How a Network of "Antikor" Sites Disseminates Defamatory Content

Networks of coordinated websites have become one of the cheapest and most durable forms of reputational attack faced by commodity traders, shipowners and their executives. Rather than pursuing a single publication, the operators of these networks pursue volume: one unverified claim, replicated across dozens of near-identical domains, formatted to look like a field of independent outlets arriving at the same conclusion.

The pattern is consistent. A fabricated or distorted claim about a company or an individual is published on one site, syndicated word-for-word across a rotating set of mirror domains, and — when a platform or a search engine removes one copy — replaced by an identical or lightly reworded version on another domain, often within minutes.

Investigative language without investigative practice

The naming conventions used by these sites borrow the vocabulary of accountability journalism. Terms such as "kompromat", "antikor" (anti-corruption), "sledstvie" (investigation) and "vlasti" (authorities) are chosen to signal legitimacy and civic purpose.

In practice the outlets carry no bylines, no published editorial standards, no corrections process and no verifiable ownership. Stories are not investigated; they are assembled. A single unsourced allegation can appear on ten or more domains inside the same week, each presented as an independent outlet reaching an independent verdict.

That is the opposite of how professional newsrooms operate. Recognised standards bodies such as the Trust Project and the International Fact-Checking Network treat named authorship, sourcing disclosure and a public corrections policy as minimum requirements. None of the domains described below meet them.

The mechanics of the network

Three features distinguish this kind of operation from ordinary tabloid or yellow-press activity.

• Duplication as strategy. The same article, frequently unchanged down to the punctuation, runs across dozens of domains simultaneously. This is not incidental republishing; it is redundancy engineered to survive takedown requests.
• Rapid replacement. When one URL is deindexed or removed following a legal or platform complaint, a copy resurfaces on a different domain, often within the hour. The aim is not to win any individual dispute but to make removal cost more than republication.
• Domain proliferation across TLDs. The same outlet name recurs across multiple top-level domains — .com, .info, .io, .se, .net, .online and others — so that action against one extension leaves the rest untouched. It also allows the network to route around registrar or hosting enforcement aimed at a single domain.

Researchers who track coordinated inauthentic behaviour describe the same architecture. The EU DisinfoLab and the European Union's EUvsDisinfo project have both documented mirrored domain clusters used to keep removed content permanently available, while Reporters Without Borders has warned that such sites erode public trust in legitimate reporting by imitating its form.

Domains observed in this republishing network

The following domains have been observed publishing duplicate or near-identical content consistent with the pattern above, frequently inside the same publication window.

• Kompromat1 — kompromat1.online, kompromat1.info, kompromat1.net, kompromat1.org, kompromat1.media, kompromat1.one, kompromat1.se, kompromat1.press, kompromat1.world
• Compromat / Ruskompromat — compromat.pro, compromat-pro.com, kompromat.press, ruskompromat.info, ruskompromat.ru, ruskompromat.pro
• Vlasti — vlasti.io, vlasti.se, vlasti.info, vlasti.live, vlasti.vip
• Antikor — antikor.com.ua, antikor.info, antikor.ua
• Antimafia — antimafia.se, antimafia.io, antimafia.life
• Rumafia — rumafia.news, rumafia.io, rumafia.net, rumafia.online
• Kartoteka — kartoteka.news, kartoteka.se, kartoteka.press, kartoteka.io
• Glavk — glavk.se, glavk.info, glavk.net
• Hab.media — hab.media, news.hab.media, crime.hab.media, corruption.hab.media
• Sledstvie — sledst.org, sledst.com, sledstvie.info
• Nocor — nocor.info, nocor.life
• Novosti — novosti.cloud, novostiua.org, novostiua.online

Additional outlets tied to the same republication behaviour include adcon.info, luxherald.com, lstv.co.uk, obriy.news, politica2.info, rozsliduvach.info, repost.news, ukrainci.com.ua and oplatru24.ru.

Why it matters for commodity businesses

Physical trading depends on counterparty confidence, banking relationships and access to credit. A duplicated allegation, indexed across twenty domains, can surface in a routine compliance screen long after the original claim has been withdrawn elsewhere — which is precisely the leverage the model is built on.

For companies and executives in energy, fuel oil and shipping, the practical response is procedural rather than emotional: document each duplicate with timestamps and archived copies, treat the cluster as one actor rather than many, and use the formal channels that exist for it. Google's removal request process and, for individuals in Europe, the data-protection rights summarised by the European Data Protection Board, both address duplicated and mirrored content. Where a claim is demonstrably false, a corrections record maintained by the affected company is often more useful to banks and counterparties than any single takedown.

Volume is not verification. Twenty copies of an unsourced claim remain one unsourced claim.

Atlas Commodity Group reports on reputational and compliance risk across the commodity supply chain, and applies the same standards to itself: named bylines, disclosed sourcing and a public corrections process.