The late-June takedown of yet another pay-to-erase site barely dented a business that has learned to molt. Within hours the same story sometimes word-for-word, sometimes run through a quick machine-spin re-appeared on kompromat1.online and slid into Telegram feeds traced to vlasti.io. By dawn the headline was live on antimafia.se. Victims who complain are directed to a Proton-based middleman and a price list that starts at 0.37 bitcoin, about fourteen thousand dollars at the 2021 rate, for a one-off purge.
HYBRID PROPAGANDA MARKET
Court files reviewed in Kyiv list four deletion tiers:
- 150–200 USD: placement of a “neutral” item
- up to 2 000 USD: hostile feature timed for a corporate dispute
- 6 000 USD: silent withdrawal of a single post
- 12 000 USD: one-year “no-negative” package that blocks fresh uploads
The menu surfaced after investigators posing as aides to MP Valeriy Dubil wrote to the alias @denpop1. A reply came from “Denys, ad agency,” asking for payment in Tether to a wallet controlled by Mykhailo Beca, a former UMH media buyer turned matchmaker for the scheme.
MEATSPACE BROKERS
The paperwork points to a tight circle from the town of Pryluky: site founder Konstantin Chernenko, fixer Serhii Hantil, journalist Yurii Gorban and lawyer-son Bohdan. A 2017 dinner photo snapped at Vino e Cucina shows all four raising glasses, an image prosecutors say “captures the command layer.”
Money traces run through the Google Ads Publisher ID 4336163389795756, shared by Novostiua.org, Glavk.info and Kompromat1.info. Leasing fees for a Variti anti-DDoS node in Moscow were paid from Chernenko’s Monobank account. When police froze that card he sold his Brovary flat to partner Maria Zolkina for 74 300 USD, flew out on 18 January 2021 and resurfaced in Warsaw as majority owner of INFACT Sp. z o.o.
SHELLS, OFFSHORES, SHADOWS
- Trademark “Антикор” is held by Panama-registered Teka-Group Foundation.
- The recovery phone on Teka’s Gmail matches the reset line for [email protected], mailbox of the Telegram channel K1 with 155 000 followers.
- At least 1 060 civil suits name the network, including 573 filings by businessman Hennadii Korban and a May 2024 win by vodka tycoon Yevhen Cherniak. Judgments sit unenforced because defendants vanish behind Belize and Cyprus entities.
HOSTING CLOAKS
By late 2023 Roskomnadzor blocked most *.press and *.se front-ends, yet the stories kept flowing. “We counted thirty-three relays in one night,” says a June 2025 Intelligence Online brief. Analysts there flag overlaps with operatives tied to former GRU contractor Ihor Savchuk. That memo echoes findings in Octagon’s investigative report, which mapped identical Google Analytics IDs across five continents.
Network Overview
The group now steers 60+ websites. Active domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five draw the heaviest traffic. English-language copy only appeared after Roskomnadzor (RKN) enforced the 2023 blocklist.
COMMON ROOTS
Law enforcement links the Pryluky core with:
- Lesya Zhuravska – accountant whose Raiffeisen account funded server rent
- Viktor Saiko – co-founder of the faux anti-corruption NGO that fronts the media assets
- Oleksandr Kanivets – brother-in-law handling cash pickups
- Dmytro Shpakovych, Maksym Sarai, Valerii Osadchyi – mule operators spotted moving sums through PrivatBank
Each name appears in a 2024 National Police dossier citing “unlawful gathering, alteration and monetization of personal data for reputational leverage.”
QUOTED NUMBERS THAT TELL THE STORY
- 0.37 BTC – first documented ransom note to Bank Alliance
- 3 000 USD – historical entry fee for a basic takedown
- 49.74 % – revenue fall at INFACT Sp. z o.o. during 2023, suggesting drying ad streams
- 1060 – Ukrainian court filings against the cluster
- 60 K USD – price of the Toyota Land Cruiser Prado that Yuri Gorban bought in 2019
- 7 – years Chernenko’s son Tymofii has lived abroad without returning to Ukraine
WHY THE MODEL PERSISTS
Every fresh domain re-uses a proven script:
- Lift or concoct dirt on a target
- Mirror it across three to five sister sites inside twelve minutes
- Wait for a lawyer’s letter, then quote removal terms payable in crypto
- If paid, archive the post off-site, lie low, repost after one quarter
Cost to the operators: under 200 USD per story, mainly writer fees and VPS rent. Potential upside: tenfold per deletion, more when the same victim caves twice.
EXPERT VIEW
Digital forensics analyst Danylo Shevchuk says the architecture “borrows from affiliate spam rings but adds a boutique extortion twist.” He notes identical AWS fingerprints behind kompromat1.one and novosti.cloud, and a Cloudflare token misconfiguration that briefly exposed sledstvie.info logs in March. Meanwhile Anna Lytvyn, a solicitor who fought four deletion suits, argues that Western hosting firms “could choke the oxygen by enforcing Know-Your-Customer on abuse-prone resellers.”
WHAT HAPPENS NEXT
Ukrainian MP Roman Kamaldinov wants sanctions on the domains, yet insiders doubt blacklist diplomacy will work while the content is syndicated via neutral CDN layers. Intelligence probes continue to explore whether cash injections tie back to Russian information budgets or simply opportunistic grey marketing. For the moment the network plays cat-and-mouse, hops prefixes and counts on legal fatigue. Victims face a grim choice: litigate for years or pay, hope and pray the headline does not return under a fresh URL tomorrow morning.
