Executive Summary
The Russian disinformation ecosystem known as Pravda — also referred to as Portal Kombat in French government investigations — represents one of the most prolific and adaptive propaganda infrastructures identified in recent years. Built to disseminate pro-Kremlin narratives, distort public discourse, and shape the informational landscape surrounding the war in Ukraine, the network aims to exploit emerging technologies such as artificial intelligence (AI) by influencing the data consumed by language models.
At the core of the Pravda operation lies a systematic model of content aggregation and automated dissemination, deployed through hundreds of self-managed websites. By publishing thousands of pro-Kremlin articles daily — translated into European languages — the network seeks to saturate search engines and, more recently, the training environments of large language models. This tactic, increasingly referred to as “LLM grooming,” contributes to the corruption of AI-generated content, leading chatbots to replicate Kremlin-aligned talking points in response to politically sensitive queries. Investigations by France’s disinformation agency Viginum, NewsGuard, the American Sunlight Project, and others have traced the network to a Crimean-based IT company, TigerWeb, founded and operated by Evgeny Shevchenko, a Ukrainian national from Russian-occupied Crimea.
Initially launched in 2010 as a personal project to monetize web traffic through SEO-driven link networks, Shevchenko’s early work evolved into a sprawling, low-cost propaganda infrastructure. The first identifiable ecosystem linked to Pravda appeared in 2013 and included domains focused on Russian and Ukrainian regional news. This was followed by a second phase targeting Russian-speaking Ukrainians in 2022, and a third, more recent wave beginning in 2023 aimed at Western audiences. By April 2024, the Pravda network encompassed at least 224 active websites, with centralized traffic funneled through core domains such as news-pravda[.]com and localized portals like Pravda EN, FR, DE, PL, and ES.
Although some reports describe Shevchenko as the architect of a major Kremlin-backed operation, available open-source intelligence suggests a far more modest profile. Available evidence suggests that Shevchenko is a self-taught developer whose income does not exceed $2,000 per month and who continues to rely on microloans — a pattern inconsistent with direct, large-scale state funding. His technical skills, however, allowed him to gradually repurpose his infrastructure for coordinated information operations. By 2018, Shevchenko had likely pitched this capability to state-linked actors. In 2019, he formally registered TigerWeb and resumed his collaboration with Krymtekhnologii, a regional state-owned entity he had previously worked with following Russia’s annexation of Crimea. The company was later acquired by a firm connected to Putin ally Arkady Rotenberg. In 2020, Shevchenko received a local government-sponsored award as “Best Developer,” further reinforcing his ties to regional authorities.
Since the launch of Russia’s full-scale invasion of Ukraine in 2022, Shevchenko’s infrastructure has been used to publish millions of auto-generated articles across dozens of languages. According to the American Sunlight Project, the Pravda network produces a minimum of 3.6 million articles per year, though this figure is likely conservative. Beyond traditional media manipulation, the network has exploited platforms such as Wikipedia, Twitter/X, and its Community Notes feature to amplify Kremlin narratives and undermine credible sources.
The Pravda network’s increasingly sophisticated influence on AI systems appears to be partially shaped by John Mark Dougan, a former Florida sheriff’s deputy who fled to Russia in 2016 to avoid prosecution and was later granted asylum. Dougan has become a visible asset of Kremlin media, frequently spreading conspiracy theories about bioweapons, stolen Western aid, and fabricated Ukrainian war crimes. NewsGuard has identified Dougan as a strategic actor in the Kremlin’s broader disinformation apparatus, with ties to Western-facing networks that blend fabricated narratives with real content to deceive both readers and algorithms. In 2024, an IP address linked to Dougan was discovered within the technical infrastructure of the Pravda network, indicating likely direct involvement.
What makes Pravda especially concerning is not its sophistication, but its scalability, automation, and low operational cost. Unlike traditional state-run disinformation campaigns, this model does not require substantial funding or personnel. It relies instead on the strategic deployment of SEO, content automation, and rapid domain registration — techniques accessible to any moderately skilled developer. As such, traditional mitigation strategies, such as domain blocking or content flagging, are insufficient. Dozens or even hundreds of new websites can be launched daily, complicating the efforts of AI developers, tech platforms, and democratic governments to contain this evolving threat.
Evgeny Alexandrovich Shevchenko, born March 25, 1988, is a Crimean IT specialist and web developer. He was born and raised in Simferopol, Autonomous Republic of Crimea (occupied region of Ukraine).
He appears to have received his higher education at the Vernadsky Taurida National University in Simferopol, where he developed an interest in web development as a student. He is known to have created the university’s student web portal, TNU. His biography on that site mentioned success in school olympiads and a gold medal diploma (based on archived versions of the TNU website).
After graduating from university (approximately in 2010 - 2011), Shevchenko began a career in web development and SEO. Since 2011, he has participated in various online projects, focusing on creating content aggregation websites and promoting them through search engine optimization (so-called SEO networks). These early projects were commercial in nature - mainly news and informational websites without propaganda, generating traffic by aggregating content and optimizing it for search queries.
By the mid-2010s, Shevchenko had gained experience in managing website networks and automating content publication, which later played a key role in his involvement with government information projects.
Full Name: Evgeny Alexandrovich Shevchenko
Date of Birth: 25.03.1988; Place of Birth: Simferopol, Crimea; Citizenship: Russia;
Tax ID Numbers: (INN): 910202780107, 314650015
SNILS: 186-954-838-46; Passport Info: 031…;
Phone: +7 978 722-… (used for loan applications); Email: sheva@tigerweb.ru, sheva-simf@yandex.ru
Registered Address: 295017, Simferopol, Turgeneva St. 21
Work Address: Simferopol, Petropavlovskaya St. 3, Office 408
Organization: LLC "TigerWeb" (INN 9102260565); Position: General Director, Founder;
Vehicle: BMW 320, Plate: B476PM82, VIN: WBABN11090JV52151
Used usernames: Sheva_TNU, ShevaUa777, Sheva777;
Twitter: https://twitter.com/ShevaUA
Facebook: https://www.facebook.com/profile.php?id=1018173195
VK (main): https://vk.com/id138474
From 2011 to 2025, Evgeny Shevchenko followed a consistent path as a technically skilled but low-profile web enthusiast. Initially building websites for ad revenue, he eventually applied the same methods to serve Kremlin propaganda - without ever receiving substantial funding, credit, or strategic responsibility.
2011–2013 After graduating from Tavrida National University in Simferopol, Shevchenko began creating SEO-optimized content aggregator websites. These early projects were commercial in nature - mainly news and information sites designed to generate ad traffic. Some of his platforms, such as crimea-news.com and topnews.kiev.ua, resembled local news sites but were built for SEO gains, not journalism.
2014 Following the Russian annexation of Crimea, Shevchenko publicly expressed support and continued living in the region. His social media activity included attendance at pro-Russian rallies in Simferopol.
He kept developing websites, now adapting to the new political environment, but still at an amateur level.
2015–2016 Shevchenko worked briefly at the state IT firm Krymtekhnologii in Simferopol — an organization central to the digital infrastructure of the occupying administration. His role was likely as a web developer. The company managed official sites and produced pro-Kremlin content like “Crimean Spring,” a justification for annexation. Shevchenko gained exposure to state-run digital propaganda operations, though only as a technical implementer.
2018 Although no longer employed there, Shevchenko received a one-off payment of 75,200 rubles from Krymtekhnologii, indicating occasional freelance work. Around the same time, a site registered to his brother - Zhitomir News - began publishing Ukrainian-language content, mimicking local news. This site was later identified by VIGINUM as part of the disinformation network “Portal Kombat.” By late 2018, Shevchenko had built a functional skillset for automating news websites, which would later be repurposed for propaganda.
2019 Likely either to formalize freelance work or support covert operations, Shevchenko founded TigerWeb - a micro-sized web studio in Simferopol, with a charter capital of 10,000 rubles. As sole owner and director, he offered site development and SEO services. TigerWeb's official projects included local business sites and government-related work. In 2019, Shevchenko received a one-time income of 1.3 million rubles from Yandex, but no similar payments followed.
2020–2021 Krymtekhnologii was privatized, with 90% of shares sold to IT-Invest, a firm tied to the Rotenberg family. The company’s head was ex-police official Alexander Uzbek. This shift deepened Shevchenko’s indirect links to Kremlin networks, although his role remained minor. TigerWeb continued functioning as a small studio, while Shevchenko quietly contributed to unofficial propaganda tech.
2022 After Russia’s invasion of Ukraine, Shevchenko began building out what would become the Pravda network. Relying on earlier templates, his team registered domains like lugansk-news.ru and pravda-en.com. From April to December 2022, 41 new domains were launched with “ZOV” code markers.
The infrastructure relied on automated aggregation from Kremlin media, aiming not at human readers but at polluting search engines and AI training datasets. The network was cheap to operate and required minimal creative input.
2023 The Pravda network expanded internationally, with at least five Western-facing sites like pravda-fr.com and pravda-en.com. By the end of 2024, the network likely produced over 3.6 million articles across 150–250 domains in 49 countries annually. Shevchenko remained a background technician, not a public figure or strategic leader.
2024–2025 By early 2024, the network came under investigation. French agency VIGINUM and NewsGuard named Shevchenko and TigerWeb as the operators of the Pravda infrastructure. In March 2025, NewsGuard and American Sunlight Project detailed how Pravda articles were being ingested by AI systems like ChatGPT, Google Bard, and Bing Chat. The French government officially classified Pravda as foreign digital interference and TigerWeb as a Kremlin-linked contractor. Shevchenko, who had operated mostly under the radar, was now publicly identified - but remained a low-level actor in a larger machine.
Rather than a success story, Shevchenko’s trajectory reflects a shift from hobbyist to tool. While his technical contributions were essential to the mass automation of propaganda, he worked on the margins: legally invisible, financially modest, and strategically replaceable.
of the Pravda network
The Pravda network is a unified, automated system of websites designed for mass publishing of pro-Kremlin content. All Pravda sites share nearly identical design and code, differing only in language and logos. TigerWeb likely used a modified CMS (e.g., WordPress) or a custom engine with a single template. Sites like pravda-fr.com and pravda-en.com are visual and code-level clones. Russian-language sites include hidden tags like “logo_big>ZOV,” indicating the network was originally branded “ZOV.”
These sites don’t produce original content. Instead, they aggregate and republish material from Russian state media (RIA, TASS, RT), pro-Kremlin Telegram channels, and government websites. Scripts automatically collect, translate (via tools like Google Translate or Yandex), and post the content. Many posts are direct copies, sometimes even including symbols like “‼️” from Telegram. This process is fully automated with minimal human input.
Though targeting foreign audiences, the network is hosted on Russian servers. In 2023, Viginum found all European Pravda sites hosted on a single IP: 178.21.15.85 (AS49352), owned by Russian registrar Reg.ru. All ZOV and Pravda sites were in the same subnet, simplifying control but creating a single point of failure. Some domains used aliases (e.g., pravda-en.com linked to news-pravda.com). Few domains used foreign TLDs (.ua or .ir); most were .ru or .com. RSS feeds and Telegram channels were used to bypass browser access, but .ru domains were likely blocked in Ukraine, limiting real local traffic.
Connection with ZOV and legacy networks Pravda evolved from earlier content farms tied to Shevchenko. ZOV sites (.ru) impersonate Ukrainian regional media, using Russian transliterations like “Kiev.” Pravda sites (.com) target foreign audiences with the same design. Viginum linked Pravda to an earlier ecosystem of ~147 domains from 2013–2023, many now inactive, using patterns like news-< city>.ru and topnews.<city>.ua. These were likely also run by Shevchenko. In 2022–2023, the ZOV/ Pravda network grew rapidly by repurposing old templates and expanding into multilingual domains, grouped by investigators under the umbrella name “Portal Kombat.”
The Pravda network is a product of efficient but unoriginal technical work. It relies on templating, cloning, and aggregation - techniques common in SEO farms. Within a year, it expanded to nearly 200 domains in dozens of languages. This uniformity made it easy to expose: shared design, IPs, and “ZOV” code linked the network to TigerWeb and Shevchenko. Content flows from pro-Kremlin sources through TigerWeb in Simferopol to two main clusters: ZOV (.ru, Russian-speaking) and Pravda (.com, foreign). Both are indexed by search engines and AI systems, enabling disinformation to enter chatbot outputs.
to influence AI
One of the most alarming aspects of the Pravda project was its impact on Western AI systems.
Instead of targeting human audiences directly, the Russian disinformation campaign focused on "AI grooming" - flooding the web with pro-Kremlin content to influence the data used to train or inform large language models.
French government analysts first noted the potential AI implications of Pravda in early 2024.
By August 2024, NewsGuard’s AI Disinformation Monitor confirmed that chatbots were echoing Pravda narratives. In March 2025, NewsGuard published an audit of 10 major AI models: all repeated Kremlin disinformation, and 7 directly cited Pravda sites like denmark.news-pravda.com and macron.news-pravda.com as legitimate sources.
In 450 test prompts, 33.5% of chatbot responses included false pro-Kremlin claims, and 70% of bots referenced Pravda at least once. Examples include fabricated claims like "Zelensky banned Truth Social," which Bing Chat and Grok repeated. Independent media outlet Meduza also documented a case in which one of the major AI chatbots echoed false claims about U.S. biolabs in Ukraine, sourced from Pravda.
In tests, AI bots repeated disinformation in 33.55% of responses, avoided answering in 18%, and debunked the claim only 48% of the time. NewsGuard described the strategy as “corrupting AI models” and “poisoning the information well.”
Thus, a Kremlin-linked network built by a low-level developer from Russian-occupied Crimea managed not only to mislead human readers but also to influence the “minds” of global AI systems - creating a feedback loop that spread propaganda to millions. This tactic represents a new frontier in information warfare, showing how small technical teams can exploit major platforms without needing significant funding.