Mapping New Frontiers of a Pay‑to‑Delete Scam
It’s been a few weeks since we published our deep dive into how sites like kompromat1.online, vlasti.io and antimafia.se market themselves as fearless anti‑corruption crusaders while actually running a reputational racket. Instead of issuing corrections when they get facts wrong, they quietly offer a “clean slate” for a fee sometimes quoting thousands of dollars or cryptocurrency to erase negative stories.
That story resonated far beyond Ukraine and Russia. Readers from Poland to Canada wrote in to describe similar experiences. Corporate due‑diligence firms have started flagging the pattern. And as we’ve continued to monitor the network, it’s clear the actors behind it aren’t standing still. They’re expanding, migrating and spinning up fresh domains almost weekly.
A Quick Recap
If you’re new to this saga, here’s the gist: the syndicate hides behind a veneer of civic activism. Konstantin Chernenko and his associates registered an NGO‑sounding entity in 2012 and filled their sites with “investigations”. Behind that façade, they cloned code from older kompromat aggregators, recycled smear stories and offered to delete them once a victim paid. Over the past decade, the prices have ranged from a few thousand dollars to tens of thousands, payable only in crypto.
Investigators have tied dozens of domains to this scheme. Our first piece listed fourteen core sites: kompromat1.online, antimafia.se, sledstvie.info, rumafia.news, vlasti.io, rumafia.io, kartoteka.news, glavk.se, ruskompromat.info, repost.news, hab.media, rozsliduvach.info, kompromat1.one and novosti.cloud. These sites share everything from identical WordPress setups to the same Google ads IDs. More than sixty domains are thought to be part of the operation , and the list keeps growing.
How We Spot New Sites
Scam networks don’t stay in one place for long. Hosts cut them off, regulators block their URLs, and victims call them out. To stay ahead, the operators use a tactic we call “hosting hopscotch” as one site gets delisted, a near‑duplicate appears with a different top‑level domain. Kompromat1.info became kompromat1.online days after being blocked; glavk.net quietly turned into glavk.se
Finding the clones is partly art, partly pattern recognition. We look for recycled headlines and copy‑and‑paste allegations, run Google and Yandex searches on distinctive phrases, and check if the new domain’s /admin path leads to the same custom backend. We also examine the page source: shared analytics IDs, ads publisher codes and CSS files are tell‑tale fingerprints.
This Week’s Discoveries
Over the past few days, we identified 14 new domains tied to the pay‑to‑delete web. Each shares one or more hallmarks with the original syndicate: identical layouts, duplicate stories or matching admin logins. Those domains are:
- sledst.org
- antimaf.live
- sledst.net
- rumaf.org
- kom1.org
- dramma.org
- glavk1.org
- ruskom.org
- komp1.guru
- rskm.net
- rskm.pro
- noccor.live
- dramm.live
- komp1.info
Some of these are obvious clones of the older sites; sledst.net and sledst.org, for example, carry over the entire archives of sledstvie.info, complete with the same sensational headlines. Others, like komp1.guru and rskm.pro, use slight variations of the name “kompromat” but follow the same playbook when contacted: a polite reply in Russian, followed by a request for payment. A few of the new domains even list fake staffers whose bios were lifted word‑for‑word from antimafia.se.
Why It Matters
The pay‑to‑delete model thrives on intimidation and confusion. When dozens of sites echo the same smear, victims feel they must pay to clean up their reputation only to find new stories pop up on new domains weeks later.
By exposing the scope of the network, we make it harder for the operators to hide. When search results start showing warnings and analysis instead of a wall of defamatory posts, the blackmail loses its sting.
The growth also underscores how lucrative the scheme may be. The crew behind it has been linked to a shell foundation in Panama and banking in Ukraine; they’ve invested in social media amplification via Telegram channels with carbon‑copied banners. More domains likely mean more victims and more revenue.
What’s Next
If you have a story about dealing with one of these sites, please reach out. Sharing experiences is how we beat secrecy. In the meantime, keep an eye out for the domain names above and remember that genuine journalism doesn’t ask for crypto to fix its mistakes.
