{"id":265791,"date":"2024-04-16T13:42:17","date_gmt":"2024-04-16T10:42:17","guid":{"rendered":"https:\/\/investigator.org.ua\/?p=265791"},"modified":"2024-04-24T21:41:24","modified_gmt":"2024-04-24T18:41:24","slug":"beget-v-vyshivanke-kak-topovaya-rossijskaya-it-kompaniya-rabotaet-na-svobodnoj-i-okkupirovannoj-rf-territoriyah-ukrainy","status":"publish","type":"post","link":"https:\/\/investigator.org.ua\/en\/investigations\/265791\/","title":{"rendered":"Beget in Vyshyvanka. How top Russian IT company works in Ukraine and on Ukrainian territories occupied by Russia"},"content":{"rendered":"

<\/p>\n

Russian hosting provider \u00abBeget\u00bb is within top three hosting companies of the Russian Federation. It launched its work in Ukraine in 2012 by registering the company with the same name in Kyiv. Then, Russian founders from Sanct Petersburg left the Ukrainian company but the Center of Journalistic Investigations uncovered signs that they are still connected.\u00a0<\/b><\/p>\n

Since 2014, Russian \u00abBeget\u00bb has delivered services to Russian illegal authorities, militarized organizations and propagandist projects in Crimea, Donbas and Zaporizhzhia region, occupied by the Russian Federation. The company has not been sanctioned by Ukraine or Western countries.\u00a0<\/b><\/p>\n

<\/p>\n

Russian LLC \u00abBeget\u00bb (brand name is Beget) is hosting provider and authorized registrar of domain names <\/span>founded<\/span><\/a> in 2007 in Sanct Petersburg. Ukrainian company with the same name \u00abBeget\u00bb was founded in August 2012 in Kyiv. It called itself representative office of the Russian company (see its <\/span>archived website<\/span><\/a>).\u00a0<\/span><\/p>\n

Iljin Aleksandr Yuryevich<\/b> and <\/span>Manikin Aleksei Yuryevich<\/b> have been co-founders of Kyiv \u00abBeget\u00bb. Each of them has owned 46,5% of the statutory capital of Russian LLC \u00abBeget\u00bb since its launch until now.\u00a0<\/span><\/p>\n

\"\u0410\u043b\u0454\u043a\u0441\u0430\u043d\u0434\u0440<\/a>

Aleksandr Iljin, Aleksei Manikin, beneficiaries of Russian LLC \u00abBeget\u00bb. Photo: vuspeh.ru, Facebook<\/span><\/i><\/p><\/div>\n

Russian co-founders appointed <\/span>Goloborodko Vladyslav Oleksandrovych<\/b> as the director of Kyiv company. In 2018, the ownership structure of the company drastically changed. Russian shares were transferred to Kyiv director and Ukrainian company was called \u00abBeget Ukraine\u00bb.\u00a0<\/span><\/p>\n

Vladyslav Goloborodko is the owner, director and bookkeeper of LLC \u00abBeget Ukraine\u00bb. Goloborodko told our journalists in an interview that he bought the company because it has been profitable. When we asked about distribution of profits, he answered that \u00abthe profit was distributed in simple way. I received profit from Ukrainian clients. Russian company \u00abBeget\u00bb has delivered services in Russia, Kazakhstan, Germany and other countries. Roughly speaking, \u00abBeget Ukraine\u00bb has delivered services only for Ukrainian citizens\u00bb.\u00a0<\/span><\/p>\n

According to analytical system YouControl, LLC \u00abBeget Ukraine\u00bb has demonstrated successful financial results. In 2020, its net profit reached 6,3 million UAH. In 2021 and 2022, the net profit of hosting company reached almost the same results. It showed losses only in 2023. <\/span><\/p>\n

\"\u0412\u043b\u0430\u0434\u0438\u0441\u043b\u0430\u0432<\/a>

Vladyslav Goloborodko, director and beneficiary of LLC \u00abBeget Ukraine\u00bb\u00a0<\/span><\/i><\/p><\/div>\n

Vladyslav Goloborodko says that Ukrainian and Russian \u00abBeget\u00bb do not have connections anymore. Our findings demonstrate different situation. Let us look first at \u00abBeget\u00bb in Sankt Petersburg.\u00a0<\/span><\/p>\n

Russian \u00abBeget\u00bb in Sankt Petersburg\u00a0<\/b><\/p>\n

Russian company \u00abBeget\u00bb is undoubtedly very successful and profitable company. It delivers its services to 200 thousand clients. As of January 2024, \u00abBeget\u00bb is the leader among Russian hosting providers by the number of domains. The company holds largest market shares in zones .RU, .\u0420\u0424 and .SU. It is the third largest domain registrar in Russia.\u00a0<\/span><\/p>\n

In Russia, IT market has been closely supervised by governmental authorities and intelligence services. \u00abBeget\u00bb is an obedient company. It has blocked websites and webpages automatically and quickly, upon requirements of the Russian Federal Service for Supervisionn of Communications, Information Technology and Mass Media. Number of websites, blocked by \u00abBeget\u00bb, has steadily grown since the Russian full scale invasion into Ukraine. Roskomsvoboda channel, managed by the Center for protection of media rights, mentions 12 cases when \u00abBeget\u00bb blocked or even deleted websites with publications criticizing Russian government or \u00abnegatively\u00bb covering Russian \u00abspecial military operation\u00bb.<\/span><\/p>\n

Most prominent cases include blockade \\ deletion of website of Sankt Petersburg office of Russian opposition \u00ab<\/span>Novaya gazeta<\/span><\/a>\u00bb and digital project of its journalists \u00abProdolzhenie sleduet; <\/span>platform<\/span><\/a> of blogger Lev Vladov (aka \u00abChelyabinski urbanist\u00bb); website of Altai office of Russian political party \u00abYabloko\u00bb and an <\/span>article<\/span><\/a> of the Center for protection of media rights.\u00a0\u00a0<\/span><\/p>\n

We paid special attention to the activity of Russian LLC \u00abBeget\u00bb on Ukrainian territories, occupied by the Russian Federation. We found out that its clients included <\/span>Russian illegal authorities, propagandist media projects and organizations directly supporting Russian invasion into Ukraine<\/b>.\u00a0<\/span><\/p>\n

It should be emphasized that Russian \u00abBeget\u00bb has serviced these bodies and organizations when its owners have been de jure co-founders of Ukrainian \u00abBeget\u00bb.\u00a0<\/span><\/p>\n

Ukrainian governmental security and intelligence bodies did not focus on \u00abBeget\u00bb even when its owners <\/span>Aleksei Manikin<\/span><\/a> and <\/span>Aleksandr Iljin<\/span><\/a> were included into the database \u00ab<\/span>Myrotvorets<\/b>\u00bb in 2016 \u2013 \u00abfor delivering its resources to terrorist organization \u00abDNR\u00bb [Donetsk People\u2019s Republic].\u00a0<\/span><\/p>\n

Authors of \u00abMyrotvorets\u00bb published communication between technical manager <\/span>Aleksandr Klukov<\/b> (now he is general director of the company) and <\/span>Sergii Kandelaki<\/span><\/a>, manager of IT unit of Russian occupation \u00abMinistry of Information of DNR\u00bb. The communication provided evidence that \u00abBeget\u00bb registered domains of \u00abofficial website of DNR\u00bb and websites of occupation \u00abgovernment\u00bb, \u00abministries\u00bb and propagandist media in zones .RU and .SU.\u00a0<\/span><\/p>\n

In 2015, Sergii Kandelaki asked Klukov to transfer \u00aboverloaded official sites of DNR\u00bb \u2013 dnr-online.ru and gazeta-dnr.ru (web portal of occupation mass media) \u2013 to dedicated server of LLC \u00abBeget\u00bb.\u00a0<\/span><\/p>\n

\"\"

Communication between Sergii Kandelaki and Aleksandr Krukov about services of LLC \u00abBeget\u00bb, 2015. Photo: myrotvorets.center<\/span><\/i><\/p><\/div>\n

Web portal <\/span>\u0434\u043d\u0440\u043e\u043d\u043b\u0430\u0439\u043d.\u0440\u0444 <\/b>has been the official website of the government of DNR since 2022. Its subdomains have hosted \u00abministries of DNR\u00bb, including \u00abministries of internal affairs\u00bb and \u00abinternal security\u00bb, \u00abPeople\u2019s Council of DNR\u00bb, occupation courts, prosecutors and local administrations. Domain has been registered and hosted by Sankt Petersburg \u00abBeget\u00bb. Its <\/span>servers<\/span><\/a> have hosted all \u00abstate\u00bb web-resources of illegal authorities of Donetsk region, occupied by the Russian Federation.\u00a0<\/span><\/p>\n

Other Russian hosting provider Reg.ru (LLC \u00abRegistrator domennykh imen Reg.ru\u00bb) delivers similar services to Russina occupation authorities in Luhansk region. \u00abBeget\u00bb has been its partner there. Then, it launched its own registration services. As an outcome, Reg.ru suspended agreement with \u00abBeget\u00bb and took joint clients. However, \u00abBeget\u00bb keeps delivering its services to Russian occupation <\/span>authorities<\/span><\/a> in Luhansk region.\u00a0<\/span><\/p>\n

Another client of \u00abBeget\u00bb is an <\/span>office of Russian \u00abDOSAAF\u00bb<\/span><\/a> (\u00abVolunteer Society for Cooperation with the Army, Aviation and Navy\u00bb) in occupied Sevastopol. It trains specialists and soldiers for the Armed Forces of the Russian Federation. According to the data of Whois service, \u00abBeget\u00bb registered domain of Sevastopol office in July 2021. The website has been hosted by servers of \u00abBeget\u00bb.<\/span><\/p>\n

\"Whois-\u0434\u0430\u043d\u0456<\/a>

Data of Whois about domain of Sevastopol office of Russian \u00abDOSAAF\u00bb, March 2024, photo: whois.com<\/span><\/i><\/p><\/div>\n

We disclosed an activity of Sevastopol office to militarize children in occupied Crimea in our investigation \u00ab<\/span>Courses of killers for adults and teenagers<\/span><\/a>\u00bb.\u00a0<\/span><\/p>\n

As we reported, \u00abMaritime innovation center\u00bb, set up on basis of DOSAAF\u00bb, won the competition of the Fund of presidential grants of the Russian Federation to implement project called \u00abYoung drone operator\u00bb.<\/span><\/p>\n

Sevastopol office had to train over 400 drone operators, aged between 11 and 16, during five months (total value of the project \u2013 six million Rubles). Project covered Sevastopol and other Ukrainian territories occupied by Russia (Crimea, Zaporizhzhia, Luhansk and Donetsk regions).\u00a0<\/span><\/p>\n

\"\"

Students of \u00abcadet class of air defense\u00bb at the training of attack drone operators in Sevastopol. Photo: social media\u00a0<\/span><\/i><\/p><\/div>\n

After our interview with Vladyslav Goloborodko, access to the website of Sevastopol office of DOSAAF has been suddenly blocked by provider \u00abBeget\u00bb at the end of March. Web-portal of \u00abDOSAAF of Russia\u00bb still posts its web address <\/span>https:\/\/sevastopol-dosaaf.ru\/<\/span><\/a>.<\/span><\/p>\n

Another example is related to the first days of the Russian full scale invasion into Ukraine. Russian occupants launched telegram channel and web site with name \u00abYuzhny platzdarm\u00bb [Southern bridgehead] and channel \u00abYuginformbureau\u00bb. This media holding disseminated Russian propagandist narratives, fake news about Russian invasion or statements of heads of Russian occupation administrations.<\/span><\/p>\n

\"\u0410\u0440\u0445\u0456\u0432\u043d\u0430<\/a>

Archived web page of site \u00abSouthern bridgehead\u00bb created by the Russian Federation in Melitopol to disseminate Russian propaganda, 29.03. 2022. Photo: web.archive.org<\/span><\/i><\/p><\/div>\n

As <\/span>Russian BBC service<\/span><\/a> reported, website \u00abSouthern bridgehead\u00bb has been hosted by servers of Russian hosting provider from Sankt Petersburg. Then, it moved to American Cloudflare, hiding real owners\u00bb.\u00a0<\/span><\/p>\n

It should be clarified that website of Russian propagandists could still be hosted by Russan \u00abBeget\u00bb. American Cloudfare could serve as an \u00abintermediary\u00bb between real hosting company and the world\u2026\u00a0<\/span><\/p>\n

Are Ukrainian and Russian \u00abBeget\u00bb still connected?\u00a0<\/b><\/p>\n

Let us begin our analysis from the most obvious signs.\u00a0<\/span><\/p>\n

First of all, Ukrainian and Russian companies display the same logo \u00abBeget\u00bb. Ukrainian version has letter \u00abg\u00bb colored by colors of the Ukrainian flag. Design of websites of both companies is similar. It can be explained by arguments of common history.<\/span><\/p>\n

There are more arguments and signs.\u00a0<\/span><\/p>\n

Footer and webpage with contacts of <\/span>website<\/span><\/a> of Russian company \u00abBeget\u00bb indicate contact phone numbers in Russia (Moscow, Sankt Petersburg), Kazakhstan and two numbers in Ukraine: 0 (800) 802-192 and +380 (44) 300-02-18.<\/span><\/p>\n

\"<\/a>

Webpage of contacts of Russian LLC \u00abBeget\u00bb, March 2024. Screenshot of beget.com\u00a0<\/span><\/i><\/p><\/div>\n

Website<\/span><\/a> of \u00abBeget Ukraine\u00bb indicates the same phone numbers.\u00a0<\/span><\/p>\n

\"\u0420\u0435\u043a\u0432\u0456\u0437\u0438\u0442\u0438<\/a>

Contacts of LLC \u00abBeget Ukraine\u00bb, March 2024. Screenshot beget.com.ua<\/span><\/i><\/p><\/div>\n

Footer of website \u00abBeget Ukraine\u00bb says that \u00ab<\/span>LLC \u00abBeget Ukraine\u00bb is the partner of registrar of domain names LLC \u00abBeget\u00bb<\/b>. Next sentence has been reworded after our interview with Vladyslav Goloborodko (we keep the screenshot of its initial version). The initial version said: \u00abSome actions with domain names in zones .RU and .\u0420\u0424 are made in accordance with Rules of loading domain names in domain .RU and .\u0420\u0424\u00bb. Then, \u00abzones .RU and .\u0420\u0424\u00bb were omitted and replaced with zones of coordinator cctld.ru\u00bb. Active web reference leads directly to website of \u00abCoordination center of domains .RU and .\u0420\u0424\u00bb, created by the Russian Ministry of Mass Communications in 2015.\u00a0<\/span><\/p>\n

If you click buttons of social media acconts in X, VKontakte and github on website of \u00abBeget Ukraine\u00bb, you land on pages of Russian \u00abBeget\u00bb, created in previous years when brand name was written as BeGet.\u00a0<\/span><\/p>\n

Let us look at documents posted on the website of the Ukrainian company. Its public offer has been <\/span>introduced<\/span><\/a> by Vladyslav Goloborodko in February 2023. It says that LLC \u00abBeget Ukraine\u00bb registers domain names in international zones in partnership with three partners. Two partners are from Russia: <\/span>JSC \u00abRegional network information center\u00bb<\/b> (RU-CENTER) and its \u00abdaughter\u00bb <\/span>LLC \u00abRegistrar P01\u00bb<\/b>.\u00a0<\/span><\/p>\n

\"\u0414\u043e\u0433\u043e\u0432\u0456\u0440<\/a>

Public offer contract, introduced by V.Goloborodko in February 2023. Photo: beget.com.ua<\/span><\/i><\/p><\/div>\n

Russian \u00abBeget\u00bb has the same partners: RU-CENTER, R01, PublicDomainRegistry.<\/span><\/p>\n

Why has \u00abBeget Ukraine\u00bb kept working through Russian registrars of domain names in international zones? First, Mr. Goloborodko refered to \u00abbad memory\u00bb, then he said that he had to implement previously signed agreements. Finally, he admitted that it might have been technical mistake.\u00a0<\/span><\/p>\n

His word-by-word answer is as follows:\u00a0<\/span><\/p>\n

\n

\u00abFirst of all, I need to recall those contracts, I do not remember\u2026\u00bb<\/span><\/i><\/p>\n

\u00abLook, I sign many papers, I do not remember. Roughly speaking, if they are indicated, then, we had certain agreements, concluded earlier\u2026 in accordance with them, we have to make references in certain places\u2026\u00bb<\/span><\/i><\/p>\n

\u00abYou know, if it is as you say, then, I will examine it\u2026 I have to check it. It might have been technical mistake which does not put obligations on us\u2026\u00bb<\/span><\/i><\/p>\n<\/blockquote>\n

We do not have doubts that Mr Goloborodko visited the website of his company and read his public offer. After that, the initial text of the public offer has not been changed. We assume that Goloborodko is not able to change anything in the text. Either cooperation with Russian companies continues or he is not empowered to make changes.\u00a0<\/span><\/p>\n

It has been complicated task for us to find out the location of servers of \u00abBeget Ukraine\u00bb when, as Vladyslav Goloborodko stated, \u00abBeget Ukraine\u00bb broke its legal and technical ties with Russian \u00abBeget\u00bb. As we uncovered, websites of Ukrainian clients of \u00abBeget Ukraine\u00bb have been hosted by servers of Russian \u00abBeget\u00bb until March 2022.\u00a0<\/span><\/p>\n