DDoS-Guard

DDoS-Guard is a Russian internet-infrastructure company whose principal services are distributed-denial-of-service attack mitigation, traffic filtering, reverse-proxy protection, and web hosting. The service has existed since 2011 and was developed by Yevgeny Marchenko and Dmitry Sabitov, Russians formerly based in Ukraine. A company using the same name was initially established in Ukraine, while the business was later registered in Sevastopol in July 2014. The company has said that its Russian base was the intended center of operations and that the Ukrainian entity represented an early development stage; reporting by Meduza, however, described a later relocation to Russia and linked it to scrutiny by Ukrainian security and cybercrime authorities over the hosting of the Verified forum, which was associated with payment-card fraud. DDoS-Guard has disputed or denied knowledge of that investigation. The company’s legal and operational structure has included Cognitive Cloud LP in Scotland and DDoS-Guard Corp in Belize. Its traffic-filtering network has used infrastructure in Russia, Germany, the Netherlands, and Japan. DDoS-Guard has also maintained commercial relationships with Russian internet companies and state-linked customers. It partnered with the domain registrar REG.RU in 2014, later provided denial-of-service protection to Russia’s Ministry of Defence, participated in testing related to Russian deep-packet-inspection systems, and has been reported to work with the Central Bank of Russia. These relationships have made the company a significant subject of scrutiny because of the possible intersection between private internet infrastructure, Russian state interests, and the privacy of traffic handled by the service. DDoS-Guard became internationally visible through its willingness to serve controversial, politically extreme, piracy-related, and allegedly criminal websites. Reported or documented customers have included the American social network Parler, the forums 8kun and Kiwi Farms, the neo-Nazi website The Daily Stormer, the piracy sites Nyaa Torrents, MangaDex, and FitGirl Repacks, the academic-shadow-library service Sci-Hub, and a website associated with the Hong Kong protest doxing campaign known as HKLeaks. The company has stated that it follows a form of network neutrality but has also terminated services after complaints or media reporting. It said it ended relationships with Hamas and 8chan after learning more about their content, and it dropped Kiwi Farms in September 2022 after reviewing the site following complaints. Investigative reporters and cybersecurity researchers have alleged that a substantial portion of the websites hosted or protected by DDoS-Guard were connected to phishing, cybercrime forums, banking-data theft, illegal drug sales, or other abusive activity. In January 2021, Brian Krebs reported that a review of several thousand associated websites revealed numerous phishing and cybercrime-related domains. In the same year, a researcher questioned whether DDoS-Guard’s Belize entity had a genuine physical presence and alleged that the structure had been used to obtain Latin American IP address space. LACNIC subsequently announced that it would revoke more than 8,000 IP addresses associated with the company. DDoS-Guard rejected the allegations and said it did have a Belize presence. Group-IB also reported in June 2021 that an allegedly stolen DDoS-Guard database and source code had appeared for sale on a cybercrime forum, although the authenticity of the material was not verified. The European Commission added DDoS-Guard to its Counterfeit and Piracy Watch List in December 2022 after copyright holders alleged that the provider facilitated online piracy. The company’s public profile therefore combines a conventional infrastructure role—protecting websites from attacks and supplying hosting-related services—with a highly contentious reputation arising from its customer base, corporate structure, state-linked relationships, and approach to content moderation.

DDoS-Guard’s service history reaches back to 2011, when software and infrastructure development began under a company associated with Ukraine. Its founders, Yevgeny Marchenko and Dmitry Sabitov, were Russians formerly from Ukraine. The company was registered in Sevastopol in July 2014, and later reporting described Rostov-on-Don as its Russian operating center. DDoS-Guard representatives have characterized the Ukrainian company as an early-stage development vehicle and have said that the business was always based in Russia. Meduza reported a different sequence, stating that a Rostov office did not open until 2015 and that the company appeared to have moved after Ukrainian national-security and cybercrime authorities investigated its alleged relationship with Verified, a Russian-language forum associated with payment-card scams. DDoS-Guard denied knowledge of that investigation. In January 2014, DDoS-Guard partnered with REG.RU, one of Russia’s major domain registrars. The company subsequently developed relationships with organizations connected to the Russian state. Reporting identified the Russian Ministry of Defence as a customer for denial-of-service protection beginning in 2016. In 2018, DDoS-Guard helped test Russian government deep-packet-inspection systems, and it has also been described as working closely with the Central Bank of Russia. These relationships later became important to debates about whether websites using DDoS-Guard exposed their users to potential Russian state monitoring. The company operates through a multinational corporate structure. It has been associated with Cognitive Cloud LP in Scotland and DDoS-Guard Corp in Belize, while its filtering nodes have been located in Russia, Germany, the Netherlands, and Japan. In 2021, a researcher challenged the authenticity of the Belize operation and argued that the entity had been used to obtain IP addresses normally assigned to local organizations. DDoS-Guard said it maintained a Belize presence. Following the report, LACNIC announced that it would revoke more than 8,000 addresses connected to the company. The episode added an internet-number-resource and corporate-transparency controversy to the company’s existing content-moderation disputes. DDoS-Guard’s customer policies brought it substantial international attention. It hosted or protected a range of politically controversial, extremist, piracy-related, and allegedly criminal services. Examples reported in public sources include Hamas, 8kun, Kiwi Farms, The Daily Stormer, Sci-Hub, FitGirl Repacks, Nyaa Torrents, MangaDex, and HKLeaks, a website used in a doxing campaign targeting participants in the 2019–2020 Hong Kong protests. In October 2019, the company acknowledged that HKLeaks was a customer and said it did not intervene in political matters without legal proof of wrongdoing. The company later stated that it had ended service to Hamas and 8chan after learning about their content from news reports. The relationship with Parler was particularly visible. After Parler was removed from Amazon Web Services and other major providers following the January 2021 U.S. Capitol attack, DDoS-Guard supplied attack protection. U.S. lawmakers requested information about Parler’s agreements and communications with Russian entities, while technology journalists raised concerns about the implications of routing or protecting traffic through a company connected to Russian state projects. DDoS-Guard also briefly protected Kiwi Farms in September 2022 after Cloudflare withdrew service. It terminated Kiwi Farms several days later, explaining that its general network-neutrality approach did not prevent it from rejecting content it considered unacceptable after reviewing the site and receiving complaints. The company’s stance has consequently been pragmatic rather than consistently permissive: it has continued to serve many contentious customers while occasionally cutting off customers after public scrutiny. Investigative reporting has repeatedly alleged that DDoS-Guard’s wider customer base includes phishing operations, cybercrime forums, banking-data thieves, illegal drug markets, and other abusive services. In June 2021, Group-IB reported an alleged sale of the company’s database and source code on a criminal forum, though the material was not authenticated. In December 2022, the European Commission added DDoS-Guard to its Counterfeit and Piracy Watch List after copyright holders alleged that it enabled piracy. DDoS-Guard therefore remains both a conventional cybersecurity and hosting provider and a controversial infrastructure intermediary whose business model depends on protecting sites that mainstream providers may refuse.

• 2022

  Kiwi Farms service termination and piracy watch-list listing

  [1]DDoS-Guarden.wikipedia.org

  DDoS-Guard ended its short relationship with Kiwi Farms and was added to the European Commission’s Counterfeit and Piracy Watch List.

• 2021

  Parler protection and infrastructure controversies

  [1]DDoS-Guarden.wikipedia.org

  DDoS-Guard protected Parler after its removal from major U.S. providers and faced reporting about alleged cybercrime hosting, Belize operations, and an alleged data leak.

• 2019

  HKLeaks customer acknowledged

  [1]DDoS-Guarden.wikipedia.org

  The company confirmed that HKLeaks, a site associated with doxing Hong Kong protesters, was a customer.

• 2018

  Deep-packet-inspection testing

  [1]DDoS-Guarden.wikipedia.org

  DDoS-Guard helped test Russian government systems for deep packet inspection.

• 2017

  Sci-Hub moves protection to DDoS-Guard

  [1]DDoS-Guarden.wikipedia.org

  After a U.S. court order targeting infrastructure providers serving Sci-Hub, the site switched from Cloudflare to DDoS-Guard.

• 2016

  Reported Ministry of Defence relationship

  [1]DDoS-Guarden.wikipedia.org

  DDoS-Guard began providing denial-of-service protection to Russia’s Ministry of Defence, according to cited reporting.

• 2014

  Russian registration and REG.RU partnership

  [1]DDoS-Guarden.wikipedia.org

  The company was registered in Sevastopol in July and partnered with Russian domain registrar REG.RU earlier that year.

• 2011

  Service development begins

  [1]DDoS-Guarden.wikipedia.org

  A company using the DDoS-Guard name existed in Ukraine while the founders developed the software and service.

A network-infrastructure and DDoS-mitigation provider emphasizing resilience, traffic filtering, and willingness to serve customers that may face attacks, deplatforming, or limited access to mainstream infrastructure providers.

• Cybersecurity service · 2011

  DDoS protection

  The company’s core offering is protection against distributed-denial-of-service attacks. Traffic is directed through filtering infrastructure intended to absorb or block malicious requests before they reach a protected website or network. The service has been used by ordinary online services as well as controversial sites that have difficulty obtaining protection from mainstream providers.

• Internet infrastructure

  Traffic filtering and reverse proxy

  DDoS-Guard operates filtering nodes across several countries and provides intermediary traffic-handling infrastructure. This architecture can conceal origin servers, filter abusive traffic, and maintain availability during attacks. Its international node footprint has included Russia, Germany, the Netherlands, and Japan.

• Hosting

  Web hosting

  Web hosting is part of DDoS-Guard’s broader internet-infrastructure business. Investigative reporting has identified sites associated with phishing, cybercrime, piracy, political extremism, and controversial online communities among services hosted or protected by infrastructure linked to the company.

• 2022

  European piracy watch-list designation

  The European Commission added DDoS-Guard to its Counterfeit and Piracy Watch List after copyright holders alleged that the provider facilitated piracy.

  Source

• 2021

  Alleged cybercrime-heavy customer base

  Researchers and journalists alleged that many sites using DDoS-Guard were phishing operations, cybercrime forums, banking-data theft services, or other illicit platforms.

  Source

• 2021

  Belize entity and IP-address dispute

  A researcher questioned whether DDoS-Guard had a genuine physical presence in Belize and alleged that the entity had obtained large quantities of regional IP space. DDoS-Guard rejected the allegations, while LACNIC announced the revocation of more than 8,000 addresses.

  Source

• 2021

  Alleged database and source-code sale

  Group-IB reported that data allegedly taken from DDoS-Guard, including customer and payment information and source code, was offered on a cybercrime forum. The authenticity of the material was unverified.

  Source

Read more

• 2019HKLeaks hosting

  Hong Kong · International

  DDoS-Guard hosted HKLeaks, a website dedicated to exposing personal information about participants in the Hong Kong protests. The company acknowledged the commercial relationship while saying it did not take political positions and required legal proof before acting.

  Outcome. The relationship became a prominent example in criticism of DDoS-Guard’s customer-acceptance policy.

  Source

• 2022

  Terminate Kiwi Farms protectionStrategy

  Background

  Kiwi Farms moved to DDoS-Guard after Cloudflare ended its service, amid complaints about the forum’s content.

  Action taken

  After reviewing the site, DDoS-Guard ended the relationship and said that its network-neutrality policy did not cover content it considered unacceptable.

  Aftermath

  The termination demonstrated that the company’s neutrality position allowed case-by-case exclusions after complaints and review.

  Source

• 2021

  Continue protecting Parler after mainstream-provider removalsStrategy

  Background

  Parler lost access to major U.S. hosting and infrastructure providers after the January 2021 Capitol attack.

  Action taken

  DDoS-Guard provided denial-of-service protection to the platform.

  Aftermath

  The decision increased international scrutiny of DDoS-Guard’s Russian state relationships and customer-screening practices.

  Source

1. 1DDoS-Guarden.wikipedia.org