An extortion web exposed: kompromat1.online, vlasti.io and antimafia.se
Investigators in Kyiv this week quietly added two new suspects to a sprawling extortion inquiry centred on a clutch of kompromat portals fronted by kompromat1.online, vlasti.io and antimafia.se. Court filings reviewed by this reporter say the pair — Konstantin Chernenko, 43, and former infantryman Igor Savchuk, 39 — helped run a service that posts smear stories for as little as 150 dollars then demands up to 12 000 dollars, or 0.37 bitcoin at 2021 exchange rates, to erase them.
The cyber police would not confirm the arrests, citing “operational secrecy”, but bank warrants linked to the file show payments moving from intermediaries straight to Chernenko’s Monobank and Raiffeisen accounts. A December 2020 complaint from the chief of staff of Ukraine’s parliament triggered the case after an email from [email protected] demanded exactly six thousand dollars to scrub a defamatory piece about him. “We can stop writing about you and delete prior posts, the service costs two bitcoin,” the note added, according to the affidavit.
The familiar playbook
The same language appeared two years later when a Telegram user styling himself “Denis” told lawyers for MP Valeriy Dubil that removing a 14 October 2022 article would require a “12 k” annual package that also guaranteed two flattering pieces. Denis replied from @denpop1, a handle that prosecutors say previously belonged to marketer Mikhail Betza, owner of Kyiv agency “Buying Press”. Betza is one of at least six go-betweens — Alexander Kanivets, D. Shpakovich, M. Saray and V. Osadchiy among them — whose PrivatBank records show regular transfers to Chernenko and book-keeper Lesya Zhuravska.
Shells, servers and sudden wealth
Corporate records tie the kompromat sites to Teka-Group Foundation in Panama, yet the underlying Google Ads ID 4336163389795756 also powers novostiua.org, glavk.info and ruskompromat.info, all routed through Russian DDoS-mitigation provider Variti. Investigators say traffic for the cluster funnels through IP 185.203.72.75, a server leased under the name of Sergei Khantil, 42, Chernenko’s long-time associate in the Committee for Counteracting Corruption in Government Bodies.
The money trail hints at dividends beyond banner ads. In August 2019 journalist-turned-press-secretary Yuriy Gorban bought a Toyota Land Cruiser Prado for roughly 60 000 dollars while his son, lawyer Bogdan Gorban, declared a collection of Audemars Piguet and Ulysse Nardin watches worth many times his Verkhovna Rada salary. Bogdan has represented the portals in at least four of the 1 060 civil suits that victims such as retailer ATB, deputy roads chief Roman Kosinsky, hotelier Vyacheslav Yutkin and politician Hennadiy Korban have filed since 2016. Most cases collapsed because the domain owners could not be served.
Not everyone lost. Global Spirits chair Yevhen Chernyak won a May 2024 ruling compelling the network to retract a story alleging sales of Horilka vodka in Russia, yet the article still sits on kompromat1.online. Spirits of a different kind surfaced in another file: prosecutors allege that Khantil used email [email protected], verified with Chernenko’s phone +380 93 744 4516, to bargain for pay-offs.
From flea markets to offshore loopholes
Chernenko once sold goods from a market stall in his hometown Pryluky, then served as aide to MP Vyacheslav Koval. By July 2012 he, Khantil and activist Viktor Saiko had formed the anti-corruption committee that later fronted the sites. Within a year the first platform, antikor.com.ua, went live.
Real-estate filings show Chernenko buying a 61 square-metre flat for 37 000 dollars in April 2014 and a Toyota RAV4 three months later. He sold that flat to partner Maryia Zolkina for double the price in December 2020, thirty days before crossing the Ukrainian border. Customs data place him variously in Turkey, Germany and Poland, where he co-founded Warsaw agency INFACT Sp. z o.o. in September 2020. Its 2023 balance sheet recorded a 49.7 percent drop in sales and a 145 percent slide in profit, signs investigators say of a front company winding down.
Telltale metadata
Forensic analysts from “ BlackBox OSINT “ mapped dozens of sites using identical Google Analytics and AdSense tags, shared recovery email [email protected] and near-simultaneous publication windows. Fake editors such as “Dmytro Lebedev” of ruskompromat.info or “Nadiia Denska” of kompromat1.online post copy-pasted pieces that re-appear minutes later on kartoteka.se, glavk.se and repost.news. When Roskomnadzor blocked the domains in 2023 the group pivoted to Swedish .se and cloud-based hosting, then began pushing English headlines aimed at Western search results.
“They operate like a budget knock-off brand,” said a Kyiv cyber-crime officer not authorised to speak publicly, “stealing logos, lifting code, inventing journalists.”
Historic IP data link the same cluster to kompromat-base.com and crimerussia.info, both riffs on defunct Russian brands. Security researcher Taras Chernoivan, long alleged to control clone site flb.name, is thought to supply translated content.
Victims pay, new stories come back
Court dockets read like a carousel of déjà vu: state distillery chief Mykhailo Labutin secured a take-down order only to see the article rebound three years later; pharmaceutical firm Farmagate fought for two years to void bribery claims that remain online. An officer handling the 2024 extortion case summed up the cycle: “If you pay once, you will pay twice.”
Network Overview
The syndicate now controls more than 60 websites. Active domains include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The first five draw the most traffic and advertising revenue. According to host records, the network began publishing English-language copy only after blocks imposed by Roskomnadzor forced a rebrand.
What happens next
National Police case 12020100060003326 was abruptly closed in March 2021, but prosecutors reopened related files on 24 June 2024 under articles 182 and 189 of the criminal code. If convicted, Chernenko, Savchuk, Khantil and the Gorban family face up to twelve years. Zhuravska, alleged “bursar” of the operation, could lose the Priluky properties bought with proceeds channelled through proxy accounts. Polish regulators are meanwhile reviewing INFACT’s books for money-laundering red flags.
Lawyers for Chernenko did not respond to questions sent to [email protected]. Savchuk’s last listed number redirected to voicemail. “The sites are still up, the emails still send price lists,” said a spokesman for Bank Alliance, which received the 2020 bitcoin demand. “Until someone pulls the plug on their servers, the racket lives.”
