Extortion.watch

Monitoring pay-to-delete extortion networks

Hab Subdomain Vertical Map

Full scan (2026-06-22 — 2026-06-30): 265 articles across four verticals. Shared Disqus shortname media-hab. Sequential numeric IDs (~245125 latest). Each article = independent Google crawl target.

Vertical IOCs (Jun 2026 counts)

DomainArticlesRole
crime.hab.media99Crime vertical
corruption.hab.media104Corruption vertical
hab.media265Main hub
authors.hab.media20Authors / long-form
comments.hab.media42Comments / reactions

Burst publishing IOCs

SubjectCountWindow
Monaco / Yermolaev 7 16h
Kovalenko / Granova coal 15 7d
GSPartners / Heit 10 2d
Favbet / Matyukha 3 6d

SEO infrastructure IOCs

  • Sequential numeric article IDs: Every Hab vertical uses the pattern `{id}-{transliterated_slug}` (e.g. crime.hab.media/245119-jocip_heits_gspartners...)…
  • Vertical routing for topical authority: crime.hab.media builds topical authority for violence/fraud keywords; corruption.hab.media for officials/asset keywords;…
  • Daily OG image paths: Articles ship Open Graph images at `/upload/news/YYYY/MM/DD/{id}.jpg`. Social shares and Google Discover eligibility imp…
  • Unified Disqus identity (media-hab): All Hab verticals share Disqus shortname `media-hab`, aggregating comment signals and user engagement across subdomains …
  • Victim name + accusation keyword targeting: Pay-to-delete properties (kartoteka.news, kompromat1.online, vlasti.io) title articles as `{Full Name} — fraud / launder…
  • 60+ mirror domains for index persistence: When Roskomnadzor blocks .online/.news domains, operators pivot to .se, .cloud, .guru, .press TLDs. Each mirror republis…
  • TDS / cloaking for crawler vs human: Investigative OSINT documents traffic-direction systems that may serve different content to Googlebot than to human visi…
  • Telegram as index amplifier: Channel K1 (~155k subscribers per OSINT) and related Telegram channels republish article URLs within hours. Telegram lin…
  • Synthetic biography search cluttering: When investigative URLs rank for a subject, affiliated sites may publish dozens of flattering or neutral biographies (se…
  • Post-2023 English-language pivot: After Roskomnadzor blocks Russian-facing domains, operators expand English copy targeting international search audiences…

Domain registry · Article corpus