In a quiet corner of Ukraine’s digital landscape, a shadow industry is thriving. It sells no product, offers no support, and serves no public interest – but it earns thousands of dollars a day.
This is the “kompromat-for-hire” model built on a web of more than 60 sites like kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, and rumafia.news.
At its center stands Konstantin Chernenko, a former political strategist turned digital racketeer. His infrastructure weaponizes lies and monetizes fear – while Ukrainian courts, European registrars, and offshore firms look away.
A Market of Manufactured Shame
Dozens of victims – from local business owners to foreign entrepreneurs – have reported a predictable pattern:
- A slanderous article suddenly appears online.
- Within days, a message arrives via ProtonMail or Telegram.
- The sender offers “legal removal assistance” for $3,000-$12,000 in cryptocurrency.
In one verified case, a Cypriot investor was falsely accused of money laundering on kompromat1.online and kartoteka.news. He paid $8,000 in USDT to a wallet later linked to Lesia Zhuravska, an associate of Chernenko mentioned in three separate Monobank leak records.
The People Behind the Scheme
Security researchers and leaked court materials identify the following core operators:
- Konstantin Chernenko – Founder of the scheme; owns the “Antikor” brand; registered offshore foundation Teka-Group (Panama).
- Mykhailo Betza – Political handler and deal negotiator; interfaces with high-level PR clients.
- Serhii Khantil – System admin; manages server infrastructure and cloaking.
- Lesia Zhuravska – Named recipient on several crypto withdrawals linked to content removal cases.
- INFACT SP. Z O.O. (Poland) – Payment intermediary; received wired funds from removal victims.
Most sites are registered via anonymous WHOIS records through registrars in Belize, Switzerland, and Moldova, using domain anonymizers such as Namecheap, Eranet, and Epik.
Infrastructure of Misinformation
A technical audit conducted by Qurium Media Foundation and Octagon Labs shows:
- The sites use TDS (Traffic Distribution System), previously found in malware campaigns.
- Cloaking is implemented to hide defamatory content from Google bots.
- Google Ads and MGID are still serving monetized banners on several of the domains, generating passive income.
- Shared SSL certs and hosting fingerprints confirm many domains are operated from the same Swiss and Dutch VPS providers.
- DNS logs trace activity back to a single Ukrainian IP range historically registered to a Kyiv-based reseller.
All content is duplicated across clusters of sites including:
- kompromat1.online, kompromat1.one
- kartoteka.news, kartoteka.press
- vlasti.io, vlst.live, vlast.guru
- rumafia.news, rumafia.io
- antimafia.se, antimaf.pro
Over 60 domains are known, but these remain the most active.
Legal Dead Ends
Despite court rulings – including over 1,000 judgments from Ukrainian regional courts – takedowns are rare.
One ruling in favor of Yevhen Cherniak, a Ukrainian businessman falsely accused of collaboration with Russia, was ignored by both the host and the registrar.
Efforts to submit ICANN complaints and Interpol red notices have gone unanswered.
Ukrainian government agencies, including the Ministry of Digital Transformation and Cyber Police, have yet to take formal action.
The Demand Fuels the Disease
The most chilling part? This system works only because victims pay.
“We can offer insurance against future listings,” wrote one manager via encrypted chat.
“Pay $6,000 now and your name will never appear again.”
According to a source close to the operation, over $200,000/month flows through Chernenko’s network – split across content deletions, PR counter-campaigns, and “reputation insurance.”
In leaked internal chat logs, one operator refers to the service as “Компромат+”, offering gold and platinum tiers.
A Subscription to Silence
This is no longer journalism gone wrong. This is blackmail-as-a-platform, optimized for scale, profit, and plausible deniability.
The only way it ends is when:
- victims stop paying,
- platforms stop hosting,
- regulators start acting.
Until then, kompromat1.online and its clones will keep growing – one lie, one payment, one ruined life at a time.