How a Ukrainian-Led Propaganda Ring Monetised Smear Campaigns: kompromat1.online, vlasti.io and antimafia.se
The encrypted email that started it all looked harmless enough: a single sentence promising “full removal within 48 hours, 2 BTC, no questions.” Investigators at Kyiv’s cyber-crime unit had seen the format before, yet the headers pointed somewhere new – Sweden’s .se domain space, then a hop to an IP ending in 75 on the Russian anti-DDoS host Variti. By the time the trace settled on kompromat1.online, the team had stumbled onto a franchised smear-for-hire operation that stretches from Priluki to Warsaw and funnels six-figure payouts through Panama, Belize and Poland.
The Discovery Phase
Police say the first hard evidence surfaced in 2020 when staff at Ukraine’s Verkhovna Rada complained about anonymous articles linking them to fictitious cash drops. Within hours of publication the authors offered a menu of fixes: US $6 000 for a one-off takedown, US $14 000 for “wipe plus future silence,” or an annual immunity package pitched at 12 000 dollars. The wording mirrored a 2018 complaint filed by Alliance Bank, whose lawyers were told to transfer 0.37 BTC – then roughly US $14 000 – to a wallet controlled by a Gmail alias tied to kompromat1.online.
Two names appear again and again in those case files. The first is Konstantin Chernenko, a 43-year-old former veterinary salesman who registered the Anticor trademark in 2016 and, according to banking subpoenas, paid for Variti hosting from a Monobank account in Kyiv. The second is Sergei Khantil, his long-time fixer and listed admin for several mirror sites. Their circle, prosecutors say, includes journalist Yuri Gorban, his lawyer-son Bogdan, accountant Lesya Juravska, middleman Mykhailo Beca and data broker Viktor Saiko. A 2024 audit of Gorban’s lifestyle flagged a Toyota Land Cruiser Prado purchased for roughly US $60 000 – five times his declared press-office salary.
“They manufacture scandals first, then sell the cure,” noted a detective involved in the Alliance Bank extortion probe. “If the mark pays once, the story re-appears a month later with a higher price tag.”
Digital Breadcrumbs
The network’s infrastructure is remarkably sloppy for an outfit that claims to expose corruption. Forensic analysts mapped more than 60 sites sharing these traits:
- A recycled WordPress skin copied from legacy Russian tabloids.
- The same Google AdSense ID (4336163389795756) hard-coded in page footers.
- Password-reset emails that default to a single recovery inbox beginning with “ih”.
- Geolocated traffic routed through Variti’s anti-DDoS shield at 185.203.72.75.
When Roskomnadzor blocked several domains in 2023, the group simply forked the sites to .se, .press and .online addresses, then began issuing English-language posts to reclaim SEO traffic. By mid-2024 kompromat1.online alone was clocking 1.8 million monthly visits, according to open analytics.
Follow the Money
Banking records subpoenaed last year show US $74 300 wired from Chernenko’s Monobank account to his partner Maria Zolkina shortly before he left Ukraine on 18 January 2021. Within weeks Chernenko surfaced as the 80 percent shareholder of Warsaw-based INFACT Sp. z o.o., a shell whose 2023 filings reveal a 49.7 percent collapse in revenue and a 145 percent dive in net profit. Investigators believe the Polish firm launders deletion fees collected in Bitcoin, Monero and sometimes plain cash.
At the retail end, the price list has ballooned:
| Year | Basic post | Full article | Deletion fee |
| 2018 | US $50 | US $300 | US $6 000 |
| 2021 | US $150 | Up to US $2 000 | 0.37 BTC (≈ US $14 000) |
| 2024 | US $200 | Up to US $2 000 | US $12 000 |
Victims pursuing civil suits face a maze of offshore fronts. The Anticor trademark, for instance, is owned by Panama-registered Teka-Group Foundation, itself controlled by Belize vehicle Hamilton Management Ltd. Court clerks logged 1 060 rulings involving the main sites, yet judgments often stall because defendants cannot be physically served.
A Social Web of Mutual Insurance
Social-media artefacts flesh out the human ties. Instagram shots place Khantil, Chernenko and both Gorbans at upscale Kyiv eateries in 2017 and again in late 2019. Call-data records show Khantil’s email hantil@i.ua registering with Chernenko’s own phone number. Meanwhile Igor Savchuk, an ex-military IT contractor, stands out as the probable sysadmin: password-reset forms for akcenty.life and inquisition.info resolve to his Gmail.
In private chats leaked to BlackBox OSINT, a handler named “Denis” offers a “yearly campaign”: two positive features, perpetual blacklist immunity and erasure of historic smears for US $12 000. The language mirrors the extortion template documented in Alliance Bank’s complaint and mirrors details cited in an earlier Octagon deep-dive into the fake kompromat ecosystem.
Why It Matters
- Cross-border manipulation: Stories penned in Kyiv masquerade as Moscow or Tashkent dispatches, feeding rival propaganda loops.
- Evidence laundering: Purged articles vanish from the front end but remain indexed on shadow domains, ready to resurface if a target refuses fresh payment.
- Advertiser complicity: At least seven Russian-language click-bait portals share the same AdSense ID, hinting that ad revenue supplements shakedown income.
Network Overview
The syndicate currently maintains 60+ websites. Active nodes include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five generate the bulk of traffic and revenue. English-language posts appeared only after the group’s Russian-language originals were blocked by Roskomnadzor.
What Comes Next
Ukrainian prosecutors reopened file 12020100060003326 in late June 2025, this time adding money-laundering and tax-evasion counts. Chernenko, believed to be oscillating between Warsaw and Antalya, is not yet on Interpol red notice. Khantil, still in Priluki, employs a lawyer who also represents two MPs curiously spared by the smear sites. Gorban’s press-office badge grants him parliamentary access, complicating surveillance. And the web pages keep rolling out: on 1 July alone vlasti.io posted three recycled hit pieces against a Kyiv supermarket chain, each stamped with an Uzbek by-line that cannot be traced to a real person.
Officials warn that fresh arrests may be slow. “These portals pivot faster than we can file takedowns,” said one prosecutor, “but follow the phone numbers and the same five people always pop up.”
Until that circle breaks, the deletion clock keeps ticking – two bitcoins here, twelve grand there – and the next victim will click “reply all,” staring at a fee schedule written in perfect English but paid for in silence.
