DITEK Ltd's last route disappeared, leaving Horlivka's repair burden unverified

Summary

• DITEK Ltd is a legally registered Ukrainian company with wireless telecommunications as its principal activity, and RIPE NCC still assigns AS9213 to it. Those administrative facts do not establish current retail service.
• RIPE routing history shows that AS9213 originated 194.8.248.0/23 and 91.237.204.0/22 until 18 May 2026. Both disappeared together. On 10 July, collectors saw no DITEK prefix, no IPv6 space and no neighbour.
• Immediately before the disappearance, every sampled path reached AS9213 through Redi's AS44539. DITEK's older registration still named AS6886 and AS3261, so the declared policy no longer described the observed route and cannot be treated as evidence of two current upstreams.
• A route withdrawal does not reveal whether the cause was a failed handoff, commercial disconnection, renumbering, power loss, physical damage or an intentional retirement. No current order page, price list, coverage map, customer measurement or public repair notice was found to prove paid service after the withdrawal.
• DITEK should therefore be treated as a historically real Horlivka regional ISP whose current end-to-end operating status is unverified. Any claim that it now delivers a resilient local connection needs fresh evidence from both the access layer and the upstream edge.

The same two prefixes went quiet

At 16:00 UTC on 18 May 2026, a simple public fact changed the interpretation of DITEK Ltd. Until then, global route collectors had been seeing two blocks originated by its autonomous-system number, AS9213. After that interval, they did not. The RIPE NCC routing-history view records 194.8.248.0/23 and 91.237.204.0/22 through the 08:00-15:59 interval on 18 May, with 325 full-feed peers seeing each route. Its 10 July routing-status view reports no announced IPv4 or IPv6 space, no observed neighbour and zero of 327 IPv4 peers seeing AS9213.

The simultaneous end matters. One block, 194.8.248.0/23, is registered under the DITEK name. The other, 91.237.204.0/22, is registered to Arden-A Ltd but has a route record with AS9213 as origin. They are separate address holdings with separate registry descriptions, yet both had the same public origin and vanished at the same boundary. That pattern points first toward a shared routing or upstream condition. It does not identify the underlying cause.

There are many plausible causes and no responsible way to select one without more evidence. A provider can deliberately withdraw routes during a migration. An upstream can stop accepting them. A border router, optical handoff or backhaul circuit can fail. A facility can lose power. A company can cease service while its legal and number-resource records remain. Customers can be moved to addresses supplied by another carrier, leaving the old autonomous system invisible even while a local access network continues.

Physical damage is another possibility in a city exposed to prolonged war, but the route record alone cannot distinguish it from a commercial or administrative change.

This is why the operating-status downgrade must be explicit. The route remained broadly visible before the final interval; it did not merely fade below one collector's horizon. RIPE's historical view from January 2024 shows both prefixes throughout that period, with normal fluctuations in collector coverage, until the May endpoint. More than seven weeks without either route is materially different from an eight-hour maintenance gap.

It is still not a customer outage certificate. Border Gateway Protocol tells the rest of the internet which address space can be reached through which autonomous system. It does not show the state of every rooftop radio, Ethernet switch, local cable, billing account or household receiver. A local network can remain powered but isolated. It can also continue under different addressing.

The right finding is therefore narrower than "DITEK closed" and stronger than "nothing can be known": the independent public routing surface represented by AS9213 was absent on the publication date, and no replacement service path attributable to DITEK has been established.

That finding changes the title question. A present-tense claim that DITEK makes a customer's current bill depend on upstream routes and field repair would assume the very thing that needs proving: a current customer, a current bill and a current service chain. The better inquiry begins with the withdrawal and asks what the old route can reveal about the network that once sat behind it, what the route cannot reveal about the local plant, and what evidence would be needed before calling the service live again.

A company record is not a working connection

DITEK is not a name invented by an address aggregator. RIPE NCC's AS9213 registration names DITEK Ltd, gives the autonomous system the name DitekAS and records its creation on 20 August 2002. The linked organisation record gives Ukrainian company number 25116962 and an address at 11 Pionerskaya Street in Horlivka, also transliterated in older records as Gorlovka. The DITEK maintainer record describes an ISP company in the same city.

The Ukrainian corporate trace goes further back. YouControl's company page says the limited-liability company was registered on 5 November 1997 and remained registered in its January 2026 view. It identifies wireless telecommunications, activity code 61.20, as the principal business. That is useful evidence of identity and intended line of business. It is not evidence that a subscriber could place an order in July, receive an installation or pass traffic.

The same page contains a sharp counter-signal. It says DITEK's value-added-tax registration was cancelled on 2 September 2015 after declarations reporting an absence of supplies. The legal entity remaining registered does not reverse that commercial signal. Nor does the tax item prove that all activity ceased in 2015: a company can change tax treatment, and AS9213 was visibly originating routes long after that date. Together, the two records show why status must be split into separate layers. DITEK had continuing legal identity. Its autonomous system had continuing route visibility.

Neither, by itself or together, proves a continuing retail broadband business.

Older traces confirm that DITEK once provided locally meaningful internet infrastructure. The 194.8.248.0/23 route record calls the block "DiTek ISP Company, Gorlovka Ukraine." Public documents from the early 2000s carried addresses under the ditek.dn.ua domain, including local civic organisations and a Horlivka chamber office. A 2010 Global Methane Initiative mine profile listed a ditek.dn.ua email address for a Horlivka coal mine. Those references show that the domain once functioned as local communications infrastructure, not merely as a corporate label.

They are historical references. The ditek.dn.ua host did not return a current address in a July 2026 DNS check. A live-looking commercial directory can also outlast a provider. The 2IP.ua Horlivka provider-rating page still lists DITEK with seven reviews, but exposes no current tariff, installation result, measured line or recent dated customer report on the page used here. It suggests historic market recognition. It cannot settle present availability.

Even specialised network pages disagree because they refresh at different times and describe different things. Hurricane Electric's AS9213 page continued to display the two familiar prefixes in a June update. IPinfo labelled the system inactive, with zero IPv4 addresses in its current routing summary. Cloudflare Radar retains an AS9213 identity page. These pages are useful corroboration and warnings about stale presentation, not substitutes for time-stamped route observations. A page can preserve an ASN's name after its traffic disappears, just as a company register can preserve a legal entity after its service changes.

The evidence therefore supports a precise description: DITEK was a real Horlivka ISP with its own autonomous-system number, its own registered /23 and a long-lived local domain. It remained a registered company in early 2026. Its routes were visible until May. What is missing is the bridge from those facts to current paid access: an orderable service address, a current tariff, an active support channel, a post-May route under different addressing, a customer-side measurement or a current statement from the operator.

One observed predecessor replaced an old two-carrier declaration

DITEK's old autonomous-system record looks reassuring at first glance. It declares imports, exports and default routes involving AS6886 and AS3261. Read casually, that can become a claim of two upstream carriers. Read as an operational document dated 2017, it is only a declaration of routing policy at that time. The observed paths immediately before the May withdrawal tell a different story.

A RIPE BGP-state snapshot for 17 May 2026 contains hundreds of collector paths for both DITEK-originated prefixes. In the sample, the autonomous system directly before AS9213 is consistently AS44539. A neighbour observation for 16 May identifies the same single left-side neighbour. This is strong evidence that AS44539 was the visible route predecessor at the end of AS9213's public life. It is not proof of the number of physical circuits, contractual terms or companies involved in field maintenance.

RIPE's AS44539 record belongs to Redi LLC and explicitly includes a policy entry accepting AS9213 and announcing routes to it. The linked Redi organisation record gives an address in Donetsk and identifies the country field as Russia. This administrative geography reflects a politically contested and occupied operating environment; it should not be converted into a statement about sovereignty. For network analysis, the important point is simpler: the observed route reached DITEK through a Donetsk-based network rather than through the two carriers still named in DITEK's older policy.

The older names illustrate different kinds of staleness. AS6886's 10 July routing status shows no current announced space and a last-seen route in December 2024. AS3261, by contrast, remained visible with 19 IPv4 prefixes and numerous neighbours. That does not show whether DITEK retained a dormant contract, spare circuit or private connection to either one. It shows only that the two-line policy in the old registration cannot be counted as two working DITEK exits in 2026.

Nor does one visible autonomous-system neighbour necessarily mean one fibre. Redi could have delivered more than one circuit over different paths, or DITEK traffic could have reached two Redi points of presence while appearing under one AS number. Conversely, two separately invoiced circuits can share a duct, power feed, building entrance, optical span or upstream router and fail together. Route diversity and physical diversity are related but not interchangeable.

The absence of a PeeringDB network entry for ASN 9213 provides another bounded clue. It means no DITEK network profile was returned there; it does not prove the operator never peered or never used an exchange. The public BGP view is more decisive for the final period: one observed predecessor, no visible IPv6 route and no public evidence of a second current exit.

The address count also needs care. AS9213 originated a /23, which contains 512 IPv4 addresses, and a /22, which contains 1,024. The latter is registered to Arden-A, not DITEK. Adding them to call DITEK a 1,536-address retail network confuses route origination with ownership and customer use. Addresses may serve infrastructure, customers, servers, translated sessions or another network. They can be allocated but idle. They can remain in an old commercial inventory after withdrawal.

The correct capacity statement is that AS9213 publicly originated two IPv4 blocks immediately before 18 May; it had no observed IPv6 announcement, and the number of active customer addresses is unknown.

Route security was also incomplete in the public view. RIPE's validation checks for 194.8.248.0/23 and 91.237.204.0/22 returned no validating Route Origin Authorisations and an unknown state. That did not cause the May disappearance, as far as public evidence shows. It did mean relying networks lacked a cryptographic authorisation saying AS9213 was permitted to originate those prefixes. For a small operator dependent on one observed route predecessor, origin protection would have removed one avoidable ambiguity from an already opaque edge.

The access network is still the missing asset

An autonomous system is an administrative routing boundary, not a photograph of a network. It does not say whether DITEK reached customers by rooftop radio, coaxial cable, copper pairs, Ethernet strung between buildings, buried fibre or a mixture accumulated over decades. The corporate activity code supports a wireless telecommunications history. The old ISP description supports local access. Neither supplies a tower list, fibre map, pole agreement or current inventory.

Horlivka's built form makes several architectures plausible. A dense urban core, low-rise residential districts, industrial sites and taller structures can support neighbourhood Ethernet, point-to-point radio and fixed-wireless sectors. Mine and industrial facilities can create demand for dedicated links. Apartment buildings can concentrate many subscribers behind one building entry, improving the economics of a small provider. Detached homes and damaged or depopulated districts can reverse that advantage by increasing metres of plant and technician travel per paying line. Plausibility is not evidence of DITEK's exact design.

The ownership boundary is equally unclear. DITEK's own /23 and AS number show control at the internet addressing edge. They do not show ownership of the local poles, rooftops, towers, ducts, fibre strands, rooms or electrical service supporting that edge. A small provider can own customer radios and switches while leasing building access, dark fibre or transit. It can operate electronics on a partner's mast. It can resell service over someone else's plant. Each arrangement changes who can authorise repairs and how quickly a failed span returns.

The public record offers no current evidence of a ring, alternate tower, separated building entrance or geographically diverse upstream handoff. It does not publish backup-power duration, spare radios, optical modules, cable reels, vehicles, staffing levels or emergency access rights. It does not show whether the old Pionerskaya Street address was a network operations site, an office, both or neither by 2026. Calling the site a core facility would be an invention.

This gap is especially important because AS9213's two routes disappeared together. If both blocks were attached to one border router, one upstream session or one powered room, a failure there would explain the shared endpoint. If they were announced from redundant routers over separate circuits, the shared endpoint would require a broader event or a deliberate withdrawal. Without router locations and circuit paths, the route pattern establishes a common public outcome but not the physical common cause.

War damage makes unsupported specificity more dangerous, not less. The ITU's assessment of Ukraine's telecommunications infrastructure found that power outages and damaged infrastructure repeatedly disrupted service, particularly in occupied regions. It also documented the extraordinary scale of technician mobilisation by national operators. Those national findings establish credible failure mechanisms. They do not show that a shell cut DITEK's cable or that DITEK employed any particular number of technicians in May 2026.

The safest physical description is therefore functional rather than invented. A DITEK customer connection, when the service operated under AS9213, required a premises link into local access plant; an aggregation point; power for active equipment; transport to a routing edge; and a handoff into upstream reachability. Some elements may have been shared with Arden-A or other local operators, given the second prefix's registration, but route origination alone cannot establish a corporate or physical arrangement. The specific medium, locations, ownership and current condition remain unverified.

Installed capacity is not usable capacity

Small-provider coverage claims often collapse three separate quantities. Installed capacity is the hardware and address space put in place. Usable capacity is what can carry acceptable traffic after signal loss, contention, equipment faults and overhead. Recoverable capacity is what remains when the primary path fails. DITEK's public record gives only fragments of the first and almost none of the other two.

The two IPv4 prefixes are the most visible fragment. They define possible address space, not throughput. A /23 does not specify whether the upstream handoff was 100 Mbps, 1 Gbps, 10 Gbps or something else. It does not reveal oversubscription, peak traffic, route filters, latency or packet loss. The /22 registered to Arden-A enlarges the advertised address footprint but says nothing about how many addresses were in active use behind AS9213. No public IPv6 route means there was no independently visible native IPv6 surface, although private or upstream-supplied arrangements cannot be excluded.

The physical side is even less measurable. A wireless base station can be installed and powered while offering poor service at the edge of a sector. A fibre strand can exist while a damaged splice, unpowered switch or missing optic makes it unusable. A building can have a distribution switch with too little surviving backhaul for evening demand. A second upstream session can exist but carry only a small fraction of normal load. A spare radio on a shelf is not recovery capacity until a technician can reach the site, install it, align it and restore configuration.

The World Bank's fifth Ukraine damage and needs assessment estimates $2.5 billion in damage to telecommunications, digital and media assets through the end of 2025 and $7.1 billion in recovery and reconstruction needs for 2026-2035. That scale places any local network inside a national competition for power equipment, cable, electronics, finance and skilled labour. It does not give DITEK's balance sheet or repair bill. It explains why an old route and allocated addresses cannot be mistaken for a fully usable local service.

There is also a density question. A neighbourhood provider pays fixed costs for upstream transit, core equipment, support availability and site access whether it serves 200 customers or 2,000. Revenue, however, depends on connected paying lines. Population displacement, damaged premises, business closure and competing providers can reduce the number of billable endpoints without reducing the kilometres of plant or number of sites needing inspection. Each surviving subscriber then carries a larger share of the fixed burden.

This is the mechanism behind the local connectivity bill, but it should be stated conditionally for DITEK. If a paid DITEK service still exists, the bill would reflect more than bandwidth. It would carry the cost of keeping access equipment powered, retaining or contracting local technicians, obtaining replacement parts, reaching sites safely, maintaining an upstream handoff and holding enough spare capacity to survive a fault. If the old customer base has already migrated, the same assets may no longer support an economic service at all. The public evidence does not reveal which condition applies.

Useful capacity evidence would include busy-hour throughput at the upstream port, active subscriber counts by access type, sector or switch utilisation, packet loss under load, backup runtime, failover test results and spare-port headroom. None is public. A current speed test from one address would improve the operating-status finding but still not establish network-wide capacity. A credible assessment needs both broad measurements and the physical route that produced them.

Power turns every active node into a maintenance promise

Every plausible DITEK access technology has a power dependency. A rooftop wireless relay needs electricity for radios, switches and backhaul. An apartment Ethernet network needs powered aggregation. Passive optical fibre reduces the number of field-powered elements but still needs an optical line terminal at the provider end and a powered terminal and router at the customer premises. The border router and upstream handoff need power even if every local cable remains intact.

Ukraine's experience shows how quickly this dependency becomes operational. The ITU assessment described power outages as a principal cause of complete communications disconnection in places of active hostilities. It reported thousands of repair visits and extensive use of traffic rerouting by larger operators. Those operators had scale, mobile assets and national teams. A small Horlivka provider would face the same electrical physics with fewer sites over which to spread generators, batteries, fuel logistics and specialist staff.

The national standard has moved toward long autonomy. A January 2026 Ukrainian government communications-without-power update said 92 percent of mobile base stations had batteries designed for up to eight hours, 36.4 percent had generators capable of more than three days, and the state and operators aimed for at least 72 hours of autonomous operation. Those are mobile-sector figures, not DITEK specifications. They provide a useful benchmark for the questions a fixed provider should answer: how long does each essential node run, who refuels it, and does the upstream site survive the same outage?

No public DITEK record answers those questions. Batteries may have existed at a central room and nowhere else. A generator may have served one facility while rooftop or building switches failed earlier. Fuel may have been available but inaccessible. A customer may have lost household power before the provider exhausted its reserve. Even a fully backed-up DITEK core would not preserve service if AS44539's local handoff, an intermediate transport node or the customer's own receiver lost power.

Common power domains can also defeat apparent route diversity. Two circuits entering the same room can terminate on separate routers and still fail when the room's battery empties. Two wireless sites can use separate radio paths and share one distribution feeder. Two fibres can follow separate streets and converge at an unprotected upstream facility. A resilience claim needs a dependency map that crosses company boundaries, not just a count of circuits.

The wider energy burden remained severe. Ukraine's State Energy Supervision Inspectorate reported in January 2026 that specialists had examined almost 10,000 damaged power-network facilities since the full-scale invasion, including around 2,000 during 2025. That is national evidence and cannot be assigned to a DITEK site. It does show that communications power planning operates amid damaged generation, transmission and distribution assets, not against an ordinary utility baseline.

For customers, reserve power has two clocks. The first is the provider clock: how long the access node, aggregation, edge and upstream remain alive. The second is the premises clock: how long the customer's receiver, optical terminal, router and device remain powered. Service fails when the shorter critical clock expires. A fair commercial offer in this environment would tell customers what equipment they must back up, its approximate load and the limits of provider-side autonomy. No current DITEK service page was found to make that promise.

Field repair is the network's scarce local capacity

The final metre of recovery belongs to a person. Someone has to identify whether the fault is at the premises, on a building, along a pole line, inside an equipment room or at the upstream handoff. Someone has to obtain access, carry the right replacement, make a safe repair and verify that traffic has returned. In a compact regional ISP, that knowledge can reside in very few people.

The ITU report gives the scale at the other end of the market. It described hundreds of technicians and thousands of repairs by major Ukrainian operators during 2022. A RIPE Labs analysis of Ukrainian internet resilience reached a complementary conclusion: the country's decentralised network of many operators improved systemic resilience, but local networks still went dark when routers, fibre and electricity failed. Decentralisation protects the country from one national switch-off. It does not guarantee that a particular small provider can replace its only specialist or reach its only failed site.

DITEK's public records name administrative and technical contacts, but publishing those historical names does not establish current staffing. There is no current vacancy page, technician roster, depot, service-level promise or repair notice. The 2IP listing confirms that customers once recognised the provider, not how quickly it now answers a fault. The correct labour finding is therefore a dependency without a verified quantity: any remaining service needs local hands, but the available team and response radius are unknown.

This uncertainty has direct economic consequences. Keeping an experienced technician available carries a fixed cost. Outsourcing converts some of that cost into a call-out charge but may lengthen response and weaken site knowledge. Maintaining spares ties up cash in radios, optics, power supplies, batteries, cable and connectors that may never be used before ageing out. Holding too few spares saves money in normal weeks and extends outages in the one week that matters.

Access rights can be as constraining as skill. A technician may know exactly which device failed but lack permission to enter a roof, mine site, apartment basement, utility corridor or upstream facility. Safety conditions can block a visit. A damaged route can prevent a vehicle from reaching the site. A power fault can require coordination with an electricity operator before communications work begins. These are general failure mechanisms; no public account shows which applied to DITEK on 18 May.

The local labour burden also grows as customer density falls. If technicians travel the same streets for fewer paying lines, each repair consumes more revenue per subscriber. If a district becomes inaccessible, the provider must decide whether to hold capacity for customers it cannot reliably reach. If upstream service is restored before the access layer, the global route can return while customers remain offline. If the access layer survives but the border route does not, technicians can see healthy local links without delivering the internet.

The labour test for DITEK is therefore not simply whether a telephone number exists. It is whether there is a reachable support channel, a current team or accountable contractor, safe and authorised access to critical sites, a spare inventory near the service area, and a documented escalation path to the upstream. Evidence of one completed post-May repair would be more valuable than several undated provider listings. No such public repair account was found.

The likely failure sequence has several branches

The last route observation gives an endpoint but no alarm log. A useful assessment should map the branches without pretending one is confirmed.

The first branch is upstream loss. AS9213's two prefixes had one observed predecessor, AS44539. If the session between them failed, if Redi stopped accepting the routes or if the common handoff lost power, both prefixes could disappear together while DITEK's local access equipment remained intact. Customers using those addresses would lose external reachability. Local services inside the network might still work, but no public measurement establishes that they did.

The second branch is edge failure. One router, one configuration error or one powered room may have originated both blocks. Failure at that point would produce the same global symptom. A redundant design would use separate routers, separate power, separate handoffs and tested automatic failover. No public source establishes any of those protections. The repeated appearance of AS44539 immediately before AS9213 in observed paths shows a common logical dependency; it does not reveal whether the edge hardware itself was singular.

The third branch is a deliberate change. DITEK or an upstream could have retired AS9213, moved customers behind another autonomous system, or renumbered infrastructure. That would make the old prefixes vanish without a physical outage. This explanation needs a new route, current customer address, service notice or updated contact. None was identified. The possibility must remain open because route withdrawal is a normal network operation as well as an outage symptom.

The fourth branch is local power or facility loss. If the routing edge was in Horlivka and its reserve power ended, both announcements could stop. If the edge sat elsewhere, a damaged transport circuit from Horlivka could isolate it differently. The RIPE organisation address is not a router location, so the city cannot be assigned to the border equipment from that field alone. The World Bank RDNA5 and ITU assessment make power and physical damage credible regional risks, but they do not locate DITEK's edge.

The fifth branch is commercial cessation. The 2015 tax signal, absent current website, lack of order evidence and seven-week route absence make this more plausible than the legal registration alone would suggest. They still do not prove liquidation or closure. The company remained registered, the organisation record was updated in May 2026, and routes were visible days after that update. Administrative activity can accompany cleanup, sponsorship changes or continuing operations; the update's meaning is not public.

The sixth branch is prolonged access-layer attrition. A provider can remain globally visible while losing customers one building or one street at a time. Broken drops, failed radios, missing power and inaccessible sites reduce usable service without changing the BGP route. When the final route then disappears, public observers see only the end of a decline. Conversely, the access network can remain largely usable until one common upstream failure removes everything at once. There are no current DITEK customer measurements to choose between those shapes.

The shared withdrawal of both prefixes slightly favours a common edge or upstream explanation over two unrelated access failures at exactly the same time. That is an inference, not a finding about cause. It should guide the next evidence request: start with the AS9213-AS44539 handoff and the origin routers, then work outward to power and local plant. It should not be converted into a claim that Redi disconnected DITEK, because no commercial notice or operator statement supports that wording.

Recovery would also differ by branch. An upstream session can sometimes return remotely. A failed border router needs powered replacement hardware and a known configuration. A fibre cut needs location, access, cable and splicing. A dead rooftop relay needs a site visit and alignment. A commercial migration needs customer renumbering and support. A closed operator has no normal recovery path; customers need another provider. One global symptom can therefore correspond to minutes, weeks or permanent change.

The people affected cannot be counted from the prefix

The 1,536 IPv4 addresses seen under AS9213 are not 1,536 customers. Some could have been unused, assigned to infrastructure, shared through translation, used by businesses with multiple addresses or associated with the Arden-A block. No active-subscriber count is public. The number of households, companies or institutions affected by the May withdrawal is therefore unknown.

The types of harm are easier to identify. A household loses messaging, education, entertainment and access to online services. A small business can lose payments, ordering, cloud applications and contact with customers. A mine, workshop or civic office can lose remote access and routine communications even if its operational systems use separate links. People with only one fixed connection bear more risk than those who can switch to mobile or satellite service. None of these user groups should be claimed as a confirmed DITEK customer without a current record.

The condition of occupied Horlivka raises the stakes while increasing uncertainty. An analysis by Occupied.media described residents linking utility failures with internet loss and reported severe maintenance difficulties in Horlivka and Donetsk. It is a contextual account, not a DITEK incident report. It suggests that shared power and utility failures can reach communications at household level; it cannot identify which ISP failed or whether AS9213 was involved.

Alternative access also cannot be assumed. The 2IP page lists several historical providers in Horlivka, but a list is not a current coverage test. Mobile service can fail with power or congestion. Satellite service needs equipment, an open view of the sky, power and affordability. A second fixed provider may share the same upstream or utility corridor. The practical impact of DITEK's disappearance would depend on whether customers had a physically and commercially independent substitute.

For that reason, the most important customer metric is not the old address count but the number of premises with only one usable path. A resilient local market needs diversity at several layers: another access network, another powered aggregation site, another transport route and another upstream. Two provider names on a bill comparison page do not guarantee those layers are separate.

Current customer evidence would settle both scale and consequence. A set of dated measurements from known DITEK service addresses, with privacy protected, could show whether traffic continued under different addressing. Current invoices or installation offers could establish paid service. Fault reports could reveal duration and geography. Without those, the article can identify who would be exposed by a small-provider failure but cannot honestly put a number beside them.

What would reverse the downgrade

The evidence needed to restore a current-operating assessment is practical and obtainable. First, show that a customer can order service at a specific Horlivka address and identify the access technology. A current tariff, installation terms, support contact and dated confirmation would bridge the gap between legal existence and retail availability. A generic directory listing would not.

Second, show the end-to-end route. If AS9213 returns, collector visibility should identify the prefixes and observed predecessors. If DITEK now uses upstream-assigned addresses or another autonomous system, a customer-side trace and an operator explanation should establish that arrangement. This would not require publishing sensitive topology. It would require enough information to distinguish a migration from a dead route.

Third, identify the physical operating surface at a safe level of detail: access medium, approximate service area, number of essential aggregation sites, and whether the primary upstream handoff is inside or outside Horlivka. Exact coordinates need not be public in a conflict environment. The aim is to establish that there is maintained plant and to locate the major ownership boundaries.

Fourth, document failure independence. Two upstream contracts matter only if their paths, terminations and power domains are sufficiently separate. A second radio sector matters only if it can carry affected customers at busy hour. A backup generator matters only if it powers the full service chain and can be refuelled. A spare router matters only if configuration and staff are available. A dated failover result would answer more than a broad redundancy claim.

Fifth, document local repair capability. A current support response, named accountable contractor, typical restoration target, spare inventory and safe-access arrangement would show that local labour exists as usable capacity. The CISA guidance on extreme-weather communications, though written for another hazard environment, captures a broadly applicable rule: power, route access, damage assessment and the right mix of repair specialists must be coordinated before communications return. In Horlivka, safety and access conditions would make that coordination more difficult.

Sixth, establish route-origin protection. A valid authorisation for each originated prefix would not prove retail service or physical resilience, but it would clarify which autonomous system is permitted to announce the space and reduce one routing-security risk. The absence of a public authorisation in July leaves both old prefixes in an unknown validation state.

Seventh, reconcile the company and service records. The registered legal status, 2015 VAT cancellation, May 2026 organisation update and May route withdrawal form a sequence, but not an explanation. A current statement from DITEK could say whether it serves customers, operates only infrastructure, has migrated, is suspended or has ceased. Until then, administrative activity should not be read as network availability.

These tests are deliberately stricter than finding a pingable address. One responsive host could sit in a remote facility while the local access network is gone. One customer could remain connected while most of the footprint is unusable. One returned route could carry no meaningful traffic. Current operating evidence needs to join a customer-facing service, maintained physical access, powered aggregation and a working upstream path.

A historical ISP with no verified current edge

DITEK's history is clearer than its present. The company was registered in Horlivka in 1997. AS9213 followed in 2002. Its local domain appeared in civic and industrial contact records, and its own /23 was explicitly described as a Horlivka ISP network. This was a real local communications business, not a stray ASN label.

Its final public routing shape was also clear. Two IPv4 prefixes, no observed IPv6 route, and one visible predecessor led into AS9213. The old record naming two other carriers was stale as an account of observed 2026 routing. Both prefixes disappeared after 18 May, and neither had returned by 10 July. No current public service evidence fills the gap.

The network evidence grade is therefore negative for current end-to-end operation, not negative for DITEK's historical existence. There may be dormant assets, local links, migrated customers or private arrangements that public route collectors cannot see. There may also be no remaining paid service. The difference matters to anyone assessing the cost of connectivity, because an allocated prefix and a registered company can survive long after the repair organisation, upstream contract or customer base that made them useful.

DITEK's case leaves one firm infrastructure lesson. A small regional connection is not made resilient by an autonomous-system number, an old two-carrier policy or two address blocks. It is made resilient by maintained access plant, independent powered routes, available spares and people who can reach the fault. The public record proves that AS9213 once supplied the routing edge for a Horlivka ISP. As of 10 July 2026, it does not prove that anyone can still buy the service behind that name.