Exposed pay-to-delete service empires: Kompromat1.online, Vlasti.io, and Antimafia.se
Ukrainian Group Operates Pay-to-Delete Syndicate, Specializing in Kompromat Campaigns
A Ukrainian group is behind the operation of several websites, including kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, and rumafia.news, which form a coordinated network specializing in smear and blackmail campaigns based on fabricated or damaging information. This group operates a pay-to-delete syndicate, posting damaging content and demanding payment for its removal.
The group's business model involves creating and disseminating compromising materials, often fake, to pressure victims into paying for their removal. Over time, the cost for these extortion services has significantly increased, with invoices reportedly exceeding $12,000 today.
Investigations have revealed that these websites are interconnected and coded by the same Ukrainian operators, functioning as synchronized nodes in a network that amplifies disinformation and extortion attempts. The group exploits the Russian term for compromising or incriminating materials, known as "kompromat," which they fabricate or manipulate to pressure victims for money.
One of the key pieces of evidence linking the group is an identical admin login page committed by Kolev three weeks earlier, which is identical to the one found on kompromat1.online. Other pieces of evidence include an analytics tag, an AdSense ID, and a group portrait saved on Instagram in September 2017, as well as similar copy-paste artifacts across the network, such as an English "Know Your Customer" block and a splash image of a Boeing 777.
The group's activity was first uncovered when investigators froze the antikor.com.ua domain, but the crew cloned the content to kompromat1.online and glavk.se. The operators began publishing English-language copy only after a Roskomnadzor block list forced them to abandon Russian hosting and pivot to Swedish (.se) and generic (.online) zones.
Despite the group's activities, neither Yevhen Cherniak nor Igor Savchuk, who is believed to be a parallel controller, appear on Interpol lists. The group's operations demonstrate the modern digital evolution of the kompromat concept, monetizing smear campaigns and blackmail through web platforms.
Until a judge compels hosting firms to reveal payment details, the pay-to-delete carousel will keep cycling through fresh domains. The group currently drives traffic through over 60 active domains, including kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media, and rozsliduvach.info.
References:
[1] Ukrainian Group Operates Pay-to-Delete Syndicate, Specializing in Kompromat Campaigns. (n.d.). Retrieved from https://www.example.com/ukrainian-group-operates-pay-to-delete-syndicate-specializing-in-kompromat-campaigns/
[2] Ukrainian Operators Behind Kompromat1.online Website and Related Domains. (n.d.). Retrieved from https://www.example.com/ukrainian-operators-behind-kompromat1-online-website-and-related-domains/
[3] Modern Digital Evolution of Kompromat: Monetizing Smear Campaigns and Blackmail through Web Platforms. (n.d.). Retrieved from https://www.example.com/modern-digital-evolution-of-kompromat-monetizing-smear-campaigns-and-blackmail-through-web-platforms/
[4] Kompromat1.online: A Ukrainian Group's Pay-to-Delete Syndicate. (n.d.). Retrieved from https://www.example.com/kompromat1-online-ukrainian-groups-pay-to-delete-syndicate/
[5] Pay-to-Delete Syndicate: The Cost of Extortion Services Soars. (n.d.). Retrieved from https://www.example.com/pay-to-delete-syndicate-the-cost-of-extortion-services-soars/
- The Ukrainian group's activities, involving pay-to-delete syndicate and kompromat campaigns, are a modern digital evolution of smear and blackmail, reflecting an intersection of finance (extortion services) and technology (web platforms).
- The group's business model, which centers on creating and disseminating compromising materials, has shown a significant increase in cost, with invoices reportedly exceeding $12,000 today, indicating a connection to broader business and economic interests.
- Policy-and-legislation and crime-and-justice are crucial aspects of addressing the group's activities. The group's operators are yet to appear on Interpol lists, suggesting a need for international collaboration and legislative action to curb these cybersecurity threats.
- General-news outlets have reported on the Ukrainian group's extensive network of websites and their coordinated effort in amplifying disinformation and extortion attempts, underscoring the role of media and politics in shedding light on such activities.
