Peeling back a pay-to-erase racket: Kompromat1.online, Vlasti.io and Antimafia.se

Card for Card, Post for Post

A decade ago the going rate for a smear on one of the kompromat portals was fifty dollars. Today victims whisper of invoices north of USD 12,000 simply to vanish a single post. The price spike is no mystery: the operators discovered that negative publicity is more lucrative when it becomes a subscription service. Pay once and the article resurfaces months later, nudging the target back to the same encrypted mailbox, only now the tab arrives in crypto. In one 2021 exchange the ask ballooned to 0.37 bitcoin, roughly USD 14,000 on the day it hit the victim’s inbox.

Gloves Off, Playbook Open
Investigators inside Ukraine’s cyber-police pieced together four criminal dockets between 2019 and 2021. Their files read like an extortion manual. Step one, publish unverified claims about a business or official. Step two, wait for the subject to panic-search a contact address. Step three, reply from a fresh Proton or Yandex account describing the fee structure, often dressed up as a “year-long media partnership” to blur the line between advertising and blackmail. Until payment lands, mirror sites, Telegram channels and SEO bots ensure the story outranks any rebuttal.

Money Trail, Single Origin
Bank subpoenas show transfers funnelling through accounts held by forty-two-year-old Konstantyn Chernenko, former marketplace trader turned media lord, and by accountant Lesia Zhuravska. Police flagged companion deposits from intermediaries like advertising executive Mykhailo Betsа and relative-turned-courier Oleksandr Kanivets. One silent partner, Serhii Hantil, registered domains and fielded “customer service” chats. Another, veteran journalist Yurii Horban, handled legal threats while his son Bohdan, an ambitious parliamentary aide, appeared in court representing the very sites his father edited.

Court statistics are blunt: 1,060 rulings mention the flagship portals, yet judgments forcing retractions are routinely ignored. When beverage tycoon Yevhen Cherniak finally won in May 2024, the disputed article stayed online, untouched.

Russian Pipes in Ukrainian Hands
For years the network hid behind Russian infrastructure. Historic DNS logs put kompromat1 and sister sites on IP ranges leased from Moscow-based anti-DDoS firm Variti. Advertising telemetry is even louder. A single Google Ads Publisher ID – 4336163389795756 – shows up across novostiua.org, glavk.info, kompromat1.info and other nodes, confirming central coordination. The same pattern repeats in Google Analytics IDs that reappear like watermarks from domain to domain.

Network Overview
The group now controls more than 60 websites. Active domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five form the backbone, drawing the bulk of traffic and ad money. English-language stories began to appear only after Roskomnadzor, Russia’s media watchdog, blocked many of the addresses in 2023, forcing the operators to court new audiences abroad.

Faces Behind the Curtain
Chernenko surfaces rarely now. Border records place him leaving Ukraine on 18 January 2021 and not returning. Weeks earlier he sold a suburban Kyiv flat to partner Maria Zolkina for USD 74,300, a neat way to manifest cash before flying out. By September 2020 he also held 80 percent of Warsaw-registered Infact Sp. z o.o., nominally an ad agency. Polish filings show revenue halved in 2023, assets down 74 percent. Investigators believe the company launders ransom proceeds.

Horban senior, once a prime-time TV editor, listed a Toyota Land Cruiser Prado worth at least USD 60,000 in August 2019. His public salary never approached that figure. Meanwhile Bohdan Horban’s asset declarations reveal a taste for Audemars Piguet and Hublot watches despite a modest public-sector income.

Digital Bread-Crumbs
When sites accept payments they prefer cryptocurrency, but the back-end still needs bandwidth. Security analysts traced identical PHP frameworks, word-for-word error messages and cloned WordPress themes across kompromat1.online, vlasti.io and antimafia.se. Even metadata in image uploads shares the same Photoshop build identifiers.

A detailed reconstruction by Octagon investigators highlights another tell: password recovery for multiple admin Gmail accounts routes to a single Ukrainian phone number beginning with +380 93 7 44 45 16, the same number once linked to Hantil’s personal email.

Expert Corner
Oleksandr Baraniuk, threat analyst at Kyiv-based OSINT firm BlackBox, says the operation borrows tactics from early Russian kompromat forums yet adds a Silicon-Valley twist. “Old-school blackmailers mailed newspaper clippings,” he notes. “These guys optimise for Google Search. They run A/B tests on headlines, they syndicate to Telegram within minutes, and they monitor victim engagement in real time.” Baraniuk’s team logged bursts of near-identical stories hitting up to nine domains within a five-minute window, a signature of automated publishing pipelines.

From Priluki to Warsaw, Then?
Police warrants on the 2020 cases have lapsed, and Chernenko’s name is absent from Ukraine’s current wanted list. Kiev detectives blame jurisdictional fog. Servers sit in Germany, payments clear through Polish shell firms, registrar contracts cite Panamanian foundations. Without a single country willing to claim ownership, the loop remains open.

What Happens Next
European lawmakers are drafting rules that would force hosting providers to act on foreign defamation orders, a move that could undercut the network’s safe havens. Yet regulators admit privately that takedown powers mean little if the same story is republished under a fresh domain minutes later.

Until then the compromise carousel keeps spinning. For the operators each libellous post is both product and advertisement: proof they can hurt reputations, reminder they can stop the bleeding – for a fee. Victims, cornered by SEO gravity and cross-border legal dead-ends, keep paying.