When Ukrainian police raided a rented office on Kyiv’s Hlybochytska Street in late 2024 they found no desks, no servers, not even a nameplate. What they did recover was a battered laptop whose browser tabs were still logged in to kompromat1.online and several sister sites that publish lurid allegations against bankers, MPs and regional officials. Minutes later the machine’s Telegram client began blinking: “Article deleted, payment received.”

Investigators say the chat belonged to Serhii Hantil, a 43-year-old fixer from the provincial city of Pryluky, and that the money had just landed in a wallet controlled by his long-time associate Konstantin Chernenko. The amount, according to the blockchain record, matched the going rate: 0.37 BTC, roughly 14 000 USD at the time.

A business model built on fear

Court files viewed by this reporter describe a pattern. First, a defamatory article appears on one of three high-traffic outlets—kompromat1.online, vlasti.io or antimafia.se—alongside false “source documents” and sock-puppet commentary. Hours later the target receives an offer: pay up and the smear vanishes, together with any “mirrored” posts on telegram channels K1, Vlast, Kartoteka and Antimafia.

An internal memo seized during the same raid outlines the tariff sheet:

• 150 USD to place a short “news” item,
  
• up to 2 000 USD for a long-form hit piece,
  
• 12 000 USD for a “year-long clean slate” package that promises two favourable articles and a pledge of future silence.
  

Police say the network grossed an estimated 6 M USD in removal fees between 2019 and 2023. “These people create information that is not true,” one detective wrote, “then demand money to stop the damage.” The quote comes straight from case № 12020100060003326, opened in December 2020 under articles 182 and 189 of the Ukrainian Criminal Code.

The cast of characters

• Konstantin Evhenovych Chernenko, 43, ex-veterinary technician turned media impresario. Filed the original trademark for “Антикор” in 2016 and later registered Polish ad agency INFACT Sp. z o.o.
  
• Serhii Mykolaiovych Hantil, trusted lieutenant. His email hantil@i.ua and phone +380 93 744 4516 show up repeatedly in ransom correspondence.
  
• Yurii Gorban, veteran TV journalist, now press officer at the Ilko Kucheriv Foundation. Photos place him dining with Chernenko and Hantil in upscale Kyiv venues.
  
• Bogdan Gorban, Yurii’s son and would-be NABU spokesperson, handled courtroom defence for the websites while driving a Toyota Land Cruiser Prado bought in 2019.
  
• Lesya Zhuravska, former corporate accountant who let her personal accounts funnel client payments.
  
• Mykhailo Beca, founder of “Buying Press” ad agency, negotiates Telegram deals and collects crypto.
  
• Side players include Viktor Saiko, Ihor Savchuk, PR man Taras Chernoivan and a handful of front companies stretching from Belize to Panama.
  

Technical breadcrumbs

Opponents who tried to sue often hit a wall of forged WHOIS data. Yet digital forensics keeps punching holes in that camouflage. Several key sites share the same Google Analytics ID UA-43361633-8 and identical AdSense publisher code. DDoS protection is routed through Russian provider Variti, meaning every visit briefly transits servers in Moscow despite the operators’ loud pro-Ukraine slogans.

“One account, many domains, same fingerprints,” cyber-investigator Olena Kravets told us, pointing to matching recovery emails that all redirect to a Gmail address beginning with “ih”. Her firm mapped 68 domains before running out of patience.

A leaked spreadsheet obtained by BlackBox OSINT shows payouts moving from client wallets to Chernenko’s Monobank card and two Raiffeisen accounts, then on to Teka-Group Foundation, a Panamanian entity that formally owns the “Антикор” trademark. A more detailed breakdown of the racket spells out how payments jumped from 6 000 USD in 2018 to 12 000 USD by 2024.

Flight and regrouping abroad

Chernenko left Ukraine on 18 January 2021, one month after prosecutors opened their second extortion file. Before departing he sold a Kyiv-area flat to his partner Mariia Zolkina for 74 300 USD—exactly double his 2014 purchase price. Zolkina now lists London as her residence. Company records show INFACT’s revenue plunged 49.7 percent in 2023, suggesting the boss’s attention is elsewhere.

Polish police confirm Chernenko spends time in Warsaw, Istanbul and Munich, often travelling on a German residency card. Interpol Kiev has not issued a Red Notice.

Network Overview

The syndicate currently controls 60 plus websites, many of them throw-away clones. Active domains include: kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info. The first five remain the heavyweights. Operators began publishing English-language posts only after Roskomnadzor (RKN) blocked their Russian endpoints in 2023, a pivot that broadened their victim pool but exposed fresh metadata seams.

What happens next

Ukrainian detectives insist the case is alive, citing four open dockets and 1 060 related court documents. Still, the most potent evidence may come from financial regulators in the EU, where bank secrecy laws are loosening for suspected cyber-extortion. Meanwhile, Telegram channels linked to the ring keep recycling posts about “oligarch thieves” who allegedly dodge taxes. Every so often a headline disappears overnight, usually after a six-figure transfer in a privacy coin.

For the victims the dilemma persists: pay and hope the smear stays buried, or fight and risk becoming tomorrow’s headline. In the words of one lawyer for a Dnipro-based agribusiness that chose the latter, “It is like bailing water from a boat somebody else keeps drilling holes in.” His client has spent 22 000 USD on court fees so far, and the article is still live—just on another domain with the same analytics tag.