The Center for Countering Disinformation (hereinafter – Center), together with the private intelligence company Molfar Intelligence (hereinafter – Molfar), carried out an analysis of the activities of IT company TigerWeb (TigerWeb LLC / ООО ‘Тайгервеб’), which operates in the temporarily occupied territory of the Autonomous Republic of Crimea, the activities of Yevgeny Shevchenko, and their links to the Portal Kombat / Pravda information infrastructure. The analysis focussed on evidence of technical attribution, the evolution of the network and its ZOV segment, its current operational status, the present role of TigerWeb and Y. Shevchenko, and the grounds for the imposition of sanctions by Ukraine.

As a result of the analysis, the Center and Molfar reached the following conclusions:

• TigerWeb has a confirmed long-standing infrastructural link to the Portal Kombat / Pravda network. Taken together, archival, contact and technical indicators confirm the companyʼs significant role in creating and administering the networkʼs websites, as well as the technical continuity between the early news aggregators, the later Pravda resources and TigerWebʼs infrastructure.
• Portal Kombat / Pravda did not cease operations following its public exposure and the imposition of sanctions. The network continued to expand geographically and linguistically, automatically republishing content from russian state media and Telegram channels, and as of 2026 remains an active infrastructure for information influence.
• Taken together, the current data confirm that TigerWebʼs operational and infrastructural link to the network persists. In the consolidated EU sanctions instrument as of July 2026, TigerWeb continues to be identified as the company operating Portal Kombat, while no publicly confirmed evidence has been found that the network was transferred to another identified technical operator. At the same time, an analysis of open-source data provides no grounds for stating that TigerWeb directly administers every active domain or is the operationʼs sole strategic coordinator.
• TigerWeb continues to operate as a web studio and states that it retains capabilities in web development, SEO promotion and digital advertising. The available data provide no grounds for concluding that formal control over the company has changed or that the network has been transferred to another operator.
• Artemyev and Y. Vlasenko are listed on some of the networkʼs resources as members of the editorial and administrative team; however, no independently verified biographical, corporate or technical information has been found in open sources that would confirm that they are real persons or establish their actual role in the networkʼs operation. The absence of such data may indicate that V. Artemyev and Y. Vlasenko are fictitious persons whose names are used to provide a formal editorial attribution on the networkʼs resources.
• The findings are consistent with the Centerʼs previous assessments of this information infrastructure. In January 2026, the Center separately analysed the ZOV network, which is aimed primarily at Ukrainian audiences, while in April 2026 a broader analytical material considered Portal Kombat as an ecosystem comprising the Pravda and ZOV segments.
• Shevchenko and TigerWeb have been subject to European Union sanctions since 15 July 2025. On 25 August 2025, the Republic of Moldova also imposed national restrictive measures on Y. Shevchenko and TigerWeb. Both decisions link them to the operation of Portal Kombat and to coordinated information manipulation and interference.
• For Ukraine, the TigerWeb case is an example of civilian web infrastructure being used to provide long-term technical support for information influence operations. The available body of evidence provides grounds for considering the imposition of sanctions on TigerWeb and Y. Shevchenko in Ukraine, alongside technical and partnership measures aimed at restricting the network’s continued operation.

1. Overview of TigerWeb

TigerWeb presents itself as a web studio in Simferopol providing website development, design, search engine optimisation (SEO), advertising campaigns, hosting and technical support. The company’s official website remained accessible as of 21 August 2026; its footer states the operating period as ‘2015-2026’. Meanwhile, the TigerWeb jobs page states that recruitment is ongoing and lists vacancies for a web developer, a SEO specialist and a contextual advertising specialist as current. Thus, TigerWeb not only maintains a public presence but, at least on its own website, also demonstrates current operational capacity in the areas required to create, maintain and promote web resources.

This assessment is supplemented by registry data on the russian legal entity. According to its RBC Companies profile, TigerWeb LLC is listed in the register of recipients of state support as an active legal entity, although it has received no such support over the past year.

At the same time, TigerWeb’s activities began long before the russian legal entity was registered. DFRLab and CheckFirst trace TigerWeb’s operation as a web agency back to at least 2013, whereas TigerWeb LLC was registered under the laws of russia in 2019. In the European Union sanctions materials, TigerWeb is identified by registration number 1199112018973 and the website tigerweb.ru and is described as the company operating Portal Kombat. The TigerWeb team page currently identifies ‘Denis’ as the studio’s founder and ‘Yevgeny’ as head of backend. Because the page provides no surnames or other identifying details, these designations provide no grounds for concluding that formal control over the company has changed and do not rebut the official identification of Yevgeny Shevchenko as TigerWebʼs founder in sanctions documents.

2. Yevgeny Shevchenko

In European Union sanctions instruments, Yevgeny Shevchenko is identified as the founder of TigerWeb. The DFRLab / CheckFirst investigation traces his involvement in developing the network of news aggregators linked to the company back to at least 2011, when Y. Shevchenko was involved in creating the Crimean aggregator Crimea News. The researchers regard this resource as an early precursor to the later Pravda ecosystem; by 2013, TigerWeb was already operating as a web agency, while from 2014 resources began to appear that shared technical characteristics with tigerweb.ru.

According to the archived CV cited in the DFRLab / CheckFirst study, Y. Shevchenko worked as a project manager at ‘Crimean Technologies’ (Крымтехнологии) in 2015-2016. DFRLab notes that this entity developed digital resources for the russian administration of temporarily occupied Crimea, including its government portal. This episode confirms his long-standing professional activity in Crimea’s IT sector following the occupation of the peninsula.

Following the start of the full-scale war, TigerWeb also continued to work with clients from occupation authorities. In 2021, the company created a website for the ‘Republican Valuation Centre’ (Республиканский центр оценки), and DFRLab / CheckFirst established that in December 2022 this entity was engaged by the russian occupation administration of Zaporizhzhia Oblast to provide property valuation services.

On 15 July 2025, Y. Shevchenko was added to the EU sanctions list. The Council of the EU’s official statement of reasons identifies Y. Shevchenko as a citizen of russia and the founder of TigerWeb, with tax identification number 910202780107. The document links his activities to the operation of Portal Kombat and to involvement in coordinated information manipulation and interference that threaten the stability and security of the European Union or one or more of its Member States.

The attribution of Y. Shevchenko is not based solely on the sanctions decision. VIGINUM explicitly identifies him as one of TigerWeb’s founders and states that he has been involved in website development and maintenance since at least 2013. DFRLab / CheckFirst additionally trace the links between his professional activities and TigerWeb’s infrastructure and the early generations of websites that subsequently evolved into Portal Kombat / Pravda. Taken together, these independent sources make Y. Shevchenko’s link to the network’s technical infrastructure considerably better substantiated.

3. Attribution of TigerWeb to Portal Kombat / Pravda

The most systematic initial attribution of TigerWeb’s role was published by VIGINUM, France’s service for protection against foreign digital interference. In the second part of its Portal Kombat investigation, dated 14 February 2024, VIGINUM identified TigerWeb’s significant role in creating and administering the network’s websites. The attribution was based on a combination of archival, contact and technical indicators, rather than solely on the content of publications.

Archived versions of some network resources displayed the TigerWeb logo with the label ‘Development and technical support’, indicating the company’s role as a developer and technical contractor. VIGINUM also found the email address topnewsua7@gmail.com on older copies of the websites and linked it to Y. Shevchenko; on TigerWeb’s website, it found a URL containing the domain lugansk-news.ru. Taken together, these indicators linked TigerWeb’s commercial infrastructure to the network’s early resources.

At the same time, VIGINUM did not equate the technical implementer with the operation’s strategic client: the French service separately hypothesised that TigerWeb may have acted as a service provider for another operator whose identity had not been established at the time. The evidence therefore confirms TigerWeb’s significant role in creating and administering the network, but does not prove that the company alone determined all information tasks or was the sole decision-making centre.

In February 2025, DFRLab and CheckFirst independently corroborated and expanded the technical attribution. The researchers identified a shared Google AdSense code between tigerweb.ru and several news websites, historical DNS/IP overlaps, shared Google Analytics identifiers on early resources, and SSL certificates listing tigerweb.ru as a domain name on servers in REG.RU ranges. They also established that the old ‘-news’ websites and the new Pravda resources use the same internal application programming interface (API) with the same parameters, demonstrating technical continuity between different generations of the network.

4. Evolution of the Network and the Pravda / ZOV Segments

According to VIGINUM, in February 2024 Portal Kombat comprised 193 information portals. On 29 April 2024, VIGINUM reported that the network had expanded to 224 portals targeting audiences in almost all EU Member States, as well as in several African and Asian countries. The network evolved from local russian and Ukrainian aggregators into a multilingual infrastructure that generally does not create original content, but automatically relays material from russian state media, official bodies and pro-russian accounts.

Following its exposure, the network was not shut down. DFRLab / CheckFirst recorded its further expansion in 2024-2025 and the gradual centralisation of much of the infrastructure around news-pravda.com. At the beginning of 2025, the researchers identified 140 subdomains targeting more than 83 countries and regions. A DFRLab study dated 3 April 2026 states that the network continues to operate through more than 150 websites and automatically translates and disseminates content in more than 80 languages. As of March 2026, its five most frequently used sources included TASS, RIA Novosti, Lenta, Komsomolskaya Pravda and RT. Some of these media outlets or associated with them entities are subject to sanctions or other restrictive measures; retransmission of their content through nominally separate domains therefore effectively creates an additional channel for circumventing sanctions restrictions on the distribution of russian state content.

The network’s scale and persistence are further confirmed by the DFRLab and CheckFirst online platform, which aggregates data from identified Pravda / Portal Kombat resources and is updated hourly. The researchers report more than 3.7 million publications that repurposed material from russian media and disseminated messages from dubious Telegram channels; the project’s interactive map tracks the network’s reach across more than 110 countries and regions. A separate DFRLab / CheckFirst study also records citations to Pravda domains on Wikipedia, in X Community Notes and in responses from popular artificial intelligence systems, expanding the network’s potential influence beyond its own websites.

The Center has also repeatedly covered the activities of this infrastructure. In a publication dated 31 March 2025, the Center described the Pravda network’s role in the mass replication of pro-russian messages that may subsequently appear in responses generated by artificial intelligence systems. On 14 January 2026, the Center published a separate analytical report on the ZOV network, which is aimed primarily at Ukrainian audiences. As of the beginning of 2026, the Center had identified 68 websites, 40 Telegram channels and 40 VKontakte pages in this segment, localised for 23 regions and 17 major Ukrainian cities.

In a subsequent analytical report by the Center entitled ‘Discrediting Ukraine amid Escalating Events in the Middle East’, Portal Kombat is considered a broader ecosystem that can be divided into two main segments: Pravda, aimed primarily at international audiences, and ZOV, focussed on Ukraine. This approach is consistent with DFRLab / CheckFirst’s technical findings on the shared architecture of the older ‘-news’ network and the newer Pravda network. Thus, treating ZOV separately is useful for analysing target audiences and content localisation, but does not mean that it lacks an infrastructural link to the broader Portal Kombat ecosystem.

5. Does TigerWeb Retain an Operational Role in the Network

Data available as of August 2026 support the assessment that TigerWeb’s link to Portal Kombat / Pravda persists. First, in July 2025, the Council of the EU imposed sanctions on TigerWeb and Y. Shevchenko specifically in connection with the operation of Portal Kombat. In the consolidated version of Council Regulation (EU) 2024/2642 as at 13 July 2026, TigerWeb continues to be described as the company operating this information manipulation project.

Second, in April 2026, DFRLab explicitly identified TigerWeb as the company behind the Pravda Network and recorded that the network continued to operate following the EU sanctions. Third, the 2025 DFRLab / CheckFirst technical study demonstrates continuity between different generations of websites through shared application programming interfaces and server, analytics and advertising markers. In addition, TigerWeb’s own website was not only operational as of August 2026 but also listed current vacancies in web development, SEO and digital advertising, meaning that the company publicly states that it retains capabilities in areas directly relevant to maintaining such web infrastructure. No publicly confirmed evidence has been found that the network was transferred to another identified technical operator.

At the same time, available open sources do not make it possible to establish TigerWeb’s actual access to every active registrar account, DNS zone, administration panel or server account. It is therefore accurate to refer to TigerWeb’s continuing operational and infrastructural link to the network, rather than to the company’s documented day-to-day administration of every individual resource. Similarly, the available body of evidence provides no grounds for identifying TigerWeb as the sole strategic client behind the entire operation, as VIGINUM allowed for the possibility that the company acted as a technical provider for another unidentified operator.

Thus, TigerWeb’s role in creating and administering the network is documented, and current official and research sources continue to link the company to its operation. There is no confirmed evidence that the technical operator has changed; at the same time, open sources do not detail the specific extent of TigerWeb’s current control over individual resources.

6. Victor Artemyev and Yuri Vlasenko

The appearance of the names Victor Artemyev and Yuri Vlasenko on some of the network’s resources warrants separate attention. In 2025, DFRLab recorded that, following an update to dnr-news.ru in 2024, V. Artemyev and Y. Vlasenko were presented as members of a new editorial team. The researchers interpreted this change primarily as an attempt to give the resource a more professional and transparent appearance, rather than as confirmation that a new technical operator had emerged for the network.

As of August 2026, the same correspondence between names and roles appeared on several similar resources. In particular, on the pages ‘Lenta novostey Kharkova’ and ‘Lenta novostey Kharkova Odesa’, V. Artemyev is listed as the owner and editor-in-chief, and Y. Vlasenko as the administrator. The repetition of the same names and functions across similar websites is consistent with the network’s centralised presentation template, but does not in itself prove that these individuals actually control the domain or server infrastructure.

Furthermore, no independently verified biographical, corporate or technical data have been found in open sources that would confirm that V. Artemyev and Y. Vlasenko are real persons, establish their actual role in the network’s operation, or show that TigerWeb’s functions were transferred to them. The absence of such information, combined with the repetition of the same names and roles across similar resources, may indicate that they are fictitious persons whose names are used to provide formal editorial attribution on the websites. The mere appearance of these names in editorial sections should therefore be treated as a separate indicator for further identification, but not as evidence that the technical operator of Portal Kombat / Pravda has changed.

7. Sanctions Status and Relevance to Ukraine

On 15 July 2025, the Council of the EU added TigerWeb and Y. Shevchenko to the sanctions list. The Implementing Regulation (EU) 2025/1444 identifies Y. Shevchenko as TigerWeb’s founder and the company as a Crimean web entity that operates Portal Kombat and engages in coordinated information manipulation and interference. The consolidated version of Council Regulation (EU) 2024/2642 as at 13 July 2026 retains this designation. On 25 August 2025, the Republic of Moldova also imposed national restrictive measures on Y. Shevchenko and TigerWeb.

Despite the sanctions imposed by the EU and the Republic of Moldova, in April 2026, DFRLab recorded that the Pravda Network continued to translate and disseminate russian state and sanctioned media content on a mass scale for international audiences, while the network itself was effectively being used to reintroduce such content into the information space through other domains and language versions. In the same study, DFRLab noted that, as of 3 April 2026, Ukraine had not imposed its own sanctions on either TigerWeb or Y. Shevchenko. This underscores the relevance of imposing national sanctions alongside measures aimed at restricting the network’s access to domain, hosting and other technology services.

The Law of Ukraine ‘On Sanctions’ provides for the application of restrictive measures to foreign legal entities and individuals whose actions create real or potential threats to Ukraine’s national interests, national security, sovereignty and territorial integrity, or contribute to such threats. Complementary information is available in relation to TigerWeb and Y. Shevchenko: VIGINUM’s official attribution, DFRLab / CheckFirst’s technical findings, the sanctions decisions of the EU and the Republic of Moldova, the network’s continued operation, and its systematic targeting of Ukrainian and international audiences. This provides a sufficient factual basis for considering the imposition of sanctions by Ukraine.