kartoteka.news live site Flagship publisher domain cited across investigative reporting and victim complaints.
Inspect sourceExtortion.watch — Monitoring Pay-to-Delete Networks
Threat registry for documented kompromat pay-to-delete infrastructure. Domain clusters, mirror pivots, and technical indicators compiled from public OSINT and investigative reporting.
Extortion.watch tracks domains linked by IPS News (June 2025), Dutable, and Stop Kompromat (Medium) to a single publishing network. Victims searching a hostname — e.g., kartoteka.news, kompromat1.online, vlasti.io — can cross-check entries here before engaging operators.
The registry currently lists 66 domains grouped into editorial clusters (K1, Kartoteka, Vlast, Antimafia, Rumafia, Investigation, and others). Status fields reflect public reporting as of June 2026: active flagships, mirrored sister TLDs, pivot domains on .se/.cloud post-Roskomnadzor blocks, and blocked where RKN action is documented.
Registry scope
- Domain inventory — hostname, cluster, language, RKN block flag, operational status
- IOCs — shared analytics IDs, hosting patterns, contact emails, cloaking/TDS warnings
- Telegram vectors — republication channels with ~15-minute lag after web publish
- Operator references — publicly named individuals with mandatory "alleged" framing
Post-2023, multiple clusters added English-language copy and migrated to .se, .cloud, and .guru TLDs to evade Russian blocking while retaining SEO visibility internationally. Investigative sources document traffic-direction (TDS) cloaking: crawlers and human visitors may receive different payloads. Treat any single-domain takedown as non-durable — mirrors propagate within the cluster.
This site is data-forward. It does not provide legal advice or victim counseling. For response playbooks, see portfolio cross-links. For narrative case documentation, see paytodelete.watch. For the underlying business model, see paytodelete.org.
Registry preview
Top entries by cluster priority. Full table: /registry.
| Domain | Cluster | Language | RKN | Status | Notes |
|---|---|---|---|---|---|
| kompromat1.online | K1 flagship | RU/EN | Yes | active | Flagship kompromat portal |
| kompromat1.one | K1 mirror | RU/EN | No | mirrored | — |
| kartoteka.news | Kartoteka | RU/EN | Yes | active | High Trustpilot visibility |
| kartoteka.press | Kartoteka | RU/EN | No | mirrored | — |
| vlasti.io | Vlast | RU/EN | Yes | active | — |
| vlst.live | Vlast | RU/EN | No | mirrored | — |
| vlast.guru | Vlast | RU/EN | No | mirrored | — |
| antimafia.se | Antimafia | RU/EN | Yes | active | .se pivot post-RKN |
| antimaf.pro | Antimafia | RU/EN | No | mirrored | — |
| rumafia.news | Rumafia | RU | Yes | active | — |
View full registry (66 domains) →
Visual intelligence feed
Live publisher pages, investigative reports, and complaint archives used to verify cluster membership before you engage operators.
kartoteka.news live site 
kompromat1.online portal Primary K1 cluster domain linked to Telegram republication and purge offers.
Inspect source
Dutable infrastructure report Shared analytics IDs and WordPress clone patterns across the network.
Inspect source
Trustpilot complaint volume Public reviews documenting crypto removal demands and re-post cycles.
Inspect source