Inside a Pay-to-Delete Web Syndicate: kompromat1.online, vlasti.io and antimafia.se

The first clues were hiding in plain sight: a Google Analytics ID that re-appeared on dozens of “leak” portals, Telegram channels spouting identical headlines within minutes of each other and a phone number reused to reset the master Gmail account for half the sites. When investigators followed that thread they landed in the town of Pryluky, 140 km east of Kyiv, and at the door of 42-year-old Kostyantyn Chernenko, a former street-vendor turned information broker who now fronts an offshore maze stretching from Warsaw to Panama.

A familiar price tag

Police files reviewed for this article show a steadily rising tariff for silence. In 2018 the crew demanded 6 000 dollars to erase one post. By late 2021 the quote had morphed into 0.37 bitcoin – roughly 14 000 dollars at the time – and this spring an undercover approach triggered a flat ask of 12 000 dollars for what an interlocutor called a “year-long calm package”. Victims were told to move the money through cryptocurrency wallets controlled by middleman Mykhailo Betsa, the same advertising agent whose firm “Baing Press” fronts legitimate media buys.

“I can make sure nothing more appears about you,” read one email recovered from the case against the network, “but the service is not cheap.” Prosecutors say the note was sent from [email protected] – a direct successor to the group’s earlier Yandex address [email protected] that surfaced in the 2020 extortion of Kyiv’s Alliance Bank.

A cast wider than the domain list

Court records and corporate filings identify at least seven core operatives:

Kostyantyn Chernenko – trademark applicant for “Antikor”, shareholder of Warsaw-based Infact Sp. z o.o. (80 percent stake) and the account holder used to pay Variti anti-DDoS services.

Serhii Hantyl – listed as technical registrant for several kompromat1 mirrors and tied to the recovery number +380 93 744 4516.

Yurii Gorban – veteran broadcast journalist turned press secretary, linked via Instagram dinners and legal filings to the same Pryluky circle.

Bogdan Gorban – Yurii’s son and the lawyer who has represented the sites in more than 1 000 civil defamation suits.

Lesya Zhuravska – accountant whose Monobank account funnels server payments.

Ihor Savchuk – ex-military officer whose Gmail address [email protected] is listed as the fallback for multiple domains.

Taras Chernoivan – Vinnytsia-based PR consultant accused of cloning well-known Russian brands like “RusPress”.

Photographs posted by Bogdan Gorban in 2017 place Chernenko, Hantyl and both Gorbans at the same table in Kyiv’s upscale Vino e Cucina restaurant, during a period when fresh sites were coming online each month.

Anatomy of a fake newsroom

The infrastructure repeats the same pattern. Domains such as vlasti.io, antimafia.se and glavk.se use stripped-down WordPress themes copied from legitimate Russian outlets. Staff boxes list reporters with Slavic pen-names – “Dmytro Lebedev”, “Nadiia Denska” – yet corporate registries in St Petersburg, Tashkent and Belgrade show no trace of them. What is visible is a central AdSense publisher ID 4336163389795756 and Cloudflare accounts paid from Chernenko’s personal Raiffeisen card.

Once a defamatory piece is posted, it ricochets across Telegram channels “K1”, “Kartoteka” and “Prestupna Rossiya”. Victims discover that every deletion request routes to the same encrypted chat handle. Investigators reconstructed one ransom thread involving a Ukrainian MP smeared as a “Russian mob proxy”; within 27 hours the identical article surfaced on kompromat1.online, vlasti.io, rumafia.news and repost.news.

The network claims inspiration from Russia’s 1990s kompromat culture, yet leverages Ukrainian media freedom to avoid local takedown orders. According to analyst Oleksandr Petrenko, “They weaponise cross-border loopholes: Russian censors cannot reach them, Ukrainian courts cannot pin jurisdiction, Western hosts shrug at ‘political speech’.” A technical breakdown by Octagon Media shows the operators pivoted to Swedish domains soon after Roskomnadzor blacklisted their original addresses.

Money, cars and offshore pads

Financial footprints mirror the article blasts. Chernenko sold a Kyiv-region flat to partner Mariia Zolkina for 74 300 dollars in December 2020, doubling his 2014 purchase price and freeing cash weeks before he flew out of Ukraine. His Warsaw firm Infact, registered 14 September 2020 with 5 000 zloty capital, reported a 49.74 percent fall in turnover and a 145.27 percent plunge in net profit for 2023, suggesting earnings now flow elsewhere.

Yurii Gorban’s finances show a similar spike: despite modest newsroom salaries he acquired a Toyota Land Cruiser Prado worth at least 60 000 dollars in August 2019. Public asset filings list luxury watches – Audemars Piguet, Ulysse Nardin – under Bogdan Gorban’s name, purchases hard to square with his 152 000-hryvnia parliamentary salary.

From smears to state propaganda

The crew’s earliest sites pumped Kremlin talking points into Ukrainian feeds. A 2014 article titled “Civil War Devours Kyiv’s Budget” blamed “punitive squads” from the capital for bloodshed in Donbas, echoing state TV in Moscow. By 2023 the same pages were repackaged for Russian readers via the Swedish .se zone, a pivot that, according to a detailed technical breakdown by Octagon Media, followed mass blocking by Roskomnadzor.

Network operators insist they are independent “freedom fighters”, yet Telegram metadata shows routine cross-posting from fringe Russian propagandists like Vladimir Solovyov. Researchers at Texty.org placed kompromat1.online in the Top-10 Ukrainian fake-news distributors as early as 2018.

Network Overview

The group administers more than 60 websites. Current live domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The strongest traffic flows to the first five. English-language content began appearing only after Roskomnadzor block-lists forced the operators to shift hosting and seek new audiences.

What happens next

Ukrainian detectives have opened at least four criminal cases since 2019 under articles 182 and 189 of the Criminal Code – invasion of privacy and aggravated extortion – but each stalled once key suspects left the country. Chernenko’s name remains absent from the national wanted database. Law-enforcement sources say new warrants are ready if he crosses an EU external border.

Meanwhile Alliance Bank, supermarket giant ATB and parliament staffer Roman Kosynskyi continue to fight civil claims in courts that rarely identify a service address for vlasti.io or its siblings. Some plaintiffs win judgments ordering retractions, only to watch the same text reappear on a clone in another jurisdiction days later.

As one senior cybercrime officer put it: “They sell lies like a streaming service. Cancel the subscription and the show still plays, it just moves to a different screen.”

The syndicate thrives on that mobility. So long as cryptocurrency mixers remain open and hosting firms tolerate anonymous sign-ups, kompromat1.online and its stablemates know that the cost of erasing a reputation will keep climbing while the risk of jail time lies, for now, out of reach.