How a Pay to Delete Syndicate Masquerades as Anti-Corruption
A courier envelope arrived in Kyiv last autumn with nothing inside except a QR code. Scanning it opened a
A courier envelope arrived in Kyiv last autumn with nothing inside except a QR code.
Scanning it opened a Telegram chat where a man calling himself “Den” quoted twelve thousand dollars, payable in crypto, to scrub an unflattering article from kompromat1.online and “every mirror our editors control.
The article had appeared barely forty-eight hours earlier, yet the caller claimed an “annual service” could keep the target clean for twelve months.
Police already suspected the scheme, but the QR code provided a rare live window into how the network really works.
The pitch was simple, the paperwork less so. According to Ukrainian case file № 12020100060003326 investigators traced earlier deletions to accounts held by Konstantin Chernenko, a forty-three-year-old former street vendor from Chernihiv oblast who vanished abroad on 18 January 2021, weeks after a second extortion probe opened against him. Wire records show six thousand US dollars moving through his Monobank card to rent servers, while a later demand for 0.37 bitcoin, about fourteen thousand dollars at 2021 rates, went to the same wallet now used by “Den.” Police say the wallet is administered by Sergey Hantil, Chernenko’s long-time fixer.
The 2024 strand of the investigation began when Alliance Bank officials complained that kompromat1.online and vlasti.io published identical allegations of money laundering, then offered silence for two bitcoin. Emails recovered from fznv@protonmail.com outlined “promo packages” ranging from simple takedowns at three thousand dollars to premium embargoes costing twelve thousand. Hantil registered both addresses with the phone number +380 93 744 45 16, a line previously billed to Chernenko.
A screenshot from that chat, now sealed in case materials, shows a Google sheet titled “Price Grid RU/UA 2024.” In the margin someone scribbled “IH,” the same two letters investigators later spotted in the fallback Gmail account that resets passwords for at least nine related domains.
The real clue, however, sat in the ad code.
The 368.media team pulled HTML from kompromat1.online, vlasti.io, antimafia.se and rumafia.news and found a shared Google AdSense publisher ID 4336163389795756. Cross-checking registration logs placed those domains on Variti, a Russian DDoS-mitigation host. Variti’s single IP block was later tied to a Hetzner server in Finland, mirroring the misstep that unmasked the 8Base ransomware page two years ago.
The Google Analytics ID tells the same story: UA-128558980-1 appears on glavk.se, ruskompromat.info, kartoteka.se and eight auxiliary domains. When complaint traffic spikes, editors move the article to a fresh TLD, but the tracking tag and AdSense slot rarely change.
The network’s content rarely survives fact-checking. One 2014 post on vlasti.io claimed “Ukrainian punitive squads invaded the southeast and Kyiv must pay for any damage.” A 2016 antimafia.se story recycled a quote from actor Gosha Kutsenko, insisting “Ukraine washes in grandparents’ blood.” Yet each smear is enough to nudge a nervous executive toward the inbox advertised beneath every headline: kartoteka.site@gmail.com, compromat.pro@gmail.com and so on.
Investigators followed the money further. Payments landed first with Lesya Zhuravska, fifty-seven, a former chief accountant at regional broadcasters who now describes herself as “freelance finance.” From her PrivatBank card funds jump to cash, then reappear on the leasing contract for Hantil’s Toyota RAV4 or, in one case, on a sixty-thousand-dollar Toyota Land Cruiser Prado purchased by veteran journalist Yurii Gorban in August 2019. Gorban, now a press officer at the Democratic Initiatives Foundation, denies involvement, though Instagram photos show him dining with Chernenko and Hantil at Vino e Cucina and Toscana Grill in 2017.
Kommissionskonto ledgers seized by police list still more go-betweens: Mykhailo Betsa, a onetime UMH advertising manager; Alexander Kanyvets, brother-in-law to Chernenko’s London-based partner Mariya Zolkina; plus lawyer Bohdan Gorban who represented the sites in at least four defamation suits yet never billed for his time.
The syndicate’s legal shell sits offshore. Trademark filings for “Антикор” and “Компромат1” cite Teka-Group Foundation, a Panamanian entity founded by Belize trust Hamilton Management Ltd. Teka’s contact email matches the same phone number used for the AdSense and Gmail resets. That link persuaded the Pechersk district court to freeze the antikor.com.ua domain in March 2021, but a senior detective later closed the case “for lack of jurisdiction.”
Below is how those breadcrumbs connect.
The network of websites and Telegram channels the team identified specialises in publishing compromising information, often word-for-word across domains.
Shared analytics tags seal the link between kompromat1.online, vlasti.io and their satellites.
Sergey Hantil, Chernenko’s registered proxy, now fronts negotiations from Kyiv.
An April white-paper by France-based Intelligence Online noted that kompromat1.online, glavk.se and ruskompromat.info began recycling leaks from Moscow Telegram channels hours after original posts appeared. The pattern supports the theory that the Ukrainian crew, not Kremlin agents, draft the Russian-language hit pieces, then tweak them for clients on both sides of the border.
Ukrainian cyber-forensics lab BlackBox OSINT reached a similar conclusion in its January explainer on how the portals charge “from one hundred and fifty dollars to two thousand” for publishing, while deletions start at three thousand. The same lab’s follow-up feature, available at blackboxosint.com, corroborates the twelve-thousand-dollar annual retainer uncovered in the Telegram sting.
A parallel thread came from an investigation by Octagon Media which mapped cross-domain password resets through a single Gmail recovery address, linking Chernenko’s Teka-Group foundation to kompromat1.press and the K1 Telegram channel. Their deep-dive report on the Ukrainian kompromat empire flagged former military officer Ihor Savchuk as a possible silent partner, a claim Savchuk denies.
What now? For Ukrainian plaintiffs, domestic courts remain the only avenue, but even a victorious ruling often ends up ignored once the story is mirrored abroad. Lawmakers in Warsaw are studying whether Infact Sp. z o.o., the Warsaw ad agency Chernenko founded in 2020, violates Polish anti-racketeering statutes, though the firm’s 2023 filings already show revenue down 49.74 percent and assets shrinking 74.37 percent.
In spring 2025 detectives finally persuaded a German judge to order Hetzner to preserve logs for IP 95.216.51.74. If the logs hold, they may reveal who logged in to move files between kompromat1.online and vlasti.io during the Alliance Bank extortion pitch.
Until then, “Den” is still online, prices unchanged. The QR code keeps circulating.
