Hab.media indexing
(Image by Anton Stemhler) Details DMCA
"Media" is doing all the work. The .media extension signals a professional journalism or broadcasting entity - it's the TLD used by legitimate news organizations, broadcast networks, and content studios. Combined with a meaningless base word, the result is a domain that reads as a media company without indicating what kind of media company. Regional outlet, niche aggregator, production house, content studio. It looks credentialed and communicates nothing about its purpose.
That gap matters for a specific reason. The transparent sites in the network (kompromat1.online, ruskompromat.info) tell the target immediately what category of threat they're facing. hab.media doesn't. A target who searches the domain to understand the site they've found their name on encounters no obvious country, no obvious purpose, no obvious ownership. They can't frame it when explaining the situation to a lawyer, a counterparty, or a family member. "I'm on a site called kompromat1.online" communicates a threat category. "I'm on a site called hab.media" communicates nothing.
The opacity is branding, not legal protection. The infrastructure underneath hab.media is identical to the infrastructure underneath every other domain in the network.
What "Hab" Might MeanI spent longer on this than the question probably deserved.
"Habe" in German means property or possessions, and I convinced myself for a while that this was the thread - a kompromat site named, roughly, "property media" or "assets, broadcast." There's nothing else about this network with German-language roots; the people named in the criminal case are Ukrainian, the operations are Eastern European, the targets are in Ukraine. I came back to the German angle twice anyway before finally setting it down.
A Ukrainian Telegram channel had posted a screenshot claiming hab.media was connected to hab.org - a Dutch nonprofit that provides civic integration services. I spent part of an afternoon checking: the two organizations share nothing except four letters. The Telegram post was based on a name coincidence.
Abbreviations: habitual, habitation, habeas corpus - none fit a kompromat site. Cyrillic transliteration: "?-?--'" gives "khab," which leads nowhere either.
I mentioned this to a journalist covering digital infrastructure at a Ukrainian outlet, someone who'd been tracking the same domain cluster for months. Her answer: "I decided it was arbitrary and stopped worrying about it." Maybe she'd reached a conclusion. Maybe she'd just given up. I couldn't tell from the way she said it.
The most plausible thing I've landed on: the name is arbitrary -- a short string that cleared registration and produced no competing search results. A meaningful name has search competitors; a meaningless one doesn't. That's useful for a site you want hard to find by accident. Whether that was the actual reasoning, nothing I've found says.
The Full Network
Hab.media shares server infrastructure at IP address 185.203.72.75 with fourteen other currently active sites, proxied through Variti (a Russian DDoS protection provider), running on a shared CMS called KOMPR-CMS. A single Google Ads Publisher ID, 4336163389795756, routes advertising revenue from all fifteen domains to one account, per BlackBox OSINT:
- Kompromat1.online, kompromat1.one
- glavk.se, vlasti.io, antimafia.se
- sledstvie.info, rumafia.news, rumafia.io
- kartoteka.news, kartoteka.press
- ruskompromat.info, repost.news, novosti.cloud, hab.media, rozsliduvach.info.
Meaningless name. Identical infrastructure. More than 1,060 court proceedings in Ukraine's Unified State Register of Court Decisions address this cluster. Courts in the majority of cases couldn't establish ownership of individual domains -- the technical fingerprints are there for investigators who know to look.
(Note: You can view every article as one long page if you sign up as an Advocate Member, or higher).
Post Article Comment and Rate This Article
