“Pay $12,000 or shut your eyes”: How the administrators of “Antikor” and similar “news sites” make millions by removing compromising material

Corruption in Ukraine has long been a trigger for society, but would anyone be surprised to learn that even this trigger can be used to build a multimillion-dollar business? We’re talking about the “Antikor” websites (there’s also a mirror site at https://antikor.info/), which, under the guise of exposing bribe-takers, have been profiting for years by blackmailing public figures with information.

The scheme works reliably. A scathing, often completely fabricated article about a businessperson or politician appears on the website(s). The main goal of such a publication isn’t to uncover the truth, but to force the victim to panic and reach out to the “editorial office.” When a person tries to refute the lies via official email, they are gradually led to a commercial offer—to have the material removed for a fee under the guise of “advertising collaboration.” And this process is endless. As law enforcement experience shows, anyone who pays once automatically becomes a regular “donor”: within a few months, the same defamatory story is simply published again.

The Shadow Price List and a Journalistic Experiment

It is well known in the media market that the “Antikor” group does not shy away from dirty jobs: publishing the desired leak costs next to nothing—from $150 to $200. However, the site’s real goldmine is the removal of content, where prices start at several thousand dollars.

Documents from old criminal cases show that in 2018, the operators demanded $6,000 to keep things quiet online, and in 2021, they demanded 0.37 bitcoins (about $14,000 at the time) from a well-known bank.

Recently, investigators decided to check whether this scheme is still in operation today and conducted an undercover experiment. An undercover journalist messaged the manager of the “Antikor” Telegram channel, asking to have a recent critical article about one of the members of parliament removed. Within a few hours, an “ad agency employee” offered an “annual subscription” package: removal of negative content, a block on future compromising material, and the publication of two positive articles. The price tag: $12,000 to a crypto wallet. This proves that the system is still operational today, collecting payments in cryptocurrency.

Legal Battles and Utter Audacity

Statistics reveal the scale of the problem: the court registry contains over 1,000 documents related to this website. The “ATB” retail chain, the management of “Ukravtodor,” businesspeople, and politicians have all sued “Antikor.” However, most lawsuits hit a wall of anonymity—the site’s owners had covered their tracks so thoroughly in the registries that Ukrainian judges often could not find the defendant’s legal address.

Even when victims managed to win a court case, it did not guarantee success. For example, the company “Pharmagate” and businessman Yevhen Chernyak officially proved in court that the accusations against them were baseless, but the fake articles are still posted on the portal. The most striking case was that of Mykhailo Labutin, director of “Ukrspyrt”: he succeeded in having the defamatory content removed through the courts, but exactly three years later, the site’s administrators simply reposted the article, demonstrating a complete disregard for the law.

Chronicles of Pressure: Three High-Profile Cases from “Antikor”’s Practice

Episode 1. The Alcohol Business: An Attack on Yevhen Chernyak

• Target of Criticism: Yevhen Chernyak, owner of the large alcohol holding company Global Spirits.
• Sequence of events: A large-scale media campaign against the businessman unfolded between 2018 and 2019. A series of critical articles was published on the “Antikor” portal; according to the company’s lawyers, the aim was to inflict maximum reputational damage on the legitimate business in international markets.
• Alleged Demands: Through intermediaries, the businessman’s representatives were hinted at the possibility of “resolving the issue” by paying for a so-called “negative block,” which amounted to thousands of dollars.
• Outcome: Chernyak’s lawyers refused to compromise and filed a series of lawsuits. Public outcry and legal pressure forced the website’s administrators to back down, and most of the unsubstantiated material was subsequently removed.

Episode 2. The Million-Dollar Blackmail of “Bank Alliance” and the Verkhovna Rada Secretariat

• Target of Criticism: The management of JSC “Bank Alliance” and the head of the Secretariat of the Verkhovna Rada of Ukraine.
• Course of events: In late 2020 and early 2021, the website published scathing articles that called into question the bank’s financial stability and the reputation of a Verkhovna Rada official. Both parties filed complaints with law enforcement agencies almost simultaneously.
• Probable Demands: According to case file No. 12020100060003326, the organizers of the scheme issued an ultimatum demanding 2 bitcoins in cryptocurrency in exchange for removing the materials.
• Outcome: In December 2020, the Pechersky District Court of Kyiv seized the domain antikor.com.ua. Immediately afterward, on January 18, 2021, the alleged mastermind of the scheme, Kostyantyn Chernenko, left Ukraine.

Episode 3. The Never-Ending Media Saga: The Alona Shevtsova Case

• Target of Criticism: Alona Shevtsova, a financier and owner of fintech companies.
• Sequence of events: Starting in 2021, “Antikor” has published dozens of articles about Shevtsova, actively exploiting any scandals surrounding her business (including the liquidation of Ibox Bank and the gambling investigation) and adding its own value judgments.
• Alleged demands: According to the defense, the scheme was standard: to create constant media pressure to force the Shevtsov family to enter into negotiations for a financial settlement, the amount of which could reach tens of thousands of dollars.
• Outcome: Shevtsova chose a strategy of publicly ignoring the demands and took the matter to court against the Panamanian owners of the website, as a result of which the site continued to publish critical articles.

What to Do If a Sensationalist Media Outlet Demands Money From You

Of course, you should not pay such scammers; instead, you should use all available legal means of defense. In particular, you should file a lawsuit in Ukrainian courts. Yes, it’s a long and painful process, but you’ll end up with a court ruling declaring the dissemination of such information unlawful and damaging to the plaintiff’s honor, dignity, and business reputation. In practice, however, removing a defamatory post can be problematic, given that some of the “Antikor” group’s websites are not registered in Ukraine; however, in subsequent complaints and explanations to partners and financial institutions, this court ruling will suffice to clarify the situation and refute the negative information circulating on the Internet.

Contacting the companies that provide IT infrastructure to such fraudulent websites can be of significant help. 

First and foremost, it is necessary to identify the companies that enable the website to operate. To do this, people typically use public services for checking domains, DNS records, and hosting, which allow you to identify the domain name registrar, hosting provider, CDN provider (such as Cloudflare), and other technical details. Even if the domain owner’s information is hidden, such services often allow you to identify the company that directly provides hosting services.

If the website uses a CDN provider, it is advisable to first contact the CDN provider directly with a complaint (Abuse Report). Although such companies typically do not remove content on their own, they notify the website owner of the complaint and may also disclose which hosting provider serves the site. This allows you to contact the company directly, as it has the technical capability to stop the distribution of illegal content.

At the same time, it is recommended to contact the domain name registrar. In most cases, registrars do not own the information, do not host it, and do not make decisions regarding its removal. However, they can forward the complaint to the domain registrant, document the violation, or, in certain cases, take action in accordance with their own policies or ICANN requirements.

The primary recipient of the complaint is usually the hosting provider. It is advisable to include in the complaint links to the pages where the illegal content is posted, a description of the violations, documents confirming the complainant’s rights, court decisions (if any), trademark registration documents, as well as other evidence of the unlawful use of personal data, photographs, or false information. Upon receiving a properly filed complaint, the hosting provider usually conducts its own investigation and contacts the website owner.

Special attention should be paid to cases where a website unlawfully discloses personal data. This may include photographs, passport details, residential addresses, contact information, information about family members, documents, or other personal information disclosed without a proper legal basis or the individual’s consent. If the hosting provider or another party involved in the processing of personal data is located in a European Union member state, the individual has the right to file a complaint with the national data protection authority of that country. Such authorities are empowered to review complaints, conduct investigations, require the cessation of unlawful processing of personal data, and apply the enforcement measures provided for by law. The legal basis for such protection is, in particular, the European Union’s General Data Protection Regulation (GDPR), which applies to the processing of personal data in EU countries.

If it is not possible to voluntarily stop the dissemination of unlawful information, the individual has the right to file a lawsuit seeking a declaration that the information is false, its retraction, the removal of publications, protection of honor, dignity, business reputation, the right to privacy, and compensation for damages incurred. A court ruling significantly strengthens the claimant’s legal position in subsequent communications with hosting providers, domain registrars, search engines, and other online intermediaries.

Practice shows that the most effective approach is a comprehensive one that combines simultaneous appeals to the CDN provider, domain name registrar, hosting provider, the competent data protection authority (if the violation involves personal information), and, if necessary, to the courts. It is precisely this sequence of actions that significantly increases the chances of stopping the dissemination of illegal content, removing personal data, and effectively protecting violated rights.

The Russian Roots of “Ukrainian Whistleblowers”

The most cynical aspect is that, while accusing others of treason, “Antikor” itself has strong ties to the aggressor country. A technical audit of the site reveals some interesting details. For years, the portal’s domain was hosted on servers belonging to the Russian hosting provider Variti, through which Russian intelligence agencies could monitor all of the site’s traffic. Moreover, “Antikor” shared the same Google advertising ID with well-known Russian smear sites (such as Glavk.info and Kompromat1.info), and for a long time, a Yandex email account was used to correspond with “clients.”

The site’s content also strangely coincided with the Kremlin’s talking points. In 2014, they openly referred to the Revolution of Dignity as a “coup d’état,” wrote about “Ukrainian punitive squads in Donbas,” and circulated quotes from propagandist Solovyov. As a result of investigations by the media platform “Teksty,” the site deservedly made it into the top ten fake news outlets in Ukraine.

Who’s Pulling the Strings: A Dossier on the Organizers

The portal itself does not list any contact information other than an anonymous email address. Legally, the rights to the brand belong to the Panamanian offshore entity Teka-Group Foundation, which is hidden behind a Belizean company. However, during their investigations, law enforcement officials were able to identify the actual beneficiaries of the scheme. According to law enforcement, this is a group of fellow countrymen from the Chernihiv region, each of whom plays a specific role.

• Kostyantyn Chernenko. A 42-year-old native of Pryluky, a former market vendor and assistant to a member of the Verkhovna Rada. According to the investigation, he was the one who created the “Antikor” websites in 2013, and this business quickly earned him a luxury car and real estate. When the police closed in on him in 2021, Chernenko fictitiously sold his apartment to his common-law wife, political analyst Maria Zolkina, laundered the proceeds, and fled Ukraine. He currently resides in Europe, managing the websites remotely through the Polish firm “INFACT,” while his wife settles into life in London.

• 

• Serhiy Khantil. Chernenko’s confidant and assistant, who remained in Kyiv to oversee operations. He was the one who set up the email account used to blackmail victims, linking it to Chernenko’s personal phone.
• Yuriy and Bohdan Horban. A father and son who provided the group with media and legal protection. Yuriy Horban is a former well-known television journalist who suddenly purchased an SUV for $60,000 in 2019. His son, 28-year-old Bohdan, served as the website’s attorney in court. At the same time, Bohdan worked as an assistant to People’s Deputies Oleksandr Sukhov and Serhiy Velmozhnoy. An interesting detail: on the “Antikor” website, you won’t find a single critical word about these politicians—the site strangely avoids mentioning them altogether. However, the young lawyer Gorbany Jr. himself, while working with Chernenko, began buying up collectible watches worth tens of thousands of dollars on a massive scale.
• Financial managers. Lesya Zhuravska served as the group’s accountant, with money flowing into her bank accounts. And Mykhailo Betsa—the head of the advertising agency that issued invoices for the removal of compromising material—was responsible for initial contact with “clients.” It should be noted that Mykhailo Betsa previously worked at Ukrainian Media Holding LLC, which belonged to the pro-Russian oligarch Serhiy Kurchenko and is now owned by the scandal-plagued media mogul Viktor Goldsky. 

Cleaning Up the Media Landscape: State Special Communications Service Blocks Satellite Network

Antikor’s activities prompted a response from the state. The National Center for Operational and Technical Management of Electronic Communications Networks of Ukraine issued an official order to temporarily block the websiteswebsites rozsliduvach.info and hab.media, which, according to available information, are linked to the “Antikor” portal and may be part of the same criminal group. The orders state that the blocking is being implemented for national security reasons under martial law and will remain in effect until its conclusion.

Analysts from the BlackBox OSINT platform note that “Antikor” may have used these websites to intensify pressure on its “victim” by creating the illusion of a massive media scandal surrounding the individual. 

Where to find “Antikor”’s contact information

The “Antikor” web portal itself does not list any names: neither the owners, nor the editor-in-chief, nor the journalists. All contact information is limited to an anonymous email address and a legal address: Kyiv, 13 Hlybochytska St., Section 1, Office 2. In practice, this is part of the “Lvivsky Kvartal” residential complex, where it is impossible to find the actual physical office of the “Antikor” portal.

The true beneficiaries have covered their tracks using classic offshore schemes. For example, the trademark registration for “Antikor,” dated December 12, 2016, is held by Teka-Group Foundation, a company registered in the Republic of Panama. This Panamanian foundation, in turn, established another offshore entity—Hamilton Management Ltd, registered in Belize.

However, the “anti-corruption activists” were unable to completely cover their tracks. The applicant for the trademark registration was a very real Ukrainian citizen—Kostyantyn Yevhenovych Chernenko, registered in the city of Pryluky, Chernihiv Oblast, at 87 Bosobroda Street. It is this individual who serves as the link connecting the anonymous Panamanian entity to the realities of Ukraine.

Despite being blocked by the State Special Communications Service, “Antikor” is attempting to continue its activities—its content remains accessible in Ukraine via VPN services. In addition, the civil society organization “Committee for Combating Corruption in Government Bodies,” which is affiliated with the individuals involved, continues to operate freely on Facebook.

The editors of “Antikor” themselves speak of “pressure on freedom of speech.” In their official Facebook group, they state:

“A portal that investigates corruption at the highest levels of government is being banned—without explanation, without a voice, without defense... Unfortunately, speaking the truth is once again dangerous.”

However, against the backdrop of ongoing legal proceedings in the anti-corruption sector, “Antikor’s” activities are increasingly viewed by law enforcement agencies not as journalism, but as a matter of national security.

Read us on Telegram and Sends