Your Taxes, Their Target List: Following NED Money Into Ukraine’s Online Info-Ops Web

In 2016 the National Endowment for Democracy (NED), which Congress funds, paid $100,000 to the Kyiv nonprofit Prometheus for investigations published on InformNapalm. InformNapalm shares a private mail server with Myrotvorets, a Ukrainian “enemies” database that lists Americans, and has mentioned it in 124 English-language posts since 2015, often citing or promoting it. No record shows NED money reached Myrotvorets.

U.S. taxpayer money, Ukrainian officials and a public “enemies” database that lists Americans sit closer together than either government admits. The people overlap, too. Prometheus’ president moved into the government’s own strategic-communications centre. A soldier’s public LinkedIn profile shows service in a military psychological-operations unit while he volunteered for InformNapalm. And Myrotvorets was announced and defended by Anton Gerashchenko, an adviser to the interior minister, whose ministry’s officers attended its 2014 working meeting with InformNapalm.

The findings rest on public records: an NED grant list, State Department documents released under the Freedom of Information Act (FOIA), archived web pages, internet domain records and Myrotvorets’ own code. They are narrower than the internet rumors. They are also harder to dismiss.

What Is Myrotvorets? The Ukrainian “Enemies” Database Explained

Myrotvorets means “peacemaker.” It launched in 2014 under the domain psb4ukr.org and now runs at myrotvorets.center. Its main product is a searchable database it calls “Purgatory.” Each entry carries a name, photos, an accusation, and links. Many carry far more.

The site describes itself in English in its own header. The archived homepage from September 2, 2026 reads: “Information for law enforcement authorities and special services about pro-Russian terrorists, separatists, mercenaries, war criminals, and murderers”

Directly below that line, the same header lists three locations. One of them is “Langley, VA, USA.” Langley is the Virginia community that houses CIA headquarters. We return to that line below.

Myrotvorets says it is independent and unfunded by any government. Its donation page, archived November 1, 2021, states in Ukrainian: “Центр не фінансується жодною державною чи недержавною організацією, не належить до будь-якої урядової структури.” In English: the center is not financed by any state or nonstate organization and does not belong to any government structure.

Critics call the database a “kill list.” Fact-checkers have pushed back on that label. Newsweek wrote in 2022: “Mirotvorets does not advocate violence against those on its database, and there is no conclusive evidence that it's ever been used as a "kill list," as Waters claims.”

Human rights monitors take the doxing seriously. Doxing means publishing private personal details, such as a home address, to expose someone. The Atlantic Council’s Digital Forensic Research Lab (DFRLab) reported in 2017 that the United Nations human rights office had urged Kyiv to act. DFRLab wrote that “Ukrainian authorities were urged to promptly and effectively conduct an investigation to address alleged violations and remove personal data from Myrotvorets.”

DFRLab also reported that Ukraine’s own president objected. It wrote: “In June 2016, Ukrainian President Petro Poroshenko condemned Myrotvorets for publishing personal data of more than 4,000 journalists”

The U.S. government has weighed in, too. The State Department’s 2023 human rights report on Ukraine says: “The Myrotvorets website, which reportedly maintained close ties to the security services, hosted a database of personal information of journalists and public figures whose statements and activities had been deemed unpatriotic.”

Note the word “reportedly.” Washington has never formally tied Myrotvorets to a Ukrainian agency. Neither has Kyiv.

Who Runs It

The site’s operators stay anonymous. Press reports have long named two men. One is a director using the name Roman Zaitsev. The other is Anton Gerashchenko, a former member of parliament and adviser to Ukraine’s interior minister.

DFRLab, citing Radio Free Europe/Radio Liberty (RFE/RL), wrote that Zaitsev was a former department head at the Security Service of Ukraine (SBU), the country’s domestic intelligence agency. Asked whether Myrotvorets was his project, DFRLab reported, “Gerashchenko winked, chuckled, and replied: ‘No.’”

The Russian-language independent outlet Meduza summarized the record in 2024. It wrote that, according to The Times of London, “The Myrotvorets database was created in 2014 by Ukrainian politician Heorhiy Tuka and a former State Security Service (SBU) officer using the pseudonym Roman Zaitsev”

The same Meduza piece states plainly: “Myrotvorets is not officially affiliated with the Ukrainian government.” It adds that Zaitsev “has maintained that the website is not controlled by the agency and does not receive state funding.”

That is the official story. The records tell a more complicated one.

How Close Is Myrotvorets to Kyiv’s Government? Officials, Embassies and the NGO Web

Myrotvorets and InformNapalm call themselves volunteers. Ukraine’s diplomats call Myrotvorets a private group. The public record shows something messier: officials in the room and a nonprofit leader who moved into the government’s own messaging shop.

An OctoProbe investigation graph maps those ties. It holds 304 nodes, or data points, and 500 links among them, built from 100 queries over 15 rounds of automated lookups. The method behind such graphs is documented separately. A graph analyst seeded it with eight subjects. They included the 2016 NED grantee Prometheus, its co-founder, InformNapalm, a former interior minister and Anton Gerashchenko, a former adviser to the interior minister. Each tie was then checked against public records. Where the graph and the public record agree, we call the link proven.

A note on terms. In this section, “embassies” means Ukraine’s own embassies and its Ministry of Foreign Affairs (MFA), whose domain is mfa.gov.ua. The investigation graph contains no British embassy, U.K. government domain, or British official. It contains no embassy domain at all. Every embassy tie below comes from public records.

Proven: From Prometheus President to the Government’s Strategic Communications Centre

Mykola Balaban is the clearest bridge between the NGO network and the Ukrainian state. He did not hide it.

In 2015, Balaban spoke for InformNapalm. At an August 2015 briefing in Kyiv, the Ukraine Crisis Media Center identified him as “a member of InformNapalm portal’s editorial team” It then reported: “According to Balaban, the portal actively cooperates with the law enforcement agencies and Ukraine’s Security Service.”

The same report added a diplomatic angle: “The Ministry of Foreign Affairs of Ukraine also intends to use these materials during public debates in the United Nations as evidence of the Russian aggression”

By 2017, Balaban was president of Prometheus. InformNapalm’s own write-up of the “Donbas in Flames” launch named “Mykola Balaban, the President of the Prometheus center” That is the same Prometheus that NED paid $100,000 in 2016 for investigations posted on informnapalm.org. The guide itself was funded by Canada’s local-initiatives fund, the same article says.

Then he moved inside the government. His official biography for the 2025 Kyiv StratCom Forum reads: “He was the co-founder and the president of NGO Prometheus Centre for Studies of Security Environment; later, he headed the situation centre of the Communications and Public Diplomacy Department of the MFA of Ukraine as an adviser.”

The same page lists his current title: “Deputy Head of the Centre for Strategic Communication SPRAVDI”

The Centre for Strategic Communication and Information Security, which publishes as SPRAVDI, is part of Ukraine’s state. It runs on a government domain, spravdi.gov.ua. Its mail record points to mail.mkip.gov.ua, the mail server of Ukraine’s Ministry of Culture and Information Policy. The Centre’s own About page says: “The Centre was established as one of the mechanisms for countering disinformation by joint efforts of the state and civil society.”

The investigation graph shows the same arc in data. The Balaban subject node links to a work email on the spravdi.gov.ua government domain and to the Centre’s website. That address is not published here.

In short, one person went from InformNapalm’s editorial team, to president of a NED-funded nonprofit, to an adviser in Ukraine’s foreign ministry, to deputy head of a state communications centre. Each step is documented by the organizations themselves. There is nothing illegal about any of it. But it undercuts the picture of fully independent volunteers.

The embassy link runs through that Centre, too. A LinkedIn post by the Centre says it presented its work on countering disinformation during a meeting of the heads of Ukraine’s foreign diplomatic missions in 2026. The full post could not be viewed without signing in, so the detail is treated as reported.

On LinkedIn: A PSYOP Soldier Who Volunteered for InformNapalm

The clearest overlap between Ukraine’s military information units and the volunteer network sits on a public LinkedIn profile.

Lukyan Turetsky’s profile lists service as a soldier in the Armed Forces of Ukraine from May 2015 to July 2016. It gives his corps as Special Operations Forces and his unit as “Information and psychological operations (PSYOP).” The same profile lists him as a volunteer at InformNapalm from January 2015 to January 2017. It also lists the 9th company of Maidan Self-Defense in 2013–14.

By his own account, then, he served in a military PSYOP unit while volunteering for InformNapalm, for more than a year. The profile does not say what he did for either, or that the roles were connected.

Other overlaps run through state communications bodies. In 2015, Ukraine’s new Ministry of Information Policy announced cooperation with InformNapalm, Detector Media reported.

The state Centre for Strategic Communication draws on the same circle. The culture ministry announced in 2021 that Liubov Tsybulska, formerly of the Ukraine Crisis Media Center, would head it. When she left that September, the Institute of Mass Information reported that Balaban, the former Prometheus president, was her deputy.

Balaban still speaks for the Centre abroad. A SPRAVDI release quotes him as its deputy head presenting a handbook to help Ukraine’s diplomats counter disinformation.

Government Domains Sit Apart

The state’s own websites run separately. Ukraine’s foreign ministry uses its own mail service, run by the security company Proofpoint. SPRAVDI uses the culture ministry’s mail. No shared infrastructure turned up between any .gov.ua domain and the NGO network; the ties to the state run through people and meetings.

Proven: Myrotvorets Met InformNapalm With SBU and Interior Ministry Staff

Myrotvorets has said it is no part of the state. Its own archive says state officers sat at its table from the start.

On December 21, 2014, psb4ukr.org posted a short notice titled, in Russian, “A working meeting of Myrotvorets Center specialists with representatives of the information resources INFORMNAPALM and LOSTIVAN was held.” The archived post says: “На встрече, которая проходила 21 декабря 2014 года, присутствовали также сотрудники оперативных подразделений Центральных Аппратов СБ Украины и МВД Украины.”

In English: present at the meeting were also officers of the operational units of the central offices of the SBU and Ukraine’s Ministry of Internal Affairs. The translation is ours. The notice adds that participants discussed “пути взаимного обмена критической информацией”, or “ways of mutual exchange of critical information,” and cooperation with law enforcement and special services of European countries.

At the time, Arsen Avakov ran the Interior Ministry. His adviser was Anton Gerashchenko, whom press reports name as a Myrotvorets co-founder. Lawfare wrote in 2023 that Myrotvorets “was co-founded in 2014 by Anton Gerashchenko, then a member of the Ukrainian Parliament and now adviser to the Ministry of the Interior.” The graph includes Avakov’s public social accounts but found no technical link between them and the NGO domains. His tie is through his ministry and his adviser, not through infrastructure.

Lawfare also located a 2015 interview. It quotes Zaitsev telling the Ukrainian outlet Fakty: “I repeat, we are not abstract: we work with the state, and the state cooperates with us.”

Lawfare described a wider ring around both groups. A hacker team called Kyber Sprotyv says it works with InformNapalm and Myrotvorets. Lawfare wrote that “The group’s active cooperation with Myrotvorets, InformNapalm, and the National Resistance Center is beyond any doubt.” The National Resistance Center is a unit of Ukraine’s armed forces.

Anton Gerashchenko: The Official Behind Myrotvorets

No official is tied to Myrotvorets more closely than Anton Gerashchenko. He announced the site, defended it in public, and served in the Interior Ministry the whole time.

In 2014, Gerashchenko was a member of parliament and an adviser to Interior Minister Arsen Avakov. He later became deputy interior minister. The Cabinet of Ministers dismissed him from that post in August 2021. He now runs a widely followed Telegram channel on the war.

He introduced the site himself. In August 2014, TSN reported on his Facebook post about the new “Center.” He wrote that the Interior Ministry alone had court permission to detain more than 500 separatists and terrorists, “В тому числі і на підставі даних з сайту Центру”, or “including on the basis of data from the Center’s website.”

He gave it a historical frame. The same post called the site “прообразом українського Центру Симона Візенталя”: a prototype of a Ukrainian Simon Wiesenthal Center, the group that hunted Nazi war criminals.

He repeated the line years later. Asked about the project, he told Gazeta.ua: “Це — своєрідна картотека для українських і закордонних спецслужб.” In English: “It is a kind of card index for Ukrainian and foreign special services.”

When the site published the personal data of thousands of journalists in May 2016, Gerashchenko defended it. Ukrainska Pravda reported that he asked the prosecutor general and the heads of the Interior Ministry and the SBU to close the criminal case against the site’s volunteers. He wrote: “як і у кожного громадянина і журналіста, є право поширювати будь-яку інформацію не заборонену законом”, or that the volunteers, “like every citizen and journalist, have the right to spread any information not prohibited by law.”

Another official named him as a backer. Tetiana Popova, then deputy minister of information policy, resigned in August 2016. Ukrainska Pravda reported that, asked whom she blamed for a campaign of hate against her and journalists, she answered: “"Миротворець" і всіх, хто його підтримує: Антон Геращенко, Тимчук, Тетерук”. That is, “Myrotvorets and everyone who supports it: Anton Gerashchenko, Tymchuk, Teteruk.” Dmytro Tymchuk and Andriy Teteruk were members of parliament.

A Battalion With the Same Name

The name Myrotvorets, or “Peacemaker,” also belonged to a unit of the same ministry. In 2014, the Interior Ministry fielded a Special Purpose Battalion called “Myrotvorets.” The battalion is not the website. But both carried the name in the same year, in the same ministry, while Avakov ran it and Gerashchenko advised him.

On October 20, 2014, Avakov posted on Facebook about handing apartment keys to wounded soldiers of that battalion, with then-acting President Oleksandr Turchynov. Facebook’s translation says the apartments were bought “from the ministerial funds.” No record found links the battalion to the website’s operations.

What Ukraine’s Embassies Say

Ukraine’s diplomats publicly disown Myrotvorets. In July 2023, Bulgaria complained that its citizens, including the deputy speaker of parliament, were listed. Ukrainska Pravda reported that Ukraine’s ambassador “assured the Bulgarian Foreign Minister that ‘the activity of the Myrotvorets public organisation is in no way connected with the work of Ukraine’s state institutions and does not reflect the official policy of the Ukrainian state’.”

The same report adds: “The Embassy of Ukraine in Bulgaria stated separately that Myrotvorets’ activities are in no way connected with Ukraine’s state institutions operations”

Set that statement beside Myrotvorets’ own 2014 notice. The embassy says there is no connection with state institutions. Myrotvorets says officers of two state institutions attended its working meeting and discussed sharing critical information. Both cannot be fully right. The embassy may be describing policy; the notice describes practice.

The Overlap at a Glance

The graph also holds subjects that could not be tied to the state. One is a nonprofit finance manager with no public link to the network; he is not named here. Another is a person whose only public profile of this kind rests on sources excluded for this report. A third is the registrant named in the paid historical WHOIS record; the graph attaches an informnapalm.org address to her, which remains unverified against a primary record. The graph redacts that person’s phone numbers and personal email.

The bottom line on officials: the NGO network did not just sit near Kyiv’s government. Its people met state security officers, spoke of cooperating with them, and in at least one prominent case went to work for the state. Ukraine’s embassies say Myrotvorets is a private project. The record shows that the line between private and state has been thin from day one.

Who Paid for InformNapalm? NED, Prometheus and the “No Grants” Claim

Allegations of American money have trailed Myrotvorets and InformNapalm for a decade. Most of them cite nothing. One payment is on the public record.

Proven: A $100,000 NED Grant for informnapalm.org Work

The National Endowment for Democracy is a private nonprofit in Washington, D.C. It hands out grants to civic groups, independent media, and activists abroad. Its money comes mostly from Congress.

NED publishes each year’s grants by country. The archived 2016 Ukraine grant list includes this entry, quoted in full:

“Promoting the Integrity of the Information Space” — Prometheus — $100,000. “To defend the integrity of the information space. The organization will conduct open-source investigations that monitor and spotlight external Russian military actions and post them on its popular and trusted website, https://informnapalm.org.”

The grantee is Prometheus, a Ukrainian nongovernmental group. The described deliverable is investigations posted on InformNapalm’s website. The grant text calls informnapalm.org “its” website.

The two groups also published together. The Ukraine Crisis Media Center, a Kyiv press hub, announced a joint Prometheus and InformNapalm report titled “Donbas in Flames,” a guide to Russian-backed armed groups in eastern Ukraine.

InformNapalm’s Own Account

InformNapalm presents itself differently. Its English donation page says: “It may seem unfathomable that we have not yet become some kind of a public organization, have not applied for grants and have not become vassals of a political party or an individual businessman.”

The page adds: “There is no government institution in any country in the world that would fund our activities.” And: “We are a purely volunteer project and we will remain so.”

Can both be true? Narrowly, yes. InformNapalm itself may never have signed a grant contract. A partner organization did, for work that would appear on InformNapalm’s site. A reader told that InformNapalm “have not applied for grants” would not learn that U.S. public money once paid for its content. That gap is worth disclosing. It is not proof of wrongdoing.

There is no record of an NED grant to Myrotvorets. The NED active-grant listing and the archived 2016 Ukraine list do not name it. No public record shows NED money reaching the Myrotvorets database.

Did the NED-Funded Network Promote Myrotvorets?

Yes, repeatedly, through InformNapalm, the site NED’s grant paid to publish on. The record shows a steady stream of InformNapalm stories that cite, republish or route readers to Myrotvorets.

Start with who publishes what. NED’s 2016 grant text, quoted above, calls informnapalm.org Prometheus’ own website. Prometheus, which its About page says was registered in December 2015, describes its “Evidence” project the same way. Its project page says: “Проект здіснюється у співпраці з міжнародною волонтерською спільнотою Informnapalm.” That is, the project “is carried out in cooperation with the international volunteer community InformNapalm.” The page adds that the project provides for “сприяння розповсюдженню аналітичних матеріалів”, or “promoting the distribution of analytical materials.”

InformNapalm, in turn, writes about Myrotvorets often. As of October 17, 2026, a search of InformNapalm’s English-language edition for “Myrotvorets” returns 124 posts that mention it, dated from February 19, 2015, to July 6, 2024. Searches of the Ukrainian and Russian editions return 151 and 152 posts for the local spellings. Those counts run high, because the same words also mean “peacekeeper.”

Not every mention is an endorsement; some are passing references. But much of the coverage is not neutral. Some posts use Myrotvorets as a source. On July 31, 2016, the year of the NED grant, InformNapalm’s Ukrainian edition wrote: “Вихідні дані для аналізу спільнота InformNapalm отримала від центру «Миротворець».” In English: “The InformNapalm community received the source data for the analysis from the Myrotvorets center.”

Some republish Myrotvorets’ own reports. On November 22, 2016, InformNapalm’s English site ran a piece that opens: “InformNapalm international intelligence community presents the report by Myrotvorets (Peacemaker) that analyzed the DPR terrorist organization’s propaganda measures targeted at Western journalists.”

That report names writers from the United States, Canada and Europe who took press trips into occupied Donbas. Among them is James Carden, who the report says “was an advisor on Russia and a special representative for international affairs in the U.S. State Department.” It ends by promoting the database and the hand-off to Ukraine’s security services: “Therefore, Myrotvorets Center includes their records in the Purgatory and we, the journalists, inform the Security Service of Ukraine and the Ministry of internal Affairs of Ukraine on the facts of law violations against our state which became known to us.”

Others send readers straight to the database. An InformNapalm Russian-edition post from February 1, 2015, is headlined “ИНСТРУКЦИЯ. Сделай Украину чище – сдай рашиста в ЧИСТИЛИЩЕ!” That translates as “Instructions: Make Ukraine cleaner – turn in a Russian fascist to Purgatory!” It begins: “В принципе, все прекрасно написано на сайте «МИРОТВОРЕЦ»”, or “In principle, everything is written perfectly well on the Myrotvorets site.”

The pattern held for years. In a December 2020 update on a downed Russian drone, InformNapalm said three militants caught on camera “are listed in the database of the Myrotvorets Center as local collaborators of the Russian occupation forces in the Donbas”. It credited their identification in part to “the use of the Identigraf automated face recognition software of the Myrotvorets Center.”

What the record does not show is NED paying for any of these posts. The grant list names Prometheus and informnapalm.org, not specific articles, and no public record ties grant money to Myrotvorets content. The documented point is narrower: the website a U.S.-funded grant paid to publish on has amplified Myrotvorets, its database and its face-recognition tool for nearly a decade.

From Covert to Overt: How NED Took Over the CIA’s Old Job

Online, the NED grant is often called “CIA money.” The record does not show that. It shows something older and better documented: Congress moved work the CIA once funded in secret into open, arm’s-length grants.

The story starts in 1967. Ramparts magazine revealed that the CIA had secretly funded the National Student Association, as the Church Committee report recounts. President Lyndon Johnson ordered a review led by Under Secretary of State Nicholas Katzenbach. The Senate’s Church Committee later wrote that the disclosure “and the subsequent report of the Katzenbach Committee caused a major curtailment of these activities”.

The Church Committee issued its final report in April 1976. The House ran a parallel inquiry, the Pike Committee. Book I of the Church report described how far the secret funding reached: “The philanthropic fronts used prior to 1967 funded a seemingly limitless range of covert action programs affecting youth groups, labor unions, universities, publishing houses, and other private institutions in the United States and abroad.”

The committee explained the Cold War logic. The U.S. responded to Soviet pressure “by involving American private institutions and individuals in the secret struggle over minds, institutions and ideas.” Its verdict was blunt: “The important line between public and private action has become blurred as the result of the secret use of private institutions and individuals by intelligence agencies.”

The Overt Replacement

Congress created NED in 1983. Its leaders said openly what it replaced. In 1986, NED President Carl Gershman told The New York Times, in an article later reprinted in the Congressional Record: “We should not have to do this kind of work covertly. It would be terrible for democratic groups around the world to be seen as subsidized by the C.I.A.” He added: “We saw that in the 60’s, and that’s why it has been discontinued. We have not had the capability of doing this, and that’s why the endowment was created.”

The same article reported that Gershman “insists that there is no contact between the C.I.A. and the endowment”.

Five years later, The Washington Post’s David Ignatius quoted Allen Weinstein, who helped draft NED’s founding legislation: “A lot of what we do today was done covertly 25 years ago by the CIA,” Ignatius added: “The biggest difference is that when such activities are done overtly, the flap potential is close to zero.”

The Radio Precedent

U.S. international broadcasting went through the same shift. Radio Free Europe and Radio Liberty were, in RFE/RL’s own history, “funded principally by the U.S. Congress through the Central Intelligence Agency (CIA).” A CIA chronology records the end of all its financial support on June 30, 1971, and of all supervision on March 30, 1972.

Congress then created the Board for International Broadcasting in 1973 to fund the radios in the open. Today they sit under the U.S. Agency for Global Media, which also runs Voice of America. RFE/RL’s history page summarizes it: “In 1971, all CIA involvement in RFE and RL ended.”

USAGM’s own organizational chart shows the structure. Two networks are federal: Voice of America and the Office of Cuba Broadcasting. Four are listed as “Non-Federal Networks & Grantees”: RFE/RL, Radio Free Asia, Middle East Broadcasting Networks and the Open Technology Fund. Each grantee has its own board of directors and president.

The model is the same in both cases. Congress pays. A separate board or private grantee spends. The CIA is out of the chain.

Analysis: NED is to the CIA’s old covert-funding role what USAGM’s grantees are to the government. Both are congressionally funded nonprofits with their own boards, kept behind a statutory firewall from the agencies that once ran the work. Critics see that firewall as a way to keep the state’s hand out of sight. Supporters see it as the fix for the secrecy the Church Committee condemned. The record shows the structure. It does not show CIA money in NED today.

What NED Says, and What Critics Say

NED rejects the government label. Its FAQ page answers the question “Is NED part of the U.S. government?” with: “No. NED is a private, non-profit, grant-making organization that receives an annual appropriation from the U.S. Congress through the Department of State.”

Critics read the history as a cut-out model. The late historian William Blum, a longtime CIA critic, wrote that “The idea was that the NED would do somewhat overtly what the CIA had been doing covertly for decades, and thus, hopefully, eliminate the stigma associated with CIA covert activities.”

Analysis: No public record shows the CIA funds NED today, or that it directed the Prometheus grant. No document shows CIA funding of InformNapalm or Myrotvorets. The only “U.S. intelligence grants” language in the FOIA material is the SBU “Bedbugs” file, which concerns other activists and which the SBU called a fake. What the record does show is a policy choice. After the Church era, Washington replaced covert CIA funding of private groups with overt, arm’s-length grants through bodies like NED and USAGM. That structure is why critics call it a cut-out, and why NED’s defenders call it transparency.

What a Real CIA Link Would Look Like

Claims of CIA funding are easy to make and hard to prove. It helps to spell out what evidence would settle the question.

A real funding link would leave paper. It could be a contract or grant record naming Myrotvorets or InformNapalm. It could be a declassified document, a FOIA release that names either group, sworn testimony, or a court filing. It could be a payment trail through a known intermediary, documented by a reputable outlet with named sources.

None of those has surfaced. What exists instead is a mix of branding, such as the Langley address and the “NATO” content domain; an opinion magazine’s assertion; a 1991 quote about NED’s origins; and a Ukrainian counterintelligence file that its supposed authors disowned. Each is worth reporting. None is proof.

The NED grant is different in kind. It is a documented payment of U.S. public money, published by the payer. It went to Prometheus, for work on informnapalm.org. That is the only U.S. government-linked money in this story that the record documents.

The Webmaster Who Bridges Both

Return to the money with the infrastructure in mind. NED paid a partner to post investigations on informnapalm.org. InformNapalm’s mail runs through wildwolf.name. Myrotvorets’ mail runs through the same server. The 2016 grant does not fund that server or Myrotvorets. It does show that U.S. public money and the Myrotvorets network sit one technical step apart.

Which Americans Are on Myrotvorets? U.S. Citizens in a Foreign Database

Myrotvorets was built to catalog Russians and Ukrainians accused of aiding the invasion. It did not stay there. Archived entries show U.S. citizens, including a sitting member of Congress at the time she was listed.

The entries below come from Wayback Machine copies of the public pages.

Tulsi Gabbard

Tulsi Gabbard, a former Democratic congresswoman from Hawaii, became Director of National Intelligence in 2025. Meduza reported that she had been “included in the Myrotvorets database since at least 2022”

How Washington screens its own appointees is a separate question. Leaked 2016 transition files show that White House vetting leaned heavily on newspaper clippings.

The archived entry from August 30, 2022 accuses her in Russian: “Вероятно является агентом российских спецслужб.” That reads, “Probably is an agent of the Russian special services.” The site offers no evidence for it beyond press clips.

Among its sources, the entry cites a post from Ukraine’s own Center for Countering Disinformation (CCD), a body under the country’s National Security and Defense Council. That is a government list feeding a private one.

Meduza also corrected a viral rumor. It found no evidence Donald Trump was ever listed. And it noted a practical stake for anyone named. It wrote that the database is “widely used to screen individuals at government checkpoints”

Gonzalo Lira: Listed, Jailed, Dead

Gonzalo Lira was a U.S. citizen born in California and raised partly in Chile. He lived in Kharkiv and made YouTube videos echoing Kremlin talking points.

The archived Myrotvorets entry was posted on June 10, 2022, at 20:04, by a user named “XUNTA.” It labels him “Антиукраинский пропагандист.”, or “anti-Ukrainian propagandist.” It lists his countries as the United States and Chile.

The SBU arrested Lira in May 2023 on charges of justifying Russian aggression. Newsweek reported his death in January 2024 and quoted the State Department confirming “the death of a U.S. citizen in Ukraine” The Daily Beast also reported the death.

No public evidence shows the Myrotvorets entry caused his arrest. Ukraine’s security service needed no website to find a man posting under his own name. The case still shows what is at stake. An American was listed as an enemy by a site that critics say feeds security screening. Within a year he was in a Ukrainian jail, and he died in custody.

Scott Ritter

Scott Ritter is a former Marine officer and United Nations weapons inspector in Iraq. He has been a sharp critic of U.S. policy on Ukraine.

The archived entry was posted on April 6, 2022, at 13:17. The posting account is named “NSA.” The entry includes one inflammatory personal accusation, unrelated to his commentary on Ukraine, that was cropped from the image below.

CovertAction grouped Ritter, Gabbard, and Senator Rand Paul as Americans on Ukrainian lists. Newsweek clarified that Paul was named on the CCD government list, not on Myrotvorets. No Myrotvorets entry for Paul could be found.

Henry Kissinger

The Ukrainian media watchdog Detector Media reported on May 27, 2022, that former Secretary of State Henry Kissinger had been added to Myrotvorets. Days earlier, he had suggested at Davos that Ukraine consider territorial concessions.

Per Detector Media, the entry called him “Співучасник злочинів російської влади проти України та її громадян”, or “an accomplice in the crimes of the Russian authorities against Ukraine and its citizens.” Russia’s Kommersant carried the story, and the EU’s East StratCom team later flagged Russian coverage that called the database a “death list.”

Roger Waters Is Not American

Pink Floyd co-founder Roger Waters is often lumped in with the Americans. He is British. Newsweek reported he was added on August 27, 2018. It also offered the founders’ framing. Citing his response to an Al Jazeera report, the magazine quoted Gerashchenko: “We are not a punitive body, we are an inquiry office.”

A Government List Next to a Private One

Ukraine’s Center for Countering Disinformation is a state body. In 2022 it published its own roster of people it accused of spreading Russian narratives. That roster included Americans, among them Senator Rand Paul, according to Newsweek.

The CCD list and Myrotvorets are separate. One is official, the other private. But the Gabbard entry on Myrotvorets cites a CCD post as a source. In practice, a government accusation became a footnote in a private database entry that also carries a person’s photo and birth date.

That handoff is the heart of the domestic-targeting worry. A foreign government names a U.S. citizen. A private site with reported ties to that government’s security service files the name, the face, and the accusation in a searchable database. Neither step requires any U.S. court, agency, or appeal. The listed American has no clear way to challenge either.

Myrotvorets entries carry no expiration date. The Gabbard page was live in 2022. Meduza found it still discussed in 2024, after President Trump picked her to lead the U.S. intelligence community. A foreign database had labeled the incoming Director of National Intelligence a probable Russian agent.

The Domestic-Targeting Problem

Here is why Americans should care, whatever they think of the people listed.

First, the data. The archived entries show full names, photos, and dates of birth, and DFRLab reported that the site published journalists’ personal data in bulk. When the subject is an American, a foreign website is publishing a U.S. person’s identity data and labeling them an enemy agent. U.S. privacy law does not reach a server abroad.

Second, the plumbing. Part of the network’s infrastructure sits in North America. The shared mail server and the site’s analytics server both sit in OVH’s Canadian network, per ARIN. The front end runs through Cloudflare, a U.S. company. The code is hosted on GitHub, a U.S. platform owned by Microsoft.

Third, the money. U.S. public dollars have reached the InformNapalm side of this network through NED. No record shows any reaching Myrotvorets. But NED’s own rules bar it from funding programs inside the United States. A list of Americans hosted next door to a NED-funded project raises a fair question for Congress, which funds NED: what did grant oversight know about the people and servers around its grantee?

Fourth, the official channel. A government body, Ukraine’s CCD, has named Americans on its own list, and Myrotvorets cites it. The State Department, in its human rights report, describes the site as reportedly close to the security services. Taken together, those facts mean a U.S. citizen’s speech can land them in a database that, by the State Department’s own account, may be connected to a foreign intelligence service.

None of that proves a plot. It describes a risk that, in the public record, Washington has noted only in passing.

Why Did Myrotvorets Lean on NATO Branding? Ukraine’s 2014 Information War

Myrotvorets was born in a war of words as much as a war of guns. To read its code and its branding, you need that context.

In February 2014, the Maidan protests in Kyiv toppled President Viktor Yanukovych. Within weeks, Russia seized Crimea. By spring, Russian-backed forces were fighting in the Donbas, Ukraine’s eastern coal region. Kyiv found itself outgunned on television and online as well as on the ground.

DFRLab described the response in 2017: “After the illegal annexation and occupation of Crimea and the beginning of the conflict in eastern Ukraine in 2014, the new Ukrainian government began to undertake efforts aimed at combating Russian active measures, information warfare, and propaganda.”

A Ministry for Information and an Online Army

In December 2014, the same month Myrotvorets’ first domain was live and indexed, Ukraine created a Ministry of Information Policy. Within weeks it launched a volunteer “information army.”

Newsweek reported in February 2015: “35,000 individuals have reportedly signed up to join Ukraine's 'information army' - the new project drafted by the country's Ministry of Information Policy”

The minister promised honesty. “"We are not going to create fake news, we are not going to talk nonsense and we will not speak untrue things," he said.” The project’s motto was blunter. Newsweek reported it as “"Every post you make is a bullet to the mind of the enemy".”

That is the climate in which a volunteer “enemies” database could flourish, with officials applauding from the sidelines.

Leaving Neutrality Behind

Ukraine was also changing its geopolitical identity. NATO’s own history page says: “From 2010 to 2014, Ukraine pursued a non-alignment policy, which it terminated in response to Russia’s aggression.”

NATO says its Kyiv office advises Ukraine on messaging. The page lists among that office’s tasks “providing advice and support to Ukrainian institutions in the area of strategic communications capability development.”

None of that is secret. It is the public face of a real partnership. The question for this investigation is different. Did people behind Myrotvorets dress the project up as more Western, and more NATO-backed, than it was?

Analysis: Borrowed Credibility

The public evidence shows a pattern of Western and NATO branding attached to Myrotvorets infrastructure. Taken alone, each item proves little. Together, they suggest a deliberate effort to borrow credibility, or to rattle adversaries. That is an interpretation, not an established fact.

The Langley address. The homepage header, quoted above, lists “Langley, VA, USA” first among its locations. That line is real; it sits in the site’s HTML today. What it does not do is prove a CIA link. A website can print any address it likes.

Some outlets ran with it. CovertAction Magazine wrote in 2022 that Myrotvorets is a website “whose domain name is listed as being in Langley, Virginia, headquarters of the CIA.” It also claimed: “Its welcome message advertises itself as a “CIA project.””

The “CIA project” claim could not be confirmed. The archived homepage contains no such phrase. The site runs through Cloudflare, a U.S. network company that fronts millions of websites. Cloudflare’s presence says nothing about who owns the site.

The “NATO” content network. Myrotvorets has served files from a domain called natocdn.net. A content delivery network (CDN) is a set of servers that stores copies of images and scripts close to readers so pages load fast. The name “natocdn” invites readers to assume NATO runs it.

Public certificate records tell a plainer story. A crt.sh search for natocdn.net shows its first security certificates came in January 2019 from Cloudflare and Let’s Encrypt, a free service. NATO’s own sites use the nato.int domain.

Paid historical registration records have been cited online as tying natocdn.net to the person said to have first registered myrotvorets.center. Those records could not be independently checked.

A related rumor holds that a Myrotvorets server once resolved to a NATO subdomain, psb4ukr.nato.int. No historical DNS record shows that subdomain ever existed. The claim traces to a forum screenshot and to the defunct pro-Russian hacker site Cyber Berkut. Public records support that: the claim is unproven.

A reader comment on the CovertAction article made the same leap in reverse. It declared, in capital letters, that natocdn.net content was hosted on servers assigned to NATO in Brussels. Domain records checked on October 16, 2026, show natocdn.net behind ordinary Cloudflare servers. Nothing in public data supports the Brussels claim.

“For foreign special services.” The homepage menu includes an English link reading “For foreign special services.” It points to auth.myrotvorets.center, a login page. More on that page in the code section.

The leaked slide deck. Two slides circulate online from what is described as a leaked psychological-operations presentation. Psychological operations, or psyops, are military efforts to shape the beliefs and behavior of a target audience.

One slide, titled “Tasks of Operation,” lists goals such as “Organization of the spread of misinformation, destructive rumors, panic and pessimistic moods in the territories under separatists control.” A second slide, “Cooperation,” lists NATO’s strategic communications and cyber defense centers, U.S. Special Operations Command, U.S. Cyber Command, the Army’s 4th Military Information Support Operations Group, and two British units.

Accounts of the deck say it describes InformNapalm as a Ukrainian Ministry of Defense “special project.” The full deck has not surfaced publicly. It cannot be dated, and its author is unknown. Anyone can type a list of NATO units onto a slide. The slides appear here because they circulate widely, and because readers deserve to see what is actually on them. They are not evidence of U.S. or NATO involvement. The same caution applies to other leaked lists, such as the alleged Saudi spy files released by a Houthi-tied group: the files may be doctored, but the people named in them still face the risk.

Here is the bottom line on branding. Myrotvorets and its satellites use names and labels that point at Langley and NATO. The public record shows commercial certificates, Cloudflare hosting, and a Ukrainian volunteer operation. Branding is not backing.

How Are Myrotvorets and InformNapalm Connected? The Shared Infrastructure

InformNapalm calls itself an international volunteer intelligence community. Since 2014 it has published open-source investigations, research built from public photos, social posts, and records, into Russian forces in Ukraine. It has also published material from hacks of Russian officials.

Press reports have long hinted that InformNapalm and Myrotvorets share people. Public internet records offer a stricter test.

Who InformNapalm Is

InformNapalm’s crypto donation page, hosted by the payment service Whitepay, puts it in its own words: “Founded in 2014, InformNapalm is an international volunteer intelligence community. We investigate military activities, cyber threats and information operations using OSINT, HUMINT and CYBINT, publishing research in more than 20 languages.”

Those are intelligence-trade terms. OSINT is open-source intelligence. HUMINT is human intelligence, gathered from people and sources. CYBINT is cyber intelligence, drawn from computer networks. A group that lists human sources and cyber collection alongside public research is describing more than a fact-checking blog. The same page accepts cryptocurrency donations through Whitepay.

InformNapalm says it began in March 2014 as a volunteer response to Russia’s seizure of Crimea. Its researchers comb social media for soldiers’ selfies, unit patches, and vehicle markings. They have identified Russian units fighting in Ukraine years before Moscow admitted their presence.

Myrotvorets raises money the same way. Its sidebar asks readers to “Help the project” with a PrivatBank card, Bitcoin and WebMoney. It also lists mirror sites, including Tor addresses that work if the main domain is blocked.

It has also published hacked material. That includes the group’s 2016 release of emails it said came from the office of Vladislav Surkov, a senior Kremlin adviser on Ukraine. Hacktivists, not InformNapalm, claimed the breach itself.

Its partner in the 2016 NED grant, Prometheus, is a Kyiv nongovernmental organization. The Ukraine Crisis Media Center has listed Mykola Balaban as Prometheus’ president. Together the two groups produced research guides on Russian-backed forces. That kind of work is exactly what NED’s grant text describes.

None of that makes InformNapalm a branch of Myrotvorets. The two projects publish different kinds of material. InformNapalm writes about units and weapons. Myrotvorets names individuals. The overlap is in the infrastructure underneath.

Proven: The Same Mail Server

Both sites route their email through the same private mail server, according to public domain records checked on October 16, 2026. So do Myrotvorets’ sister sites, including its face-recognition service, identigraf.center.

InformNapalm goes a step further. Its anti-spoofing record, which tells the world which machines may send its mail, names that exact server. Someone with control of InformNapalm’s domain had to write that record.

The server is not run by a commercial email company. It sits on wildwolf.name, a personal domain with no public sign-up. The machine is in the Canadian network of OVH, a French cloud company, according to the American Registry for Internet Numbers.

Shared mail hosting does not prove shared editorial control. Small hosting providers serve many unrelated clients. But a personal domain is different, and that makes the overlap meaningful.

Why One Mail Server Matters

Skeptics will say a shared server is a small thing. Plenty of unrelated sites share hosting. That is true for big commercial providers. It is not true here, for three reasons.

First, the server is not a commercial product. There is no public sign-up for wildwolf.name mail. Organizations that hand their email to a private individual’s machine trust that person with every message they receive, including tips, threats, and law enforcement correspondence.

Second, the link runs in both directions and across years. InformNapalm’s SPF record has to be written by someone with control of InformNapalm’s domain settings. Myrotvorets’ MX records have to be written by someone with control of Myrotvorets’ domains. Both point to the same box.

Third, the server sees traffic. Mail handling gives its operator access to message routing. The c3 beacon gives the same domain a live feed of which Myrotvorets pages readers open. Whoever runs wildwolf.name sits at a chokepoint for both projects.

Who decides what Myrotvorets publishes remains unknown. The plumbing shows who keeps the pipes running.

Who Is Behind wildwolf.name

The public GitHub profile github.com/sjinks lists its website as https://wildwolf.name/. The profile name reads “Volodymyr Kolesnykov.” It lists the location as Ukraine and the company as Automattic, the firm behind WordPress.com.

InformNapalm has publicly named a webmaster with nearly the same name. In an August 2018 fundraising post for a sick volunteer, it wrote that “Volodymyr Kolesnikov – our webmaster and the most devoted volunteer in our team – was diagnosed with cancer.”

The same post adds a telling detail about his job: “We want to hear him swearing during yet another DDoS attack on informnapalm.org.” A distributed denial-of-service (DDoS) attack floods a site with junk traffic to knock it offline.

“Kolesnikov” and “Kolesnykov” are two common English spellings of the same Ukrainian surname. The match is strong but not conclusive. No public statement from Kolesnykov about Myrotvorets could be found. He is not accused of anything. Running mail servers for websites is lawful work.

What the record does prove is a single technical operator behind mail for both projects, and a public trail from that operator’s domain to a named Ukrainian developer.

The map below shows how those ties fit together. It was built from public records on eight subjects, including Myrotvorets, InformNapalm, Prometheus and Ukrainian officials. Private emails and phone numbers of individuals are blurred.

Proven: Every Page Calls wildwolf.name

The tie is not only in mail. Every page view on Myrotvorets is reported to a server on the same personal domain, telling it which page the reader opened. Details are in the code section below.

The archived /criminal/ database page from October 11, 2026, carries the same call.

Proven: Myrotvorets’ Software Factory

Myrotvorets runs a public GitHub organization. The GitHub API shows the account “myrotvorets” was created on May 23, 2020, links to https://myrotvorets.center/, and holds seventy-one public repositories. Its listed contact email misspells the site’s own name.

The repositories are not toys. They include microservices for IDentigraF, the group’s face-recognition tool, a “FaceX” image-processing stack, a Telegram bot for Myrotvorets News, and psb-api-ipgeo, described as an “IP Geolocation microservice.” IP geolocation estimates a visitor’s country and city from their internet address.

Commits come from an account called “myrotvorets-team” and from automated update bots. The organization shows no public members. The developers stay hidden.

Reported, Not Verified: The Registrant Trail

A further claim could not be checked against a free public source. Historical WHOIS records from paid services are said to show myrotvorets.center was first registered on November 7, 2015, with an email address at informnapalm.org. WHOIS is the public registry of who holds a domain name. Older WHOIS history sits behind paid services such as SecurityTrails.

A 2016 WHOIS record for psb4ukr.net names the same registrant. That record is not published here, because it contains a street address and phone number. WHOIS entries can be filled in with any affiliation and are often falsified.

If the registrant email is accurate, it would be a second, direct link between the projects. It remains reported, not proven.

The Founders’ Own Words

Myrotvorets’ leadership has never hidden its kinship with InformNapalm, or with the state. In a 2015 interview with the Ukrainian outlet Fakty, quoted by Lawfare, Zaitsev said: “I repeat, we are not abstract: we work with the state, and the state cooperates with us.” The section on officials below shows what that cooperation looked like on paper.

The two projects also sit on the same sidebar. Myrotvorets’ “Our projects” widget links its database, IDentigraF, Myrotvorets News, a radio stream, and the leak archive Ordilo.

SecurityTrails, a DNS history service, lists the site’s subdomains. Subdomains are prefixes such as report.myrotvorets.center that point to separate services. Most sit behind Cloudflare. A few, including the analytics server, sit directly with OVH, the same company behind the shared mail server. A public lookup confirms it.

How This Story Was Reported

This report uses open-source intelligence, or OSINT: research built only from information anyone can reach. Readers can check each step.

Archived pages. Myrotvorets and InformNapalm sit behind Cloudflare challenges that block automated readers. Those checks were not bypassed. Instead, the reporting used the Internet Archive’s Wayback Machine, which stores dated copies of public pages. Quoted code comes from the archive’s raw mode, which serves the page exactly as it was captured, without the archive’s own toolbar. Each code block names its capture.

Domain records. Mail, address, and text records were checked through public DNS services. Each record link reruns the lookup live, so readers can check it in a browser. Results can change after publication. The snapshot is dated October 16, 2026, at 8:58 p.m. EDT.

Network ownership. Server ownership came from the public lookup run by regional internet registries such as ARIN.

Certificates. Searches covered certificate transparency logs through crt.sh. Every certificate that browsers trust must be logged publicly, which makes these logs a reliable history of when a domain went live with security.

Code hosting. Sources include public GitHub profiles and the GitHub API, which returns creation dates and repository counts in a machine-readable form.

Documents. The FOIA excerpts come from State Department releases; the slides circulate online. Claims that could not be checked are labeled. Material resting on unverified personal allegations was excluded, and personal identifiers are not published.

Privacy. Myrotvorets publishes personal data. This report does not repeat it. Screenshots of Myrotvorets entries show what the site itself publishes, but addresses, phone numbers, email addresses, and payment details are cropped from every image.

Limits. The reporting did not log in to any account, submit forms, send test traffic to the psyops endpoint, or contact servers beyond normal public lookups. That limits what we can say about server-side behavior. It also means every finding here can be reproduced by any reader with a browser.

What Did U.S. Diplomats See in Kyiv? The FOIA Documents

Two State Department records released under the Freedom of Information Act (FOIA) shed light on the backdrop. Neither document mentions Myrotvorets by name. Both describe the security environment it grew up in. Both deserve careful reading, because both are easy to overstate.

Document One: “Massive Wiretapping” of Journalists

The first is an email chain from October 28, 2016. It was released as FOIA case FL-2017-16407. A State Department employee in Kyiv sent it to the embassy’s political section under the subject line “Ukrainska Pravda reveals massive wiretapping, surveillance of journo’s communications by pres admin.”

The note summarizes an investigation by Ukrainska Pravda, Ukraine’s leading online newspaper. It reads, in the cable’s own words: “UP published investigation report based on the ‘analytical reports’ prepared by presidential administration for Poroshenko and his entourage that were anonymously leaked to Olena Prytula (UP owner) several months ago.”

It continues: “According to UP, reports covered the web publication’s investigations in 2015-early 2016 and their content suggested that the phones and messages of journalists and MPs who criticized current administration were illegally wiretapped by SBU.”

The cable records the official denial in the next line: “Media reached SBU’s Deputy chief Tkachuk for comment. Tkachuk dismissed UPs claims as ‘groundless.’”

The email was forwarded to the U.S. ambassador, an FBI official, and others. A routing block on the same page lists Victoria Nuland, then the assistant secretary of state for European affairs, as a sender to a group of officials. Privacy redactions marked “(b)(6)” cover several addresses.

You can read the newspaper’s original story. Ukrainska Pravda published it on October 28, 2016, under the headline “Вуха влади. Як стежать за роботою журналістів УП (ДОКУМЕНТИ).” That translates to “The Ears of Power: How the Work of UP Journalists Is Being Watched (Documents).”

Ukraine’s government disputed it. Ukrainian News Agency later reported that the SBU and the National Police said they found no evidence of spying on the outlet’s journalists.

Why it matters here: the email shows U.S. diplomats tracking claims that Ukraine’s security service watched critical journalists. During the same window, Myrotvorets posted the personal data of thousands of journalists. The cable does not link the two. It sets the scene.

Document Two: The “Bedbugs” File

The second excerpt is page thirteen of twenty-one from State Department case FL-2020-00028, released August 31, 2021. The header marks it “UNCLASSIFIED.” It is an April 27, 2018, email with the subject “Counter-espionage case against Sytnyk and Uglava.” Sender and recipient are redacted.

Artem Sytnyk then ran Ukraine’s National Anti-Corruption Bureau (NABU), which the United States backed. Gizo Uglava was his first deputy.

The email summarizes a document said to come from the SBU. It reads: “Attached is a copies of the Act (top secret) about opening the counter-espionage case against Sytnyk and Uglava initiated by State Security Service of Ukraine. The case code name is ‘Bedbugs’.”

The bullet points that follow are the SBU file’s accusations, not U.S. findings. One reads: “To lobby this process U.S. Intelligence Agencies influenced public activists Shabunin, Yurchishyn, Kaleniuk, Sobolev, Leshchenko and Naiem through providing grants for them;”

Another reads: “Uglava and Sytnyk every week attending U.S. Embassy for coordination their tasks and getting new instructions;”

Read that page carefully. It does not show the CIA paying anyone. It shows a U.S. official forwarding what a Ukrainian counterintelligence file alleged. That file’s authenticity is contested.

The Ukrainian site Skelet.org, translating a Vesti report, wrote in 2018: “The SBU says it's a fake.” The same article quotes the document’s text as “the document, whose authenticity has not been proven, states.”

So the strongest fair reading is this: in 2018, the State Department had in hand a document in which Ukraine’s own security service, or someone posing as it, accused U.S. intelligence of steering activists with grants. The SBU publicly disowned it. Whether anyone acted on it is unknown.

What the FOIA Record Does Not Show

Neither document names Myrotvorets, InformNapalm, or NED. Neither proves a U.S. hand in either site. A separate leaked slide deck, discussed below, cannot be verified without FOIA releases or formal statements from the Pentagon.

That is the honest state of the paper trail. The technical trail goes further.

What Does Myrotvorets’ “Psyops” Code Do?

A website’s source code is public by design. Your browser downloads it to draw the page. The code below comes from Wayback Machine copies of Myrotvorets pages, read the way any visitor’s browser receives them. The verbatim code is in the technical evidence note at the end.

The Psyops Plugin

Myrotvorets runs on WordPress, the popular publishing software. WordPress add-ons are called plugins. Every page on the site loads an in-house plugin whose developers named it “psyops.”

The plugin’s folder carries the prefix “psb,” matching the site’s first domain, psb4ukr.org. Near the top of each page sits an empty box waiting for whatever the script produces.

What psyops.js Does

The full script, as archived on October 8, 2026, is short.

In plain English, the script does four things.

1. It looks for the empty box on the page.
2. It asks the Myrotvorets server for a “psyops_message.”
3. It includes a test switch that lets an operator pretend to be a visitor from somewhere else.
4. If the server returns a message, the script displays it in large bold type on a bright yellow background, the yellow of Ukraine’s flag.

The script itself sends no visitor data beyond the ordinary request. The key logic lives on the server, out of public view. But the test switch reveals the design: the message depends on where the visitor is. Myrotvorets keeps a public location-lookup service on GitHub, described above.

The likely result: the plugin shows a different message to readers from different places. A reader in Russia might see one banner. A reader in Kyiv might see nothing. That is targeted messaging, and the developers chose to call it “psyops.”

An earlier capture of the site’s code shows the same logic.

How Long It Has Run

The Wayback Machine’s capture index shows psyops.js first archived on July 1, 2022, about four months after Russia’s full-scale invasion. The script’s own version stamp converts to the same morning, 10:28 a.m. EDT.

The July 2022 capture is compressed onto two lines, but its logic matches the 2026 version. The plugin has run unchanged for over four years.

Why the “Psyops” Label Matters

Developers name things for what they do. A plugin called “banner” shows banners. A plugin called “psyops” tells you how its authors think about their audience.

In military doctrine, psychological operations aim at foreign audiences. The U.S. Army now calls them Military Information Support Operations. U.S. law and policy restrict aiming them at Americans. Myrotvorets is not bound by those rules. It is a private Ukrainian site.

But Myrotvorets is not only read by Russians. Americans read it, too, including reporters, researchers, and people looking up their own names. The plugin’s IP-based logic means an American visitor may see a message chosen for Americans, or none at all. Without access to the server, no outsider can say what that message is.

That opacity is the problem. A site that catalogs U.S. citizens as enemy agents also runs a feature its builders call psychological operations, and it decides by location what each reader sees. Whatever the intent, readers deserve to know it is there.

The timing also matters. The plugin first appears in July 2022, months into the full-scale war, when Ukraine’s information effort was at its peak and Western audiences were paying close attention. The “Langley” address, the “foreign special services” menu, and the “NATO” content domain all add to a picture of a site that wants Western readers to believe powerful friends stand behind it.

The branding appears to work in two directions. To Russian readers, it signals danger: the West is watching you. To Western readers, it signals legitimacy: this is an ally’s tool. Neither signal is backed by any public record of U.S. or NATO control. Both are cheap to send.

Tracking and Page Pings

Myrotvorets runs its own visitor analytics and treats its three main domains as one site, so a reader can be followed across them. Each page view is also reported to a server on wildwolf.name, the personal domain behind the shared mail server; what that server keeps is unknown.

Fingerprinting and Telemetry: What Myrotvorets’ Own GitHub Code Shows

Claims that Myrotvorets “fingerprints” its readers trace back to its public GitHub organization. The organization’s repository list holds seventy-one public repositories. Many carry the prefix “psb,” which matches the site’s first domain, psb4ukr.org. The code uses it as a namespace, as in psb::opentelemetry. No file spells out what the letters stand for.

The repositories show an engineered platform, not a hobby site. There are microservices, small programs that each do one job, for face recognition (IDentigraF and VIDentigraF), photo sync, an integration called Dzhura, IP geolocation, and search tracking. There are Docker images, Kubernetes deployment actions, a private C++ package registry, and WordPress plugins for the main site. Most commits come from an account named “Unsung Hero” tied to the “myrotvorets-team” GitHub user, and from automated update bots.

Several repositories are standard server-monitoring tools. They measure how the servers perform, not who the reader is.

The Search Tracker: Who Searched for Whom

The most revealing repository is not about OpenTelemetry. It is psb-api-search-tracker, the “Search Tracker Microservice.”

It accepts a record for each search of the database. The request body lists the search terms, a person’s name, date of birth, country, address, phone, and description, plus three fields about the searcher: ra, ff, and tc.

export interface TrackingRequestBody {
    name: string;
    dob: string;
    country: string;
    address: string;
    phone: string;
    desc: string;
    ra: string;
    ff: string;
    tc: string;
    loc: number;
    src: number;

Source: github.com/myrotvorets/psb-api-search-tracker/blob/6ac5f62f40f15c938a911aee7628e2df07f5839, fetched October 16, 2026.

The tracking service shows what those fields are. ra becomes remoteAddress, the searcher’s IP address. ff becomes forwardedFor, the X-Forwarded-For header, which lists the chain of addresses a request passed through, often including the visitor’s real address behind a proxy. tc becomes piwikCode. Piwik is the old name of Matomo, the analytics tool on the main site.

        sourceID: number,
    ): Promise<void> {
        if (!params.name && !params.dob && !params.country && !params.address && !params.phone && !params.description) {
            return Promise.resolve();
        }

        return this._model.transaction(async (_trx, { search, searchQuery }) => {
            const trackingCode = isPiwikCode(piwikCode) ? piwikCode : null;
            const searchID = await this.getSearchID(searchQuery, params);
            const ips = this.getIPs(remoteAddress, forwardedFor);
            for (const ip of ips) {
                // eslint-disable-next-line no-await-in-loop
                await this.doTrack(search, ip, locationID || null, trackingCode, searchID, sourceID);
            }
        });
    }

    protected getIPs(requestAddress: string, forwardedFor: string): string[] {
        const ff = forwardedFor.split(',').map((s) => s.trim());
        return [...new Set([requestAddress, ...ff])].filter((ip) => isGoodIP(ip));
    }

    protected async doTrack(
        searchModel: SearchModel,
        ip: string,
        locationID: number | null,
        trackingCode: string | null,
        searchID: number,
        sourceID: number,
    ): Promise<unknown> {
        return searchModel.insert({
            search_id: searchID,
            source_id: sourceID,
            dt: Math.floor(Date.now() / 1000),
            ipaddr: inet_pton(ip)!,
            loc_id: locationID,
            piwik: trackingCode,
        });
    }
}

Source: github.com/myrotvorets/psb-api-search-tracker/blob/6ac5f62f40f15c938a911aee7628e2df07f5839, fetched October 16, 2026.

Read plainly, the service saves the search terms once. Then, for every public IP address it finds in the request and the forwarding header, it writes a row with the search, a timestamp, a location ID, and the Matomo code. The validator accepts that code only if it is sixteen hexadecimal characters, the format of Matomo’s per-browser visitor ID:

export function isPiwikCode(s: string): boolean {
    return /^[0-9a-f]{16}$/u.test(s);
}

Source: github.com/myrotvorets/psb-api-search-tracker/blob/6ac5f62f40f15c938a911aee7628e2df07f5839, fetched October 16, 2026.

The result is a log of who looked up whom. Each search of the “enemies” database can be tied to the searcher’s IP addresses and to the same visitor ID that Matomo uses to follow that browser across myrotvorets.center, psb4ukr.org, and psb4ukr.net. The test database schema in the repository is dated December 1, 2019, which suggests the table design predates the public repository, first committed in February 2024.

This is not browser fingerprinting. It is server-side visitor identification, linked to analytics. For a site that publishes accusations against named people, it means the operators can see who is checking on those people, and from where.

IP Geolocation and Face-Recognition Logins

The IP geolocation microservice looks up an address in two databases and returns the country, city, internet provider, and network owner. It is the kind of service the “psyops” plugin would need to pick a message by location, though no code was found that wires the two together.

    public geolocate(ip: string): GeoResponse {
        const [city, cprefix] = this.geolocateCity(ip);
        const [isp, iprefix] = this.geolocateISP(ip);

        return {
            cprefix,
            iprefix,
            ...this.adaptCityResponse(city),
            ...this.adaptIspResponse(isp),
        };
    }

Source: github.com/myrotvorets/psb-api-ipgeo/blob/71719bc1866266e90073523e6c53d11a1252ceb5/src/ser, fetched October 16, 2026.

The IDentigraF face-recognition front end goes one step further with analytics. Its tracker code hands the logged-in user’s login name to Matomo with setUserId, so each page view is recorded against a named account.

    self._paq.push(['setDocumentTitle', document.title]);
    self._paq.push(['trackPageView']);
    self._paq.push(['enableLinkTracking']);
}

export function setUserID(login: string): void {
    self._paq.push(['setUserId', login]);
}

export function resetUserID(): void {
    self._paq.push(['resetUserId']);
}

Source: github.com/myrotvorets/n.identigraf.center/blob/b3e906679573294247df4e73ddbc3904ca46bcce/s, fetched October 16, 2026.

The organization also kept an archived scraper described as a “Cron job to scrape the list of persons wanted by the Security Service of Ukraine”, a direct software link between the site and the SBU’s public wanted list.

What the Code Does Not Show

There is no FingerprintJS, no canvas or WebGL probing, no audio fingerprinting, and no user-agent parsing library in the repositories reviewed. The request logger can record the user-agent header, but the shared format above does not include it. The claim of “excessive fingerprinting” remains unproven. The narrower claim, that Myrotvorets logs and links visitor identities, is proven by its own code.

Who Builds It: A Match to wildwolf.name

Public commit metadata names no individual. Commits come from “Unsung Hero” and “Myrotvorets” accounts, and neither lists sjinks, Volodymyr Kolesnykov, or wildwolf.name. This report does not publish the accounts’ email addresses.

The dependencies tell a different story. Four Myrotvorets WordPress plugins require PHP packages published under the “wildwolf” name, for example in this composer.json. The package registry Packagist lists the wildwolf/singleton-trait author as Volodymyr Kolesnykov, with source code at github.com/sjinks. The organization’s private C++ registry includes a package called wwa-coro that pulls code from the sjinks/coro-cpp repository. And automated update commits across the organization refresh development containers hosted at ghcr.io/sjinks/codespaces.

Using someone’s open-source code does not make that person the author. But a production stack that runs on one developer’s personal packages and personal build images, combined with mail and beacon servers on that developer’s domain, is a strong technical match. The developer link is rated likely, not proven.

“For Foreign Special Services”: The Login Page

The main menu links to a page in English labeled for foreign intelligence agencies.

The archived login page asks for four things: a login, a password, a six-digit authentication code, and a “key file” upload. Two-factor authentication plus a key file is stronger security than most banks demand.

The page does not say which agencies hold accounts. The site’s header says its information is meant for law enforcement and special services. The login proves only that the site built a gated portal and labeled it for foreign spy services. No login was attempted.

Robots.txt: Blocking Russian Search and AI Crawlers

A robots.txt file tells search engines and other automated crawlers which pages to skip. Myrotvorets’ file blocks Mail.ru, a Russian web company, and GPTBot, OpenAI’s crawler for training artificial intelligence (AI) models.

Myrotvorets wants its data visible to Google and Western security services, not to Russian indexers or AI training sets. That is consistent with its stated mission.

Where It Started: psb4ukr.org in 2014

The earliest Wayback copy of the original domain, from November 1, 2014, shows a simpler site with the same mission and the same nonprofit-center branding.

What Myrotvorets, InformNapalm, NED, and Officials Say

Fairness requires the other side in its own words.

Myrotvorets says it is independent. Its donation page says it is funded by no state or nonstate body and belongs to no government structure. Newsweek quoted Gerashchenko’s response to an Al Jazeera report: “We are not a punitive body, we are an inquiry office.” Meduza reported that Zaitsev “has maintained that the website is not controlled by the agency and does not receive state funding.”

InformNapalm says it is a volunteer project funded by no government. It has publicly thanked its webmaster and described defending its site from attacks.

NED says it is a private nonprofit, not part of the government, and does not fund programs in the United States. Its 2016 grant to Prometheus is public on its own site.

Ukraine’s government has kept its distance. Newsweek reported that the site “has no known or official links to the Ukrainian government” It added that “official Kyiv keeps its own separate list” of people it considers threats.

Russia’s government has long called the database a hit list. Russia’s state news agency TASS reported Moscow’s complaints to international bodies. The EU’s East StratCom team has flagged some Russian claims as disinformation.

The murders cited as proof. Critics point to the 2015 killings of journalist Oles Buzina and former lawmaker Oleg Kalashnikov, both listed on Myrotvorets. Newsweek, citing Al Jazeera, wrote that “no direct link has been found or proven in court” between the listings and the killings.

The legal record in Ukraine. DFRLab reported that Ukraine’s National Police opened a criminal case over the journalist leak in 2016 under the article covering obstruction of journalists’ work.

Timeline: Myrotvorets, InformNapalm, and U.S. Attention, 2014–2026

• February 2014. Maidan protests topple President Yanukovych. Russia moves on Crimea.
• 2014. InformNapalm forms as a volunteer intelligence community. Myrotvorets launches at psb4ukr.org; the Wayback Machine has a copy from November 1, 2014.
• December 2014–February 2015. Ukraine creates a Ministry of Information Policy; Newsweek reports 35,000 sign-ups for its “information army.”
• December 21, 2014. Myrotvorets posts that its specialists met InformNapalm and LostIvan with SBU and Interior Ministry officers present, per its own notice.
• August 2015. Mykola Balaban, speaking for InformNapalm, says it cooperates with the SBU, per the Ukraine Crisis Media Center.
• November 7, 2015. Paid WHOIS history is said to show myrotvorets.center was first registered on this date. Not independently verified.
• May 2016. Myrotvorets publishes personal data of thousands of journalists accredited by Russian-backed authorities in the Donbas. DFRLab records Poroshenko’s condemnation and a police case.
• 2016. NED grants Prometheus $100,000 for investigations posted on informnapalm.org, per its 2016 Ukraine list.
• October 28, 2016. Ukrainska Pravda publishes its wiretapping investigation. A State Department email in Kyiv summarizes it the same day.
• April 27, 2018. A State Department email relays the SBU “Bedbugs” file accusing U.S. intelligence of steering activists. The SBU later called it a fake.
• August 2018. Myrotvorets adds Roger Waters, per Newsweek. InformNapalm names its webmaster in a fundraising post.
• January 26, 2019. First logged certificates for natocdn.net, per crt.sh.
• May 23, 2020. The Myrotvorets GitHub organization is created, per the GitHub API.
• February 24, 2022. Russia launches its full-scale invasion.
• April–June 2022. Entries for Scott Ritter (April 6), Henry Kissinger (May 27, per Detector Media), and Gonzalo Lira (June 10) appear.
• July 1, 2022. The psyops.js plugin is first archived, per the Wayback capture index.
• By August 2022. Tulsi Gabbard’s entry is live, per the archived page.
• May 2023. The SBU arrests Lira. He dies in custody in January 2024, per Newsweek.
• July 2023. Ukraine’s embassy in Bulgaria says Myrotvorets has no connection with state institutions, per Ukrainska Pravda.
• 2024. The State Department’s 2023 human rights report says Myrotvorets reportedly maintained close ties to the security services.
• November 2024. Meduza examines Gabbard’s listing after her nomination as intelligence chief.
• 2025. Balaban appears at the Kyiv StratCom Forum as deputy head of the state Centre for Strategic Communication, per his forum biography.
• September–October 2026. Archived Myrotvorets pages still list “Langley, VA, USA,” load the psyops plugin, and beacon to c3.wildwolf.name. Public DNS checks on October 16 confirm the shared mail server.

Proven, Reported, Unproven: The Scorecard

This table sorts every major claim about the Myrotvorets network by the strength of the public evidence. “Proven” means it was verified from a primary record. “Reported” means a named outlet or document says it but it could not be confirmed independently. “Unproven” means no supporting record was found.

Claims That Could Not Be Substantiated

Several popular claims did not survive the records check. No document shows CIA money reaching Myrotvorets or InformNapalm. No NED grant to Myrotvorets appears in NED’s records. No browser-fingerprinting library appears in the pages or code reviewed, though the code does log searchers’ IP addresses. Nothing shows that NATO hosts natocdn.net or ever ran psb4ukr.nato.int. The leaked slides and the paid historical registration records could not be verified. A usable copy of a cited State Department press briefing could not be retrieved. And no shared servers turned up between any Ukrainian government or embassy domain and the NGO network; the ties to the state run through people and meetings, not machines.

What Does the Record Show? The Bottom Line

Ukraine in 2014 was fighting a war it was not equipped to fight. The Maidan had just toppled a president. Russia had seized Crimea. Kyiv was outgunned on television and online as well as on the ground, and it leaned on volunteers to fill the gap.

Myrotvorets grew out of that scramble. It calls itself private. The record shows a project built in the shadow of the state. An adviser to the interior minister, Anton Gerashchenko, announced it and defended it. Its own notice puts SBU and Interior Ministry officers at its Dec. 21, 2014, working meeting with InformNapalm. And Mykola Balaban, who spoke for InformNapalm in 2015 and later led Prometheus, became deputy head of the government’s own Centre for Strategic Communication.

It also borrowed a halo. The site printed a Langley, Virginia, address and served files from a domain called natocdn.net. Rumors added a NATO server that no record shows ever existed. None of that proved a Western hand. NATO’s cyber-defense center said so in 2015: “In the past day, Russian media reports have linked the NATO Cooperative Cyber Defence Centre of Excellence to the Mirotvotec website.” The center said it “has absolutely no connection with the site mentioned”. The branding made a volunteer list look bigger and more Western than it was, and Russian outlets amplified it.

The money, though, is real. In 2016, the National Endowment for Democracy, which Congress funds, paid $100,000 to Prometheus for investigations published on informnapalm.org. That site has repeatedly cited, republished and promoted Myrotvorets, including a 2016 report that named American writers and said their records were going into Myrotvorets’ “Purgatory.”

That raises the question the record cannot yet answer. Myrotvorets has listed U.S. citizens, from Tulsi Gabbard to Gonzalo Lira, an American who later died in Ukrainian custody. A network that U.S. taxpayers helped fund shares a private mail server with it, people with it and headlines with it. No record shows NED money went to Myrotvorets itself. But a grant to one group, for content on a website that promotes a third, is the kind of pathway Congress would need to examine to be sure.

No public record shows that Congress has asked.

Technical Evidence

For readers who want to check the infrastructure claims, here are the underlying records, as of October 16, 2026.

• Mail. myrotvorets.center and sister domains list mx.wildwolf.name as their mail server; informnapalm.org lists mail.wildwolf.name. Both resolve to the same OVH address in Canada, per ARIN. InformNapalm’s SPF record names that server’s IPv6 address.
• Page beacon. The archived Myrotvorets homepage source ends with a one-line request to c3.wildwolf.name that passes the current page address.
• Analytics. A self-hosted Matomo instance on pond.myrotvorets.center links visitor IDs across myrotvorets.center, psb4ukr.org and psb4ukr.net, using Matomo’s cross-domain feature.
• Monitoring. The site’s GitHub organization publishes OpenTelemetry packages, and an otel.myrotvorets.center subdomain resolves in public DNS.

Disclaimer

This report relies on public records, archived web pages, and government documents released under the Freedom of Information Act. Allegations described here are allegations, attributed to those who made them.

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio