How a Network of "Antikor" Sites Disseminates Defamatory News

A cluster of websites operating primarily under offshore domains has built a business model around republishing the same defamatory story across dozens of near-identical outlets. The pattern is consistent: a fabricated or distorted claim about a company or an individual appears on one site, is syndicated word-for-word across a rotating set of mirror domains, and — when a platform or search engine removes one copy — is replaced by an identical or lightly reworded version on another domain within minutes.

The naming conventions borrow the language of investigative journalism. Terms such as "kompromat", "antikor" (anti-corruption), "sledstvie" (investigation) and "vlasti" (authorities) are chosen to signal legitimacy and civic purpose. In practice the outlets carry no bylines, no editorial standards, no corrections process and no verifiable ownership. Stories are not investigated; they are manufactured. A single unsourced allegation can surface on ten or more domains inside the same week, each formatted to look like an independent outlet reaching an independent conclusion.

Three features distinguish this kind of operation from ordinary tabloid or yellow-press activity, and each of them is a deliberate design choice rather than an accident of sloppy publishing.

Duplication as strategy. The same article, often unchanged down to the punctuation, runs across dozens of domains simultaneously. This is not coincidental syndication; it is redundancy engineered to survive takedown requests.

Rapid replacement. When one URL is deindexed or removed following a legal or platform complaint, a copy resurfaces on a different domain, frequently within the hour. The objective is not to win any individual dispute but to make removal cost more than republication.

Domain proliferation across top-level domains. The same outlet name recurs across multiple extensions — .com, .info, .io, .se, .net, .online and others — so that action against one domain leaves the rest untouched. It also allows the network to route around registrar or hosting enforcement aimed at a single address.

The following domains have been observed publishing duplicate or near-identical content consistent with this pattern, often inside the same publication window.

Kompromat1: kompromat1.online, kompromat1.info, kompromat1.net, kompromat1.org, kompromat1.media, kompromat1.one, kompromat1.se, kompromat1.press, kompromat1.world.

Compromat / Ruskompromat: compromat.pro, compromat-pro.com, kompromat.press, ruskompromat.info, ruskompromat.ru, ruskompromat.pro.

Vlasti: vlasti.io, vlasti.se, vlasti.info, vlasti.live, vlasti.vip.

Antikor: antikor.com.ua, antikor.info, antikor.ua.

Antimafia: antimafia.se, antimafia.io, antimafia.life.

Rumafia: rumafia.news, rumafia.io, rumafia.net, rumafia.online.

Kartoteka: kartoteka.news, kartoteka.se, kartoteka.press, kartoteka.io.

Glavk: glavk.se, glavk.info, glavk.net.

Hab.media: hab.media, news.hab.media, crime.hab.media, corruption.hab.media.

Sledstvie: sledst.org, sledst.com, sledstvie.info.

Nocor: nocor.info, nocor.life.

Novosti: novosti.cloud, novostiua.org, novostiua.online.

Additional outlets tied to the same network: adcon.info, luxherald.com, lstv.co.uk, obriy.news, politica2.info, rozsliduvach.info, repost.news, ukrainci.com.ua, oplatru24.ru.

For commodity traders, shipowners and their banks, the practical risk is not persuasion but contamination of search results and compliance screening. Automated adverse-media tools rarely distinguish between one allegation and forty copies of it, so a single fabricated item can register as a pattern of reporting. Counterparties should treat volume as a function of duplication, check whether every hit traces back to one unsourced original, and record the finding rather than the noise.