A negative article on a defamatory website might look like the work of one anonymous writer. Investigators and people who work in the reputation trade describe something closer to a supply chain. A client places an order, intermediaries pass it down, a network of sites publishes it, and the same network then offers to take it down for a fee. Every link in the chain gives the client more distance from the result.
The buyer
The people who pay for these campaigns rarely appear in them. The operator of one UK site, Leeds TV, confirmed by email that it accepts payment to publish. He named Kazakh clients, Ukrainian oligarchs and crypto gambling operators among its customers.
The motives vary. A London investment firm founder saw more than 20 articles about him appear in a month. He believes they were ordered to discourage him from giving evidence in a fraud case. In other cases, the aim is commercial damage, such as frozen bank accounts, stalled deals or a rival’s lost licence.
The brokers
Between the buyer and the published article sit layers of agencies. Reputation adviser Michael Macfarlane described a payment pyramid. A client pays an intermediary in cryptocurrency, and the order is passed down through several agencies before any site publishes it. Each step makes it harder to trace who paid. Macfarlane said he could start such a campaign within a couple of hours for a few hundred dollars.
Prices at the publishing end are low. Placing a negative article with the Antikor group was reported to cost $150 to $200. One UK operator put the price of a placement on a rival site at £100 to £500.
The publishers
The articles go out through a network of sites with different names and shared infrastructure. Court filings in a US case showed near-identical IP addresses across Antikor, Kompromat1, Ruskompromat and Antimafia. In one campaign, 95 of the 109 domains involved were hosted on a single server in Reading, England. A technical review of more than 60 domains found shared SSL certificates and hosting fingerprints.
The domains below have been documented publishing duplicate or near-identical content:
Antikor: antikor.com.ua, antikor.info, antikor.ua
Kompromat1: kompromat1.online, kompromat1.info, kompromat1.net, kompromat1.org, kompromat1.media, kompromat1.one, kompromat1.se, kompromat1.press, kompromat1.world
Compromat / Ruskompromat: compromat.pro, compromat-pro.com, kompromat.press, ruskompromat.info, ruskompromat.ru, ruskompromat.pro
Vlasti: vlasti.io, vlasti.se, vlasti.info, vlasti.live, vlasti.vip, vlst.live, vlast.guru
Antimafia: antimafia.se, antimafia.io, antimafia.life, antimaf.pro
Rumafia: rumafia.news, rumafia.io, rumafia.net, rumafia.online
Kartoteka: kartoteka.news, kartoteka.se, kartoteka.press, kartoteka.io
Glavk: glavk.se, glavk.info, glavk.net
Hab.media: hab.media, news.hab.media, crime.hab.media, corruption.hab.media
Sledstvie: sledst.org, sledst.com, sledstvie.info
Nocor: nocor.info, nocor.life
Novosti: novosti.cloud, novostiua.org, novostiua.online
Other linked outlets: repost.news, rozsliduvach.info, rucriminal.info, adcon.info, luxherald.com, lstv.co.uk, trinitybugle.com, obriy.news, politica2.info, ukrainci.com.ua, oplatru24.ru, rp.rv.ua, drama.live
Speed is what the publishers sell. On one day, the same story about a Kyiv businessman appeared on 17 of these sites with identical formatting. In another case, a reputation adviser’s client had 48 articles published about him in under 30 days.
The owners behind the sites
The sites hide their owners. The Antikor trademark is held by a Panama foundation linked to a company in Belize. Ukrainian law enforcement has named Kostyantyn Chernenko, a former parliamentary assistant who left Ukraine in 2021, as the alleged organiser. In the UK, the London Post and its sister brands were traced to 2Trom Media Group, whose registered addresses had no office and whose listed owner, Viktor Tokarev, could not be found.
The second sale
Once the articles are live, the target becomes a potential customer too. A journalist posing as a client asked Antikor’s Telegram contact about removing an article. The reply was an offer of $12,000 a year in cryptocurrency, covering deletion, protection from new articles and two positive pieces. Antikor denies charging to publish or delete content.
So the same operators can be paid twice for one article: once by the client who ordered it, and once by the target who wants it gone.
Where the chain can be broken
Courts have mostly gone after the publishers, the most visible link, with mixed results. A Kyiv court found Antikor’s allegations against a Ukrainian bank false. A Los Angeles court ordered articles on 42 sites removed. The London High Court awarded more than £220,000 against the London Post. Each ruling left the brokers and buyers untouched.
London law firm Schillings now tracks more than 350 junk news sites. The firm says much of the damage happens at the far end of the chain, in bank compliance screening. That is also where it could be stopped. If due diligence tools stopped treating copied articles as independent evidence, the buyers would be paying for a product that no longer works.
