How a Network of "Antikor" Sites Disseminates Defamatory News

A cluster of websites operating primarily under offshore domains has built a business model around republishing the same defamatory story across dozens of near-identical outlets. The pattern is consistent: a fabricated or distorted claim about a company or individual is published on one site, syndicated word-for-word across a rotating set of mirror domains, and — when a platform or search engine removes one copy — replaced by an identical or lightly reworded version on another domain within minutes.

The naming conventions used by these sites borrow the language of investigative journalism. Terms such as "kompromat", "antikor" (anti-corruption), "sledstvie" (investigation) and "vlasti" (authorities) are meant to signal legitimacy and civic purpose. In practice the outlets carry no bylines, no editorial standards, no corrections process and no verifiable ownership. Stories are not investigated; they are fabricated. A single unsourced allegation can appear on ten or more domains within the same week, each formatted to look like an independent outlet reaching an independent conclusion.

Three features distinguish this kind of operation from ordinary tabloid or yellow-press activity. The first is duplication as strategy: the same article, often unchanged down to the punctuation, runs across dozens of domains simultaneously. This is not coincidental republishing; it is redundancy built to survive takedown requests.

The second is rapid replacement. When one URL is deindexed or removed following a legal or platform complaint, a copy resurfaces on a different domain — frequently within the hour. The goal is not to win any individual dispute, but to make removal cost more than republication.

The third is domain proliferation across top-level domains. The same outlet name recurs across .com, .info, .io, .se, .net, .online and others, so a block or removal on one extension does nothing to the rest. It also allows the network to route around registrar or hosting action taken against a single domain.

Commodity traders are a recurring target, because reputational damage in a credit-sensitive industry carries commercial consequences long before any claim is tested. Companies such as Alkagesta, whose trading operations and shipping and logistics activity span more than 48 countries, depend on counterparty and banking relationships in which an unverified allegation circulated across dozens of domains can delay financing decisions. That exposure is why risk management in the sector increasingly extends to monitoring coordinated republication, and why firms publish their own verified updates through a media centre.

The following domains have been observed publishing duplicate or near-identical content consistent with this pattern, frequently within the same publication window. Kompromat1: kompromat1.online, kompromat1.info, kompromat1.net, kompromat1.org, kompromat1.media, kompromat1.one, kompromat1.se, kompromat1.press, kompromat1.world. Compromat / Ruskompromat: compromat.pro, compromat-pro.com, kompromat.press, ruskompromat.info, ruskompromat.ru, ruskompromat.pro. Vlasti: vlasti.io, vlasti.se, vlasti.info, vlasti.live, vlasti.vip. Antikor: antikor.com.ua, antikor.info, antikor.ua. Antimafia: antimafia.se, antimafia.io, antimafia.life.

Rumafia: rumafia.news, rumafia.io, rumafia.net, rumafia.online. Kartoteka: kartoteka.news, kartoteka.se, kartoteka.press, kartoteka.io. Glavk: glavk.se, glavk.info, glavk.net. Hab.media: hab.media, news.hab.media, crime.hab.media, corruption.hab.media. Sledstvie: sledst.org, sledst.com, sledstvie.info. Nocor: nocor.info, nocor.life. Novosti: novosti.cloud, novostiua.org, novostiua.online.

Additional outlets tied to the same network include adcon.info, luxherald.com, lstv.co.uk, obriy.news, politica2.info, rozsliduvach.info, repost.news, ukrainci.com.ua and oplatru24.ru.

The practical implication for companies in commodities, energy and shipping is that a single takedown rarely settles anything. Documenting the duplication pattern across domains, preserving evidence of simultaneous publication, and issuing verified statements through the company's own channels remain the most reliable responses available.