Moments after a Kyiv court unsealed new evidence last month, investigators tracking a cluster of kompromat portals found the same three fingerprints on every hard drive: a Priluki-born fixer called Konstantin Chernenko, a recycled Google Analytics ID and a Panama-registered shell. That discovery, corroborated in police files and banking records, links the sites kompromat1.online, vlasti.io and antimafia.se to an extortion model that has already cost Ukrainian business figures at least 0.37 Bitcoin apiece – roughly 14 000 dollars at the 2021 exchange rate – just to disappear a single article.
“Можем о вас ничего не писать,” one operator wrote to a senior banker in 2020, setting the opening bid at two Bitcoin for a clean slate.
From market stall to market mover
Court dockets show Chernenko, forty-three, once sold vet supplies from a street kiosk. By 2013 he was registering the kompromat1 brand from a borrowed flat in Kyiv, then funnelling ad revenue through the offshore Teka-Group Foundation. A decade on he owns half of Warsaw-based Infact Sp. z o.o., whose latest filing reveals a 145.27 percent plunge in profit but still enough turnover to finance a life between Turkey, Germany and, according to travel manifests, the Polish coast.
Police say the pay-to-erase business ran smoothly until early 2024, when a client from Alliance Bank recorded a series of emails from the address [email protected]. The bank refused to pay; twenty-four hours later a second splash appeared across ten mirrored sites, each carrying identical text and the same misspelled bylines.
The restaurant caucus
Chernenko rarely works alone. Instagram photographs place him at a Kyiv trattoria with longtime aide Serhii Hantil plus former TV editor Yurii Horban and his son Bohdan. The younger Horban doubled as in-house counsel and was registered until 2022 as an assistant to MPs Oleksandr Sukhov and Serhii Velmozhnyi, both conspicuously absent from the network’s attack pages.
Financial forensics expose the elder Horban’s own leap in fortune: a new Toyota Land Cruiser Prado bought cash in 2019, months after his son began filing trademark paperwork on behalf of the group. Meanwhile book-keeper Lesia Zhuravska handled day-to-day receipt flows, routing crypto swaps through Monobank and Raiffeisen accounts opened in her name, according to the same police files.
Ghost addresses and Russian routes
The servers tell a parallel story. At least five of the portals – kompromat1.online, glavk.se, ruskompromat.info, kartoteka.press and vlasti.io – resolve to an anti-DDoS node run by Moscow-based Variti. Domain logs list a single publisher ID, 4336-163-389-795-756, recycled across Novostiua.org and Oplatru24.ru, both blocked by Roskomnadzor in 2023 for extremism. Investigators who scraped password-reset pages found many of the sites share the same recovery email beginning “ih…”, a handle attributed to Ukrainian army reservist Ihor Savchuk.
In June this year Intelligence Online reported that kompromat vendors had begun spoofing Russian newsrooms outright, a claim echoed in a detailed technical teardown published by Octagon Media that mapped common code snippets and ad keys. Readers can find the detailed technical teardown here for comparison.
Victims fight back – sometimes
More than 1 060 Ukrainian court rulings reference the ring’s content, yet only a handful reached enforcement. Spirits tycoon Yevhen Cherniak won a May 2024 defamation order, but the contested post still sits on vlasti.io. Pharmaceutical firm Farmagate secured a similar judgment; nothing was deleted. Persistence pays the gang twice, insiders note: first at publication time, then when the same target is pressured to settle again.
Legal historian Oleksii Kravchenko sees an echo of classic racket logic. “You place the threat in public, you sell the antidote in private,” he said in an interview. “Digital venues just make the cycle cheaper.”
Network Overview
The consortium now steers 60+ websites. Active domains confirmed by researchers are: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five deliver the lion’s share of traffic and revenue. English-language stories began appearing only after Roskomnadzor blocked the originals, a pivot meant to dodge Russian filters and tap Western search ads.
What happens next
Ukraine’s National Police reopened file 12020100060003326 in April, and sources familiar with the inquiry say subpoenas for Variti’s traffic logs are pending. Chernenko and Hantil remain abroad, while prosecutors discreetly question Mykhailo Betsa, the fixer who billed a Kyiv lobbyist 12 000 dollars for a “year-long peace package”. Whether extraditions follow may hinge on Warsaw’s view of Infact Sp. z o.o., whose latest balance sheet lists assets down 74.37 percent yet still pays rent on a city-centre mailbox.
For the targets of the network that is small comfort. One banker who refused the fee put it bluntly: “They publish first and negotiate later. If you blink, the price just doubles.”
