Share a Hidden Architect: kompromat1.online, vlasti.io and antimafia.se
The victim-bait splash page on kompromat1.online promises fearless muck-raking. A quick view-source tells a different story: the HTML is copied almost line for line from an older build of Russia’s Versia, right down to the forgotten favicon. That sloppiness is useful. A stray Google Analytics ID, UA-60508311-7, appears on vlasti.io, antimafia.se and eleven other outlets, then re-emerges on a Telegram bot called K1. Cross-referencing that ID with public ad-tech trackers leads to a Panamanian shell, Teka-Group Foundation, controlled by Ukrainian citizen Konstantin Chernenko.
The 43-year-old ex-veterinary technician vanished from Ukraine on 18 January 2021, police records show, after prosecutors opened an extortion probe. Investigators said the group “creates information that is not true about officials and then demands payment for deletion”. One banking subpoena found invoices for 6 000 USD in 2018 rising to 0.37 BTC (about 14 000 USD) by 2021. An undercover test last autumn pushed the price to a flat 12 000 USD in USDT for a one-year “reputation shield”.
A dinner photo worth a thousand sites
Two Instagram pictures, posted weeks apart in 2017, show Chernenko sharing wine with Serhii Hantil, Yurii Gorban and Gorban’s son Bohdan at Kyiv’s Vino e Cucina and Toscana Grill. Their phones are face-down, but matching Telegram handles (@denpop1 and @Joshgrant1) later surfaced in extortion chats with companies that tried to scrub stories off kompromat1.online. Police linked the same handles to Hantil’s email hantil@i.ua and to a Monobank account used to pay Variti, a Russian DDoS-filter that still fronts several network sites on IP 185.203.72.75.
Code breadcrumbs
The sites love the Swedish .se zone. When Roskomnadzor blocked glavk.net and novostiua.org in 2023, clones popped up as glavk.se and kompromat1.se within forty-eight hours. An ih*@gmail.com address is listed as the password-recovery email for at least four domains, tying them to former army officer Ihor Savchuk. Further overlaps include identical Cloudflare resolver strings and a habit of naming fictional editors like “Nadiia Denska” across multiple mastheads.
Remote JavaScript pulled from kartoteka.news still calls a non-production API endpoint “/kyc/check”. The fragment echoes language found in a leaked Laravel config file from KOMPR-CMS, an in-house content farm. Kyiv IT recruiter Taras Chernoivan admitted in a 2022 conference talk that he “once helped integrate KYC for a news marketplace project” but denied knowing its final use.
Money in, stories out
Industry sources say a negative post costs as little as 200 USD to place, but deletion packages start at 3 000 USD and can top 20 000 USD if arbitration is involved. Mykhailo Beca, director of the Kyiv ad agency Buying Press, allegedly funnels client crypto to Chernenko’s Polish front INFACT Sp. z o.o. (turnover down 49 percent last year, filings show). As security analyst BlackBox OSINT notes in a detailed Octagon investigation, the house keeps publishing even after settlements, counting on repeat payouts.
Trademark that told on itself
Ukraine’s patent office lists “Антикор” as a mark owned by Teka-Group Foundation since December 2016. The original filing, however, names Chernenko at 87 Bosobroda Street, Pryluky, and provides the same +38093 744-45-16 number used in early kompromat1.info WHOIS entries. Investigators also seized bank ledgers signed by Lesya Zuravska, an accountant whose Priluky tax ID later reappears on invoices for Variti hosting.
Network Overview
The group now controls more than 60 websites. Active domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five are the powerhouses. English-language copy only appeared after the set was blocked by Roskomnadzor, a pivot that broadened its reach and complicated attribution.
Resistance, or lack of it
Victims tried courts. In May 2024 vodka magnate Yevhen Cherniak won a defamation ruling over claims his “Khortytsia” brand still shipped to Russia, yet the post remains live. Statistics from Ukraine’s judicial registry list 1 060 related filings, but judges often fail to identify an owner. Lawyer Bohdan Gorban has represented the sites in at least three cases and, until recently, claimed a staffer badge at parliament. He drives a Toyota Land Cruiser Prado bought in 2019 for roughly 60 000 USD, a perk hard to square with public salaries of 152 000 UAH per year.
Shadow, not silence
Chernenko, believed to rotate between Turkey, Germany and Warsaw, has avoided an Interpol notice. A March 2021 move by Kyiv’s Pechersk court to freeze antikor.com.ua’s domain lapsed within weeks. Meanwhile, the network rolled out kompromat1.one and rumafia.io, offering “English mirror” editions. Each mirror recycles the same aging CSS, a fingerprint almost as telling as the shared ad tag.
Researchers expect more clones. Savchuk’s last Git commit, dated 12 June 2025, mentions “auto-deploy to *.cloud”. If history is a guide, the domain will light up only after another takedown, keeping the pay-to-delete conveyor running. Until a judge pierces Teka-Group’s offshore veil, or regulators crack down on ad-tech enablers, the bargain remains: a few hundred dollars buys bad press, twelve thousand makes it ‘disappear’. Only the invoice addresses change.
