division following a merger with his previous company, Dash Proxies.

What is IP Hijacking?

Nicholas defines IP hijacking as "the act of stealing access to IP address assets." Hijackers obtain IP blocks and maliciously announce them on networks, either using the IPs themselves or selling them to unsuspecting buyers.

The Thrace Story

Nicholas became personally invested in combating this threat after falling victim to a hijacker operating under the alias "Thrace." A colleague named Charlie alerted him to the unauthorized activity, prompting him to learn hijacking techniques from the inside. Since early 2021, he has systematically shut down Thrace's stolen ranges wherever they surface.

Common Targets

Vulnerable IP resources include:

  • Orphaned IPs from defunct companies or those undergoing mergers and bankruptcy
  • Organizations with unused IP space they don't actively monitor
  • Large ISP blocks announced without proper security protections

Nicholas notes that hijackers exploit expired company domains to gain ARIN account access and falsify documents using free IRR databases.

Scale of the Problem

Over four years, Nicholas has deactivated between 750,000 and 1,000,000 IPv4 addresses, predominantly belonging to that one actor. He believes the actual scope extends far beyond his efforts, with hijacked IPs appearing across industries from defense contractors to small businesses.

Detection Methods

Nicholas identifies hijacked IPs through:

  • Community tips from those aware of his anti-hijacking work
  • Monitoring ASNs previously used by known hijackers, particularly in the 6xxx-7xxx range
  • Checking ARIN WHOIS records for "non-portable" designations
  • Tracking IP ranges dormant for eight or more years that suddenly appear on new networks
  • Maintaining databases of known hijacked ranges and accounts

Response Outcomes

Most IP owners prove difficult to contact due to outdated registration information. Nicholas primarily works with hosting providers directly, presenting evidence and escalating to upstream networks when necessary. Most hosts act quickly to remove hijacked IPs to protect their reputations.

The work is unpaid, and the rewards have been modest - one grateful company sent him a free domain. As he told Proxyway: "I really do enjoy doing this work and am not doing it for any reward or compensation."

The Importance of IP Security

This work highlights the often-overlooked vulnerability of internet infrastructure. IP hijacking affects everyone from small businesses to large enterprises, and fighting it requires vigilance and community cooperation.

Conclusion

Beyond IP hijacking prevention, Nicholas continues building Stat Proxies, which offers static residential ISP proxies for various use cases including data collection, product purchasing, and internet research at scale. Knowing what stolen and gray-market IP supply looks like is exactly why we source ours the way we do. The full conversation is at Proxyway.