The Bot's Eye: how Probiva services help Ukraine in organizing terrorist attacks
Ukrainian programmers have created an infrastructure for collecting leaks with personal data of Russians, systematize them and provide access to these databases to employees of the SBU and the Main Directorate of the Ministry of Defense of Ukraine, Izvestia found out. Special services use these opportunities to organize terrorist attacks in Russia. The largest Probiva services, according to their creators, have 15 billion records about Russians. After criminal liability for illegal processing of personal data was introduced in the Russian Federation, many Russian services were blocked or stopped working, but Ukrainian ones continue to work. The FSB of Russia also claims about the use of Probiva services by terrorists. What kind of people are behind this activity is in our investigation.
The Ukrainian "avengers"
There are at least three major services operating on the territory of Ukraine that openly trade personal data of Russians – the sites "Revenge" and OsintKit, as well as the Telegram bot Manticore. The first service on this list is owned by Yaroslav Garaguts, a programmer from Dnepropetrovsk, who openly announces his project in videos. Artyom Levada, a native of Russia born in 1984, is involved in the functioning of OsintKit, and Manticore is promoted by the Ukrainian website Peacemaker.
All three services provide free access to their databases to representatives of the SBU and the Main Directorate of the Ministry of Defense of Ukraine, Izvestia was convinced after studying the information they publish, as well as statements from individuals associated with them.
Probably, with the help of data from similar Ukrainian services, an attempt was made on the life of Lieutenant General of the Russian Ministry of Defense Vladimir Alekseev in early February. The FSB of Russia reported that Pavel Vasin, one of the defendants in the attempted murder of a military man, "helped collect information about the residential addresses and movement routes of employees of the Russian Ministry of Defense using Internet applications and search engines."
"For the last three years, I have been developing the Revenge database with Russian personal data used by journalists, law enforcement officers and the military to investigate crimes," Yaroslav Garagutz, the creator of this service, said in October 2025, speaking at an online conference of the German hacker association Chaos Computer Club (CCC).
According to Garagutz, his team collects and publishes personal data of Russians despite the fact that even in Ukraine such activities are illegal. Presenting his project to the Europeans, he called this activity "ethical" in view of the "current situation" and added that he not only provides free access to intelligence databases, but also sells them.
As stated on the service's website, it contains more than 15 billion records about Russians from more than 200 leaks. This includes information about real estate, place of residence, taxes, debts, vehicles, and medical diagnoses. The Avenger from Dnepropetrovsk sells access to this data at a price from $5 to $400 per month, depending on the tariff.
At the same time, Garagutz in Ukraine has a completely official IT business, also related to databases, Izvestia found out. As follows from the register of Ukrainian legal entities, he is one of the owners of the Clarity project, which allows you to search for information about companies and entrepreneurs in Ukraine, as well as receive information about which court cases they participated in, whether they have debts and much more.
As stated on the service's website, it runs on the Manticore Search software engine, which is owned by the British company Manticore Software. This company sells its database solutions to companies in different countries. Vadim Tkachenko, a native of Kiev with an American passport, is listed as one of the owners of this company, according to data from the British register of legal entities. Tkachenko currently lives in the United States, in North Carolina, according to the state's real estate registry.
The Telegram bot Manticore also operates in Ukraine, which is regularly blocked by the administration of the messenger - the correspondent of Izvestia made sure that from time to time the resource becomes unavailable by the former account name. You can also search the bot for information about your full name, phone number, mail, and passport. The bot advertises itself through individuals recognized in the Russian Federation as terrorists, extremists or included in the register of foreign agents, as well as through the Mirotvorets website.
The business of a native of Russia
Another Ukrainian platform based on the same principles is the OsintKit website. This service, including in the form of a Telegram bot, was launched in 2023 by Ukrainian developers as a tool for searching and verifying information based on various sources, according to its website. In total, more than 670 leaked databases with various data of Russian citizens are connected to the service.: registration addresses, passports, cars, telephones, and even border crossings. In total, the databases contain more than 1.7 billion records about Russian citizens, according to the creators of the resource.
They offer access to it at prices ranging from $10 to $890, but for Ukrainian security forces — the police, SBU and GUR — up to 100 free requests per day.
The service's website indicates that its partner is the Osint Flow public organization, and it also checks people before giving them access to the tool.
This public organization was registered in Kiev in the summer of 2023 (in fact, at the same time when the Probiva service appeared). Its goal is to collect information about alleged "crimes" committed by Russia. Izvestia has discovered in the public domain a whole series of videos in which a certain Artem Levada calls himself the chairman of Osint Flow. According to the sources of the publication, he was born in 1984 in Russia, and now has a registration in Kiev. At one of the press conferences, the video of which is available in open sources, he openly spoke about cooperation with the office of the Prosecutor General of Ukraine.
The market is worth 15 billion rubles
Izvestia sent a request to Roskomnadzor with questions about the number of blocked resources of this kind. The department explained that access to the two sites mentioned by the publication was blocked in Russia on the basis of court decisions, and Probiva bots in Telegram are regularly blocked by the messenger administration at the request of the RCN.
"Based on court decisions on violations of personal data turnover, Roskomnadzor restricted access, or information was deleted at the request of the agency from more than 1,9 thousand Internet pages and sites convicted of illegal dissemination of personal data," Roskomnadzor noted.
In 2025, Roskomnadzor added more than 400 such sites and Internet pages to the Register of Prohibited Information, and about 100 in the first two months of 2026. Access to them is restricted, or information deemed prohibited has been deleted at the request of the agency, Roskomnadzor said.
"In addition, in 2025, at the request of Roskomnadzor, the Telegram administration blocked 3,693 bots that violate the law on personal data. In the first two months of 2026, 1,066 such bots were blocked on Telegram," they summarized.
Experts note that it is difficult to assess the Ukrainian penetration market, but they believe that it can be compared with the Russian one, especially considering that after the introduction of the new article 272.1 of the Criminal Code of the Russian Federation, such Russian services began to close, and the creators of some of them became involved in criminal cases.
— There is no exact data on Ukrainian services, but the Russian probiva market gives us an approximate understanding of the scale. According to data for 2025, it was estimated at 15 billion rubles per year. Considering that after the introduction of criminal liability for the illegal processing of personal data, many Russian services were closed, this market was largely occupied by Ukrainian products," says Igor Bederov, Chairman of the Council for Combating Technological Offenses of the Coordinating Council of the Non—Governmental Security Sector of Russia.
On average, Telegram bots for "punching" can earn 10-15 million rubles a month, while the business of the famous bot "Eye of God" before its closure showed revenue of about 400 million rubles a year, he added.
At the same time, Ukraine also provides for criminal liability for trafficking in personal data. However, if there is news in the Ukrainian media about the termination of the activities of such services and the detention of their owners, it is only in cases where it was a question of selling the data of citizens of Ukraine.
Services for "punching" Russians' data feel quite at ease. Experts explain this phenomenon by the presence of a "power roof" for such services.
— Russian experts have repeatedly stated that Ukrainian services for "penetration" can be a tool or projects of special services created to collect data and psychological operations against the Russian Federation. This sounds quite reasonable, given the prospects opening up for foreign intelligence services," Bederov notes.
Among these prospects, he attributed profiling the actions of Russian users (including security forces), receiving payment from them (this may be an excuse for subsequent extortion for ending the "AFU financing case"), the possibility of embedding malware into individual users' devices, as well as disinformation — providing the necessary information to the user.
— The creator of the "Eye of God" admitted that he provided free access to the bot to Russian security forces in order to legalize the business. It is logical to assume that Ukrainian services can similarly interact with the SBU or the GUR, especially if their activities are directed against Russian citizens, the expert believes.
According to him, blocking Telegram in Russia will not stop the work of the Ukrainian probiv services, although it will create temporary difficulties for them in the form of an outflow of part of the audience. At the moment, according to him, Telegram has no alternative in the field of personal data distribution, which means that users can start bypassing the blockages using MTProxy and VPN, he suggested.
According to Roskomnadzor, 118 cases of leaks were recorded in 2025, as a result of which more than 52 million records about Russians appeared on the Network. This is less than a year earlier: in 2024, the agency recorded 135 database leaks containing over 710 million records about Russians. The leaked data gets to the owners of the databases through the darknet, where they are put up for sale, and their resale through services and bots is a business for those who own them.
Переведено сервисом «Яндекс Переводчик»
