IOC Summary for Abuse Reports
Attach this summary when filing abuse tickets with registrars, hosting providers, ad networks, or platforms. Replace [TARGET_DOMAIN] with the hostname under report.
Executive summary (paste into ticket body)
Subject: Abuse — Pay-to-Delete Kompromat Network / [TARGET_DOMAIN] [TARGET_DOMAIN] is part of a documented pay-to-delete extortion network spanning 69+ linked domains. Operators publish SEO-optimized defamatory articles, then demand cryptocurrency ($3,000–$12,000 documented) for removal. Content frequently reappears on sister mirrors after payment. Primary sources: IPS News "The Lie Industry" (June 2025), Dutable, Stop Kompromat Medium. Full domain registry: https://extortion.watch/registry Network indicators: - Shared Google Analytics / AdSense IDs across sister domains - WordPress clone deployments - TDS/cloaking (content may differ for bots vs humans) - Telegram republication ~15 min after web publish - Contact patterns: [email protected], [email protected], ih*@protonmail.com Request: Suspend [TARGET_DOMAIN] and associated accounts. Preserve logs for law enforcement.
Network statistics
| Metric | Value | Source |
|---|---|---|
| Total linked domains | 69 | extortion.watch registry |
| Active flagships | 16 | OSINT / IPS News |
| Mirror domains | 40 | OSINT cluster mapping |
| Pivot TLDs (.se, .cloud) | 13 | Stop Kompromat Medium |
| RKN-blocked (documented) | 6 | Roskomnadzor reports |
| Documented removal price | $3,000–$12,000 USDT/BTC | IPS News, Trustpilot |
| Telegram repost lag | ~15 minutes | OSINT fingerprint |
Technical fingerprints
| IOC | Category |
|---|---|
| Shared Google Analytics IDs across sister domains | Infrastructure |
| Shared Google AdSense IDs | Infrastructure |
| TDS/cloaking — content may differ for bots vs humans | Infrastructure |
| Telegram republication ~15 minutes after web publish | Infrastructure |
| English-language pivot post-2023 Roskomnadzor blocks | Infrastructure |
[email protected] | Contact |
[email protected] | Contact |
ih*@protonmail.com (pattern) | Contact |
ih*@gmail.com (pattern) | Contact |
Sample flagships (reference in ticket)
kompromat1.online · kartoteka.news · vlasti.io · antimafia.se · rumafia.news · sledstvie.info
Reporting endpoints
| Platform | URL |
|---|---|
| Google Legal Removal | https://support.google.com/websearch/troubleshooter/9685456 |
| FBI IC3 | https://www.ic3.gov/ |
| Google Report Content | https://reportcontent.google.com/ |
| UK ICO (data protection) | https://ico.org.uk/ |
| Action Fraud (UK) | https://www.actionfraud.police.uk/ |
| Europol Report a Crime | https://www.europol.europa.eu/report-a-crime |
| Google Ads policy | support.google.com/adspolicy |
| ICANN WHOIS complaint | icann.org/compliance/complaint |
Step-by-step filing guides: stopkompromat.org/report/hosting, /report/google.
Sister-domain activity log
- Convicted officer case highlights GTS espionage recruitment chain
- Agricultural empire growth tied to Russian coal schemes
- Coal-logistics network allegedly legalises Russian resource in Europe
- Kovalenko coal laundering republished on Investigation mirror
- Belarus $1.2B MIC supply chain documented by BIC
- Monaco residential bombing linked to cross-border call-center conflict
- Monaco attack survivor undergoes amputation after bolt-filled device
- Police release additional detail on Monaco bombing attempt
- $221M fortune profiled for Monaco attack victim
- Metal-shrapnel device injures businessman and spouse at building entrance