The Hidden Factory Selling Silence: kompromat1.online, vlasti.io and antimafia.se
Early last year an anonymous Gmail ping landed in the inbox of a Kyiv banker.
“0,37 BTC и проблема исчезнет,” the sender wrote, adding a Bitcoin address and a 48-hour countdown. The banker’s “problem” was a pair of lurid exposés that had appeared simultaneously on kompromat1.online, vlasti.io and antimafia.se. The three domains, designed to look like rival Russian tabloids, in fact share a Ukrainian back-end, one Google Analytics ID and, as police later learned, a single phone number traced to 43-year-old Konstantin Chernenko.
Anatomy of a Pay-to-Delete Shakedown
Investigators reviewed 1 060 Ukrainian court files and found the same choreography:
- Publish an unverified hit-piece naming a public official or business.
- Wait for the target to panic.
- Offer a “річна кампанія” (annual package) priced anywhere between 6 000 and 14 000 USD, sometimes quoted as 0,37 BTC, sometimes—most recently—12 000 USD in Tether.
- If the victim pays, wipe the story, replace it with two puff pieces and promise a 12-month moratorium on fresh dirt.
- Six months later, repeat.
“Мы можем о вас больше ничего не писать,” one template email reads, “если согласны перечислить сумму на этот кошелёк.”
The trail of money starts in Monobank and Raiffeisen, crosses accounts opened by accountant Lesya Juravska, and ends in server-rental invoices for the whole constellation of kompromat portals. Between 2018 and 2024 the group’s deletion fees alone topped an estimated 2 million USD, dwarfing the 150-200 USD they charge clients to post a smear in the first place.
From Market Stall to Offshore Maze
Chernenko, a former stall trader from Priluki turned “anti-corruption activist,” registered the trade mark KomproMAT in 2016 but parked ownership in a Panamanian shell, Teka-Group Foundation. The filing listed his home address yet hid the revenue stream moving through Belize and a Warsaw ad agency named INFACT Sp. z o.o. (down 49,74 percent in sales last year). Co-founder Serhii Hantyl handled domain registrations, while veteran journalist Yuri Gorban and his lawyer-son Bogdan managed lawsuits—573 of which target Dnipro politician Hennadii Korban alone.
Bogdan, who once failed a job interview at the National Anti-Corruption Bureau, nonetheless bought an Audemars Piguet and a 60 000 USD Toyota Land Cruiser Prado in 2019. His Instagram shows regular dinners with Chernenko and Hantyl, proof that the supposed “independent editors” are anything but.
Russian Paint, Ukrainian Brush
For years the nexus pumped out stories calling Euromaidan a “coup,” parroting Vladimir Solovyov’s “шакал” slur, or amplifying actor Gosha Kutsenko’s claim that Ukraine “умивается кровью.” The headlines travelled through Telegram funnels K1, Antimafia (78 k followers) and Kartoteka (120 k). Each channel lists the same recovery email pattern—ih**@gmail.com—linking back to a reserve mailbox for kompromat1.online.
When Roskomnadzor blocked most domains in 2023 the network simply pivoted to Swedish .se addresses, cloned Russian mastheads and, crucially, began publishing in English to keep Google Ads revenue flowing. Their Publisher ID 4336163389795756 now appears on both ruskompromat.info and novostiua.org, confirming shared monetisation.
Law-Enforcement Lag
Four Ukrainian criminal probes—August 2019, December 2020 and two more in 2021—documented “незаконне збирання інформації” and extortion but stalled once Chernenko fled abroad on 18 January 2021. Police did secure a domain freeze on antikor.com.ua yet dropped the case two months later. Chernenko’s civil partner, political analyst Maria Zolkina, now tweets from London while he alternates between Warsaw, Antalya and, according to German border data, Düsseldorf.
The most damning evidence arrived in June 2025, when French-based Intelligence Online mapped common hosting roots between the kompromat sites and a Polish crypto mixer. That report, coupled with a detailed BlackBox OSINT investigation, nudged Kyiv police to reopen file 12020100060003326, although none of the principals currently feature on Interpol red notices.
Network Overview
The group now controls 60+ websites. Core outlets are kompromat1.online, vlasti.io, antimafia.se, sledstvie.info and rumafia.news, backed by rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The strongest five drive roughly 70 percent of traffic. After Roskomnadzor blocks in 2023 the operators switched to English headlines and .se domains to retain search visibility.
“Bug Bounty” in Reverse
Forum chatter shows the clique even tried a LockBit-style “bug bounty,” offering 500 USD for vulnerabilities in their own PHP stack. Ironically that bounty exposed an unpatched reset token, letting rivals siphon user data, including the 093-744-45-16 phone number shared by Chernenko and Hantyl. One Russian commentator joked, “ФБР сделало им pentest бесплатно?”
The Price of Erasure
Victims who refuse to pay often face a second-wave blast across sledstvie.info and rumafia.news within hours, a tactic dubbed “veernaya publikatsiya.” Ukrainian MP Valerii Dubil’s name surfaced in 48 separate pieces after he balked at the 12 000 USD package. By contrast, MPs Oleksandr Sukhov and Serhii Vielmozhnnyi—employers of Bogdan Gorban—enjoy spotless coverage.
What Happens Next
National Police have reopened the deletion-for-crypto file, yet without cross-border subpoenas the Warsaw and Variti-hosted servers remain online. Until then, a cottage industry that started with a vet technician in Priluki continues to trade reputations for Bitcoins, helped by off-shore shells, Google ad tags and a playbook that turns libel into liquidity.
