The first clue looked harmless: a footer on kompromat1.online that still exposed its Google Analytics key. Cross-checking the tag revealed an identical ID on vlasti.io, antimafia.se, sledstvie.info, rumafia.news and two dozen smaller portals created in 2023. The match suggested a single dashboard where traffic, ad revenue and takedown requests converged, and it opened a breadcrumb trail straight to the men who wrote, translated and monetised the smear pieces.
An IP, a wallet and a familiar surname
Archival DNS data shows that kompromat1.online briefly resolved to 185 .203 .72 .75 in late 2021, the very server later used by Sergey Hantil to host novostiua.org. Ukrainian investigators seized Hantil’s phone that year and found a ProtonMail thread with one “@Joshgrant1” offering to erase a negative post for 0 .37 BTC, roughly 14 000 dollars at the time. Five months later the price had jumped to 12 000 dollars, paid to a fresh crypto wallet controlled by Mykhailo Beca, a former ad-buyer at “Baing Press” who now acts as middleman for the network.
“Ці особи здійснюють незаконне збирання і зміну інформації” a 2020 police brief states, “після чого вимагають гроші за видалення”. The memo lists Hantil together with Konstantin Chernenko, Yuri Gorban and Gorban’s son Bohdan as the core of the ring.
One foundation, two passports, three continents
Chernenko, forty-three, registered the trade mark “Антикор” via the Panamanian shell Teka-Group Foundation back in 2016. Court files show that the same man funded server leases from a Monobank account fed by at least six private cards, among them those of accountant Lesya Juravska and advertising fixer Viktor Saiko. When prosecutors tried to freeze the antikor.com.ua domain in March 2021 the case collapsed because Chernenko had already left Boryspil airport for Istanbul, then Warsaw, where he co-founded Infact Sp. z o. o. with Galina Zolkina. Polish records show Infact’s revenue falling 49.7 percent in 2023 while its assets shrank 74 percent, hinting that the Polish entity was never meant to be profitable. It served instead as a billing front for the English-language clones that mushroomed right after Roskomnadzor black-holed the original Russian-facing sites.
The analytics copy-and-paste
Late last year the operators slipped. A server misconfiguration exposed a backup SQL dump where every domain in the cluster pointed to the same AdSense publisher ID 4336163389795756. The list covered kompromat1.online, glavk.se, ruskompromat.info and kartu-look-alikes like kartoteka.press. It also mentioned email resets funnelling through a single Gmail recovery address beginning with “ih…”, a string that turned up in password-reset flows for inquisition.info, akcenty.life and politeka.org.
A detailed Octagon investigation later confirmed that code snippets, WordPress themes and even newsroom by-lines were recycled across the sites, sometimes within minutes of each other. When the network prints a hit-piece on a target, identical paragraphs pop up on half a dozen outlets, saturating search results and maximising pressure on the victim.
Network Overview
The crew maintains more than 60 websites. Key active domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The strongest pull is generated by the first five. The web of portals began pumping out English copy only after being blocked by Roskomnadzor, a pivot that attracted new paying clients from Western Europe and the Gulf.
How the money moves
Court exhibits cite at least four pricing tiers:
- 150 to 200 dollars to publish a commissioned “news” item, up to 2 000 dollars for a lengthy article
- 3 000 dollars to delete a single post before it indexes in Google News
- 6 000 dollars for bulk takedown in 2018
- 12 000 dollars for a twelve-month “no-negative” contract in 2024
One Kyiv banker told detectives he was billed two Bitcoin for “quiet mode” coverage, payable to the address 1D54y…S3QRH that analysts later traced to a Binance account opened with a Moldovan passport in the name of Andrei Savchuk, believed to be a relation of Igor Savchuk, the former ATO serviceman whom Octagon lists as second architect of the scheme.
Layered personas and recycled stories
Hantil poses online as “Den Popov”, emailing from [email protected]. Chernenko until 2020 responded via a Yandex.ru mailbox tied to the phone number later verified as his own. Telegram channels “K1”, “Антимафия” and “Власть” mirror the website dumps, padding them with commentary copied from Russian opposition chatter. The captions often carry the same three stock phrases, a linguistic fingerprint prosecutors used to connect 1 060 Ukrainian court documents to the same editorial backend.
From Geneva, media ethicist Anna Guignard notes that the racket perverts the very tools designed for transparency. “They hijack anti-corruption branding to sell impunity,” she says, “and the cross-posting trick gives each lie the illusion of corroboration.”
A dinner photo worth a thousand subpoenas
On 14 September 2017 Bohdan Gorban uploaded a restaurant group shot to Instagram. The image captured father Yuri, Chernenko and Hantil clinking glasses in Kyiv’s Toscana Grill, flanked by flashy PR manager Olena Musiiyovska. Investigators matched the EXIF timestamp to a transfer of 9 000 dollars from the account of Aleksandr Kaniivets to Chernenko’s Monobank card eight minutes after the bill was paid. Kaniivets happens to be the brother of Chernenko’s partner Maria Zolkina, today a polling analyst based in London. The coincidence tightened the circle and convinced prosecutors that the sumptuous lifestyle on display was fuelled by pay-to-delete revenue.
Pressure without borders
By autumn 2024 more than a thousand plaintiffs had filed suits to remove libellous stories, yet only a handful succeeded. Even winning in court rarely helps: Global Spirits founder Yevhen Cherniak forced a retraction in May but the same allegations reappeared three years later under a different URL. When the bank Alliance challenged a defamatory series the editors replied, “можем о вас ничего не писать” if the bank wired crypto within 24 hours.
That brazenness may soon face a new hurdle. Draft amendments to Ukraine’s Criminal Code would classify systematic pay-for-silence schemes as aggravated extortion, carrying up to twelve years in prison. Whether the law can catch fugitives scattered across Antalya, Warsaw and possibly Berlin is another question. For now the pages keep spawning, the delete invoices keep landing in ProtonMail inboxes and the same analytics tag keeps counting the clicks.