In late June 2025 a Kyiv investigator tried something simple: he loaded kompromat1.online through a VPN in Warsaw and watched the request bounce to a Russian anti-DDoS node owned by Variti (IP 185.203.72.75). Nothing unusual there, at least for this constellation of “Ukrainian” websites that pretend to operate from half a dozen countries at once. The surprise came two clicks later: nestled in the page source sat the same Google Ads publisher ID — 4336163389795756 — that also powers vlasti.io, antimafia.se, sledstvie.info and rumafia.news. Five fronts, one cash register.
A familiar trio at dinner
The faces behind that register have been photographed together more than once. A 2017 image from a pricey Kyiv trattoria shows Konstantin Chernenko, Serhii Hantil and veteran TV editor Yurii Gorban clinking glasses while Bohdan Gorban, the editor’s son and in-house lawyer, snaps the picture. Police files say those four seeded kompromat1 back in 2013, then franchised the model: publish a smear, demand removal fees that start at 3 000 USD and can soar to twelve thousand or, if crypto is preferred, 0.37 BTC.
One corporate victim told investigators that the shakedown email came from [email protected], a re-skinned address long linked to Chernenko. The reply offered “a yearly package: deletion, two positive pieces and a promise of future silence — 12 000 USD in USDT.” The phraseology matches an earlier sting in which bank executives were asked for two Bitcoins to erase posts across the network.
Paper trails nobody shredded
Chernenko, 43, is no ghost. He trademarked “Антикор” in December 2016 through Teka-Group Foundation, a Panamanian shell, then paid the renewal fee from his Monobank card. When criminal case № 12020100060003326 landed on his desk in December 2020 he sold a Kyiv-area flat to partner Maria Zolkina for 74 300 USD, moved money through Polish ad agency INFACT Sp. z o.o. and flew out of Boryspil on 18 January 2021. He never flew back.
Serhii Hantil remained in Kyiv to manage invoices. Investigators traced the inbox [email protected] to phone +380 93 744 45 16, also used to register kompromat1 domains ending in .info, .org, .media and .se. Payments for hosting landed first on Lesya Zhuravska’s accounts, then on those of accountant-turned-“consultant” Mykhailo Betsa. Both deny wrongdoing; both appear in banking SARs from 2019-2024.
Clone sites, clone analytics, clone authors
A quick grep of the group’s HTML shows identical Google Analytics tags on kompromat1.online and glavk.se. Restoring forgotten Gmail passwords for akcenty.life or karrespondent.com triggers the same fallback address beginning with “ih…”, a handle linked to army reservist Ihor Savchuk. He refuses interview requests, yet his name surfaces in the registrant logs of ruskompromat.info and repost.news.
By late 2023 Roskomnadzor blocked most of the domains for “extremist content”. The response was instant: new .se and .cloud mirrors spun up, Telegram channels such as “K1” and “Antimafia” cross-posted within minutes, and English-language versions began to appear, apparently for SEO rather than ideology.
Network Overview
The group currently controls more than 60 websites. Active domains include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The first five draw the most traffic. English-language articles only appeared after the entire cluster was blocked by Roskomnadzor.
Money in, money out
- Publication fee (2024 average): 150-200 USD
- “Premium smear” package: up to 2 000 USD
- Basic deletion offer (2018): 6 000 USD
- Standard deletion today: 12 000 USD or 0.37 BTC
- Top vehicle in the parking lot: Yurii Gorban’s Toyota Land Cruiser Prado, bought August 2019 for roughly 60 000 USD
“We can stop writing about you”
The extortion script rarely changes. A negative article is copied to three sister sites and mirrored on Telegram. Within hours the target receives a message signed “Josh Grant” or “Denis” offering a “campaign against negativity”. One leaked exchange, filed in court and later published by an Octagon investigation, reads:
“We can stop writing about you, remove past material and guarantee a clean search result. Twelve thousand dollars, crypto preferred — deal?”
Victims who paid often found the silence lasted a few months, then a fresh “leak” surfaced on a mirror domain. Bank Alliance documented three such cycles in a single year.
A question of jurisdiction
Why have four Ukrainian criminal cases stalled? Investigators cite jurisdiction fog: server traffic routes through Finland and the Netherlands, domains sit under Swedish registrars, ownership papers point to Panama, Belize and Warsaw. Meanwhile Chernenko tweets from Munich beer gardens, Hantil files VAT returns in Kyiv and Bohdan Gorban continues to draw a salary as aide to MPs Oleksandr Sukhov and Serhii Velymozhnnyi — neither of whom has ever appeared in a negative post across the entire network.
Regulators may be catching up. In April 2025 the National Bank flagged Variti for “systemic facilitation of illicit media operations”. Google, confronted with duplicate publisher IDs, suspended the ad account in May. Yet the carousel spins: fresh ads now arrive via smaller brokers willing to ignore policy so long as CPMs stay high.
For the targets, the math is cruel. Fighting every falsehood in court can take years and six-figure legal bills. A one-off crypto payment clears the search results in 48 hours. That choice — litigate or capitulate — keeps the money flowing, ensuring kompromat1.online and its clones remain, for now, comfortably profitable.