01.11.2024
2 min
1188
Ukraine’s Center for Countering Disinformation and private intelligence company Molfar Intelligence investigated the activities of the Crimean IT company TigerWeb, its founder Yevgeny Shevchenko, and their links to the Portal Kombat / Pravda information infrastructure. The analysis examined technical attribution evidence, the evolution of the network and its ZOV segment, TigerWeb’s current role, and potential grounds for Ukrainian sanctions.
According to the researchers’ findings, TigerWeb has maintained infrastructure links with Portal Kombat / Pravda for many years. Archival materials, contact details, and technical indicators point to the company’s significant involvement in creating and administering the network’s websites. They also reveal technical continuity between early news aggregators, later Pravda resources, and TigerWeb’s infrastructure.
Public exposure and sanctions have failed to stop Portal Kombat / Pravda. As of 2026, the network remains an active tool of information influence, continues to expand its geographical and linguistic reach, and automatically republishes content from Russian state media and Telegram channels.
Current evidence also indicates that TigerWeb’s operational and infrastructure ties to the system remain intact. In the EU’s consolidated sanctions legislation as of July 2026, the company is still described as the operator of Portal Kombat, while no verified evidence has emerged that the network was transferred to another identified technical operator. At the same time, open-source information does not establish that TigerWeb directly manages every active domain or serves as the sole strategic coordinator of the entire operation.
The company continues to present itself as a web studio with expertise in web development, SEO, and digital advertising. Researchers found no evidence that formal control over TigerWeb has changed or that the network has been transferred to another organization.
Viktor Artemyev and Yuriy Vlasenko are named on some of the network’s websites as members of its editorial and administrative teams. However, no independently verified biographical, corporate, or technical information about them has been found in open sources. This may indicate that the identities are fictitious and used only to populate the websites’ editorial pages.
The new findings are consistent with the Center’s previous assessments. In January 2026, it separately examined the ZOV network, which primarily targets Ukrainian audiences. In April, the Center described Portal Kombat as a broader ecosystem comprising the Pravda and ZOV segments.
Yevgeny Shevchenko and TigerWeb have been under European Union sanctions since July 15, 2025. Moldova imposed its own restrictions on them on August 25 of the same year. In both cases, the measures cited their involvement in Portal Kombat and in coordinated information manipulation and interference.
For Ukraine, the TigerWeb case demonstrates how civilian web infrastructure can be used for years to provide technical support for information influence operations. According to the authors of the analysis, the collected evidence provides grounds for considering Ukrainian sanctions against the company and Shevchenko, alongside technical measures and cooperation with international partners aimed at restricting the network’s continued operation.
TigerWeb describes itself as a Simferopol-based web studio offering website development, design, search engine optimization, advertising, hosting, and technical support. As of August 21, 2026, the company’s official website remained accessible, with “2015–2026” displayed in its footer.
TigerWeb’s careers page states that the company is continuously recruiting. Current openings include positions for a web developer, an SEO specialist, and a contextual advertising specialist. This suggests that TigerWeb not only maintains a public presence but also claims to retain expertise in areas essential to developing, promoting, and maintaining web resources.
Corporate registry records provide further context. According to its RBC Companies profile, TigerWeb LLC remains an active legal entity and is listed in the register of state support recipients, although it received no such assistance during the past year.
TigerWeb’s actual operations began before the Russian legal entity was established. DFRLab and CheckFirst traced the agency’s activities back to at least 2013, while TigerWeb LLC was not registered under Russian law until 2019.
In European Union sanctions documents, the company is identified by registration number 1199112018973 and the website tigerweb.ru and is described as the entity operating Portal Kombat. Meanwhile, TigerWeb’s current team page identifies “Denis” as the studio’s founder and “Yevgeny” as the head of backend development. Since the page provides no surnames or other identifying information, these entries do not confirm any change in the company’s formal control and do not contradict sanctions documents identifying Yevgeny Alexandrovich Shevchenko as TigerWeb’s founder.
EU documents identify Yevgeny Alexandrovich Shevchenko as the founder of TigerWeb. The authors of the DFRLab / CheckFirst investigation traced his involvement in the development of a network of news aggregators back to at least 2011. At the time, he helped create the Crimean aggregator Crimea News, which researchers consider one of the early predecessors of the future Pravda ecosystem.
By 2013, TigerWeb was already operating as a web agency, while websites sharing technical indicators with tigerweb.ru began appearing in 2014. An archived résumé cited in the DFRLab / CheckFirst investigation indicates that Shevchenko worked as a project manager at Krymtekhnologii between 2015 and 2016. According to DFRLab, the company developed digital resources for the Russian administration in occupied Crimea, including its government portal. This points to Shevchenko’s longstanding professional presence within Crimea’s IT sector following the occupation of the peninsula.
TigerWeb continued working with occupation authorities after the beginning of Russia’s full-scale invasion. In 2021, the studio created a website for the Republican Assessment Center. As DFRLab / CheckFirst found, in December 2022 the Russian occupation administration in the Zaporizhzhia region hired this organization to provide property valuation services.
Shevchenko was added to the EU sanctions list on July 15, 2025. The Council of the EU’s official justification identifies him as a Russian citizen, the founder of TigerWeb, and the holder of tax identification number 910202780107. The document links him to the operation of Portal Kombat and involvement in coordinated information manipulation and interference threatening the stability and security of the European Union or one or more of its member states.
This attribution is not based solely on the sanctions decision. The French agency VIGINUM also explicitly identifies Shevchenko as one of TigerWeb’s founders and states that he has been involved in developing and maintaining websites since at least 2013. DFRLab / CheckFirst additionally traced links between his professional activities, TigerWeb’s technical infrastructure, and early websites that later evolved into Portal Kombat / Pravda. Evidence from several independent sources substantially strengthens the case for this connection.
The most systematic initial attribution was published by VIGINUM, the French agency responsible for countering foreign digital interference. In the second part of its Portal Kombat investigation, published on February 14, 2024, the agency described TigerWeb’s significant role in developing and administering the network’s websites. Its conclusions were based not only on published content but also on a combination of archival, contact, and technical indicators.
Researchers found the TigerWeb logo accompanied by the phrase “Development and Technical Support” on archived versions of several websites, directly identifying the company as their developer and technical contractor. VIGINUM also discovered the email address [email protected] on older copies of the websites and linked it to Yevgeny Shevchenko. In addition, a URL containing the domain lugansk-news.ru was found on TigerWeb’s website. Together, these traces connected the studio’s commercial infrastructure with the network’s early components.
At the same time, the French agency did not equate the technical contractor with the operation’s strategic sponsor. VIGINUM suggested that TigerWeb may have provided technical services to another operator whose identity had not been established. The evidence therefore confirms the company’s important role in creating and managing the infrastructure but does not prove that it independently determined every information objective or served as the operation’s sole decision-making center.
In February 2025, DFRLab and CheckFirst independently confirmed the attribution and uncovered additional technical evidence. Researchers identified a shared Google AdSense code on tigerweb.ru and several news websites, historical overlaps in DNS records and IP addresses, identical Google Analytics identifiers on early resources, and SSL certificates containing tigerweb.ru domain values on servers within REG.RU address ranges.
Researchers also found that older websites with names ending in “-news” and newer Pravda resources used the same internal API with identical parameters. This indicates technical continuity between different generations of the network.
According to VIGINUM, Portal Kombat consisted of 193 information portals in February 2024. By April 29, 2024, VIGINUM had identified 224 resources targeting audiences in nearly every EU member state, as well as several countries in Africa and Asia.
Over time, the system evolved from a collection of local Russian and Ukrainian news aggregators into multilingual infrastructure. It produces little original reporting, instead automatically republishing content from Russian state media, government institutions, and pro-Russian accounts.
The network did not disappear after being publicly exposed. DFRLab / CheckFirst documented its continued expansion throughout 2024 and 2025, along with the gradual concentration of much of its technical infrastructure around news-pravda.com. By early 2025, researchers had identified 140 subdomains targeting audiences in more than 83 countries and regions.
A DFRLab investigation published on April 3, 2026 reported that Portal Kombat continued operating through more than 150 websites, automatically translating and distributing content in over 80 languages. As of March 2026, the network’s five most frequently used sources included TASS, RIA Novosti, Lenta, Komsomolskaya Pravda, and RT.
Because some of these media organizations or their affiliated entities are subject to sanctions or other restrictions, republishing their content through formally independent domains provides an additional way to circumvent limits on the distribution of Russian state media.
The scale of the network is also demonstrated by an online platform created by DFRLab and CheckFirst, which collects information about identified Pravda / Portal Kombat resources and updates every hour. Researchers have recorded more than 3.7 million publications that reused content from Russian media and circulated messages from questionable Telegram channels. The project’s interactive map covers more than 110 countries and regions.
Another DFRLab / CheckFirst investigation found that Pravda domains had been cited on Wikipedia, in X Community Notes, and in responses generated by popular AI systems. This means the infrastructure’s potential influence is no longer limited to its own websites.
Ukraine’s Center for Countering Disinformation has also examined the network on several occasions. In a report published on March 31, 2025, the Center explained how Pravda’s mass reproduction of pro-Russian narratives could cause them to appear in responses generated by artificial intelligence systems.
On January 14, 2026, the Center published a separate analytical report on the ZOV network, which primarily targets Ukrainian audiences. By early 2026, the Center had identified 68 websites, 40 Telegram channels, and 40 VKontakte pages within this segment, localized for 23 regions and 17 major Ukrainian cities.
In a subsequent analytical report examining attempts to discredit Ukraine amid escalating tensions in the Middle East, the Center described Portal Kombat as a broader ecosystem comprising two main segments. Pravda primarily targets international audiences, while ZOV focuses on Ukraine.
This division is consistent with DFRLab / CheckFirst’s technical findings regarding the shared architecture of the older “-news” network and the newer Pravda resources. Treating ZOV as a separate segment helps researchers examine its target audiences and localized content, but it does not negate its infrastructure links to the broader Portal Kombat system.
Data available as of August 2026 indicates that TigerWeb’s ties to Portal Kombat / Pravda remain intact. In July 2025, the Council of the EU imposed sanctions on TigerWeb and Yevgeny Shevchenko specifically because of their involvement in the operation of Portal Kombat. In the consolidated version of the EU Regulation as of July 13, 2026, the company is still described as the entity managing this information manipulation project.
In April 2026, DFRLab explicitly identified TigerWeb as the company behind the Pravda Network and confirmed that the network continued operating after the EU sanctions were imposed. Meanwhile, a 2025 technical investigation by DFRLab / CheckFirst demonstrated continuity between different generations of websites through shared APIs, server indicators, analytics identifiers, and advertising markers.
TigerWeb’s own website provides additional indirect evidence. As of August 2026, it continued to advertise vacancies in web development, SEO, and digital advertising. The company therefore publicly claims to retain expertise directly relevant to maintaining this type of infrastructure. At the same time, there have been no verified reports that the network was transferred to another identified operator.
However, open-source information does not make it possible to determine whether TigerWeb has direct access to every domain registrar account, DNS zone, administrative panel, or server. It is therefore more accurate to speak of continuing operational and infrastructure links rather than proven day-to-day administration of every individual website by the company.
There is also insufficient evidence to consider TigerWeb the operation’s sole strategic sponsor. VIGINUM did not rule out the possibility that the web studio may have acted as a technical contractor for another operator whose identity has yet to be established.
TigerWeb’s involvement in creating and administering the network is therefore documented, while current official and research sources continue to link the company to the management of Portal Kombat. No information about a new technical operator has emerged, although open sources do not reveal the precise extent of TigerWeb’s current control over specific resources.
The names Viktor Artemyev and Yuriy Vlasenko, which appear on some of the network’s websites, raise a separate set of questions. In 2025, DFRLab noted that both men were presented as members of a new editorial team after dnr-news.ru was redesigned in 2024. Researchers viewed this primarily as an attempt to make the website appear more professional and transparent rather than evidence that a new operator had taken control.
A similar pattern remained visible in August 2026. On the pages of Lenta Novostey Kharkova and Lenta Novostey Odessy, Artemyev is identified as the owner and editor-in-chief, while Vlasenko is listed as the administrator. The repetition of the same names and positions across template-based websites is consistent with the network’s centralized presentation, but it does not confirm that these individuals actually control its servers or domains.
No independently verified biographical, corporate, or technical information confirming the existence of Artemyev and Vlasenko, their involvement in the network, or the transfer of TigerWeb’s responsibilities to them could be found in open sources. The lack of such evidence, combined with the repetition of identical names and roles across similar websites, suggests that they may be fictitious identities used to populate editorial information pages.
References to Artemyev and Vlasenko should therefore be treated as indicators requiring further investigation, not as evidence that Portal Kombat / Pravda has changed its technical operator.
On July 15, 2025, the Council of the EU added TigerWeb and Yevgeny Shevchenko to its sanctions list. EU Implementing Regulation 2025/1444 identifies Shevchenko as the company’s founder and describes TigerWeb as a Crimean web company that manages Portal Kombat and participates in coordinated information manipulation and interference.
The consolidated version of the EU sanctions regulation dated July 13, 2026 retains this designation. On August 25, 2025, Moldova also imposed national restrictive measures on Yevgeny Shevchenko and TigerWeb.
Despite the sanctions imposed by the EU and Moldova, DFRLab documented the continued operation of the Pravda Network in April 2026. The system continues to translate and distribute content from Russian state and sanctioned media outlets to international audiences on a massive scale, effectively reintroducing it into the information environment through alternative domains and language versions.
The same investigation noted that, as of April 3, 2026, Ukraine had not imposed its own sanctions on either TigerWeb or Shevchenko. This strengthens the case for national restrictions combined with measures designed to limit the network’s access to domain registration, hosting, and other technology services.
Ukraine’s Law on Sanctions allows restrictive measures to be imposed on foreign individuals and legal entities whose actions create real or potential threats to Ukraine’s national interests, security, sovereignty, or territorial integrity, or contribute to such threats.
In the case of TigerWeb and Yevgeny Shevchenko, several complementary sources of evidence are available: VIGINUM’s official attribution, the technical findings of DFRLab and CheckFirst, sanctions decisions adopted by the EU and Moldova, Portal Kombat’s continued operation, and the network’s systematic targeting of Ukrainian and international audiences. Taken together, these facts provide sufficient grounds for Ukraine to consider imposing its own sanctions.
TigerWeb demonstrates how ordinary web development, SEO, hosting, and technical support services can become the foundation of a long-running information influence operation. Evidence confirms the company’s longstanding technical ties to Portal Kombat / Pravda, while the network continues to expand, circumvent restrictions, and distribute Russian state content in dozens of languages. At the same time, open sources do not establish that TigerWeb is the operation’s sole strategic center or prove that it exercises daily control over every website. Any potential Ukrainian sanctions should therefore be considered alongside technical and international measures capable of restricting the network’s access to the infrastructure it needs to continue operating.
