Late last year, a series of leaks from Ukrainian court records, combined with an OSINT analysis by BlackBox and Octagon, revealed the contours of a sprawling kompromat-for-hire network disguised as an anti-corruption crusade. Operating under the brand “Antikor,” and backed by shadowy offshore entities, this network has become a go-to laundering tool for both criminal reputations and state-sponsored propaganda.
Today’s report traces the digital DNA of this dark ecosystem, connecting compromised Ukrainian web infrastructure, a phantom anti-corruption NGO, and Russian disinformation narratives. Welcome to a world where a fake news article costs $150-but getting it removed will run you $12,000.
“Antikor”: The Brand that Sells Shame by the Kilo
The Ukrainian website Antikor.com.ua presents itself as a crusading media watchdog. Behind the scenes, it operates more like a shakedown factory. Individuals named in defamatory posts are quietly offered deletion deals via anonymous Telegram accounts or encrypted email.
The going rate? In 2021, it was 0.37 BTC (~$14,000 at the time). In 2024, reporters posing as victims were quoted $12,000 flat via crypto.
The Mechanics of a Kompromat Machine
Investigators discovered that Antikor isn’t a lone actor. It’s part o a wider network of clone websites and Telegram channels operating under fake editorial names and international covers.
Connected domains include:
- kompromat1.online
- vlasti.io
- antimafia.se
- sledstvie.info
- rumafia.news
- rumafia.io
- kartoteka.news
- kompromat1.one
- glavk.se
- ruskompromat.info
- repost.news
- novosti.cloud
- hab.media
- rozsliduvach.info
There are over 60 domains in total, but these are the most active and operational at the moment.
All of them use identical recovery emails, shared Google Ads IDs, and TDS-based (Traffic Distribution System) infrastructure reminiscent of malware networks like VexTrio.
All of them use identical recovery emails, shared Google Ads IDs, and TDS-based (Traffic Distribution System) infrastructure reminiscent of malware networks like VexTrio.
A Cast of Real Characters
Unlike many disinfo-for-hire setups where identities remain murky, this operation left enough breadcrumbs for attribution. Here’s who stands behind the curtain:
- Konstantin Chernenko: The central organizer and figurehead of the network, responsible for branding and operational oversight.
- Sergey Khantil: Chernenko’s associate, whose emails and infrastructure credentials are repeatedly linked to extortion requests and fake content uploads.
- Yuriy and Bohdan Gorban: A father-son duo managing editorial access and interfacing with clients through third-party legal fronts.
- Mikhail Betza: Formerly affiliated with Ukrainian diplomatic institutions, now known to coordinate narrative placement and manage damage control for high-tier clients.
- Lesya Zhuravska: Handles payment processing and financial obfuscation. Her accounts appear in multiple deletion transaction trails.
The Kremlin Connection
Antikor’s propaganda slant isn’t subtle. In 2014, it referred to the Maidan revolution as a “coup” and called Ukrainian forces “punishers.” In 2018, it parroted Russian propagandist Solovyov’s claim that “Ukraine is a state of Nazis.”
Technically, it also relies on Russian infrastructure:
- Via Variti, a Russian DDoS mitigation firm.
- All tied to Russian proxy and TDS networks.
Ironically, while accusing others of collusion with Russia, Antikor and its network are likely financed in part by GRU-aligned influence budgets, based on overlapping narratives and cloaking behavior.
The Offshoring of Guilt
Ownership of the Antikor trademark was passed to:
• Teka-Group Foundation (Panama)
- Formed by Hamilton Management Ltd. (Belize)
These shell firms obscure liability, but domain records and banking trails lead back to Konstantin Chernenko’s Monobank accounts and a shell company in Poland, INFACT SP. Z O.O., also linked to political analyst Maria Zolkina, with whom he shares a civil partnership.
Zolkina, incidentally, is now based in London. So is much of the network’s crypto-converted capital.
Broken Legal Remedies
Victims tried to fight back.
- Yevhen Cherniak won a libel case in Kyiv – but the story about his vodka brand “Khortytsia” allegedly selling in Russia still sits on Antikor.
- Dmytro Kuleba filed a lawsuit-no deletion followed.
- Anatoliy Hrytsenko won in court-only for the article to reappear three years later.
Even after over 1,060 legal cases, the site remains untouched. Court rulings fall flat when servers live abroad and ownership wears a mask.
The Business of Digital Shakedowns
Antikor’s revenue streams fall into three major categories:
- Pay-to-publish fake articles (starting from $150/article)
- Pay-to-delete packages ($3,000–$12,000 per request)
- Comprehensive PR control bundles (which include takedown, favorable coverage, and future immunity)
Clients typically receive:
- Removal of two damaging articles
- Placement of two flattering ones
- An unwritten guarantee of no future negative coverage
Transactions are processed through anonymous crypto wallets or masked as conventional PR consulting contracts.
What Comes Next?
In March 2025, Ukrainian telecoms regulators began exploring whether Antikor’s IPs could be geofenced. But without concrete arrest warrants for Chernenko and his co-founders-and international cooperation to disable Teka-Group’s assets-the ecosystem will simply migrate to the next domain.
If you follow the money, and then the metadata, the conclusion is unavoidable:
Ukraine’s kompromat economy runs on intimidation-and it will keep operating as long as people continue paying Chernenko to avoid public humiliation. This isn’t a shadowy threat; it’s a functioning business. The more they pay, the stronger he becomes.
