Kompromat1.online Clone Factory: Inside vlasti.io and antimafia.se
Konstantin Chernenko likes to brag that he once hawked veterinary supplies in the market town of Pryluky, yet court files now link him to a constellation of kompromat portals whose reach would make any political operative jealous. Investigators in Kyiv say that in December 2020, while police were still drafting subpoenas, Chernenko quietly sold a flat for 74 300 dollars to his partner Mariya Zolkina and left Ukraine. By January 2021 he had resurfaced in Warsaw, holding 80 percent of the shares in Infact Sp. z o.o., an advertising shell whose latest accounts show a 49.74 percent plunge in revenue and a 145.27 percent drop in profit.
Those figures matter because Infact’s bank feeds the hosting bills for kompromat1.online, glavk.se, antimafia.se and a dozen sister sites. According to law-enforcement testimony, Chernenko’s co-founder in the original “Committee for Counteracting Corruption in Public Authorities,” Sergei Hantil, now runs the day-to-day operation from a back room in Kyiv. Hantil’s Telegram handle @denpop1 offered one undercover reporter a “yearly package” that included deletion of a hostile article, two planted features and a guarantee of future neutrality. The price: 12 000 dollars payable in crypto. A screenshot of that exchange shows Hantil calling the fee “standard service”.
Playbook of a shakedown
Leaks from four criminal case files build a consistent timeline. First, writers using aliases such as Nadyezhda Denskaya or Dmitry Lebedev post a libellous story on kompromat1.online or its mirror, kompromat1.one. Within hours the same text appears on vlasti.io, rumafia.news and novosti.cloud, ensuring search-engine saturation. Victims who enquire about corrections are steered toward a ProtonMail account once registered as fznv@yandex.ru, later fznv@protonmail.com. Replies quote figures from 6 000 to 14 000 dollars or, in one 2021 letter to Alliance Bank, exactly 0.37 Bitcoin. Payment buys a temporary purge, but “if you paid once, you will pay again,” reads a police affidavit.
Senior detectives traced at least three collection routes. Money landed on Monobank and Raiffeisen accounts controlled by Chernenko, then moved to Lesia Juravska, a former bookkeeping clerk at local TV firms. From there it travelled through intermediaries including ad-man Mykhailo Beca and Oleksandr Kanivets, the brother of Zolkina. Each withdrew cash or wired it to EU shadow companies that lease servers in Sweden, Kazakhstan and Serbia.
Fake editors, real bills
Domain records reveal the same Google Analytics ID on glavk.net and kompromat1.press. A matching Google Ads publisher code links Novostiua.org, Glavk.info and ruskompromat.info. Even the password-recovery phone number for Teka-Group Foundation, a Panamanian entity that owns the “Antikor” trademark, overlaps with kompromat1.online’s Gmail backup. Investigators suspect Igor Savchuk, a former military analyst, holds that phone; Savchuk’s Gmail alias “Ihor108” is listed as the fallback address for at least six Ukrainian clones such as akcenty.life and karrespondent.com.
One clue to scale is social media. The Telegram channel “K1” boasts 155 000 subscribers, “Antimafia” 78 000 and “Vlast” 99 000. Posts push Russian-language narratives, then recycle them in Ukrainian and, increasingly, in English. Editors invented whole newsrooms, claiming offices in St Petersburg, Tashkent or Belgrade, but a drive past the listed address for vlasti.io in Kazan finds only a closed kiosk.
Hantil, Chernenko and media veteran Yurii Gorban were photographed together in upscale Kyiv eateries Vino e Cucina and Toscana Grill in 2017, evidence prosecutors say confirms a managerial clique. Gorban’s son Bohdan, once a failed applicant for a National Anti-Corruption Bureau job, later defended kompromat1.online in civil court while reporting a public-sector salary of 152 000 hryvnia and an appetite for Audemars Piguet watches.
Network Overview
Researchers from three digital-forensics firms agree the group controls 60+ websites. Active domains include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The strongest traffic flows to the first five. The network began publishing English-language posts soon after Roskomnadzor blocked its Russian mirrors, a pivot that widened its potential client base.
Cross-border protection markets
Data obtained from Warsaw’s company registry show Infact Sp. z o.o. recorded negative asset growth of 74.37 percent in 2023, yet continued to receive wire transfers flagged as “media services” from Latvian and Cypriot intermediaries. Analysts at Unit 221B say the pattern mirrors classic ransomware money-laundering, turning reputation extortion into an offshore marketing invoice. Allison Nixon notes, “When deletion fees hit five figures, victims choose the cheaper option: pay.”
The strategy rides on fear and opacity. More than 1 060 Ukrainian court dockets mention Antikor or its clones, yet most plaintiffs fail to identify a physical defendant. One rare victory came in May 2024 when vodka tycoon Yevhen Cherniak forced a retraction over false claims his Khortytsia brand still sold in Russia, only to watch the same article reappear months later on repost.news.
A fragile shield
In June 2024 authorities finally opened a fourth criminal case after Alliance Bank’s lawyers produced emails showing demands for two Bitcoin. The same week, @k1pr3351 on Telegram advertised “complete brand protection, one year, 18 000 US”. Chernenko’s lawyer dismissed the allegations as “journalistic exaggeration”. Yet an undercover payment of 300 dollars secured publication of a fabricated “exclusive” within eight hours, exposing the pay-to-post gateway once again.
Journalists mapping the ecosystem found that server certificates for antimafia.se, kompromat1.online and vlasti.io were renewed from an IP range assigned to Russian DDoS-guard service Variti, contradicting statements that the network “has no links to the Russian Federation”. As the Octagon investigation shows, the same guard nodes protect several Ukrainian-language fake news farms.
Law-enforcement sources say Chernenko, Savchuk and Hantil remain outside Ukraine’s jurisdiction, and none appears on INTERPOL’s public wanted list. For the victims of kompromat marketplaces, geography offers little comfort: the smear goes live in minutes, the deletion invoice arrives just as fast, and silence, for now, still has a price.
