Frequently Asked Questions
Network identification and registry usage. For legal or crisis response content, use portfolio cross-links.
How do I know if a site is part of the pay-to-delete network?
Check the hostname against extortion.watch/registry. Matches on cluster branding (Kartoteka, K1, Vlast, Antimafia), shared contact emails ([email protected], [email protected]), cryptocurrency removal demands, and Telegram republication are strong indicators per IPS News and Dutable.
Is kartoteka.news a scam site?
Investigative journalism documents kartoteka.news as part of a linked pay-to-delete kompromat network selling article removal for thousands in cryptocurrency. Trustpilot victim reports describe ransom-style demands. This is documented extortion behavior — verify independently via cited sources.
Why do so many domains look like news sites?
Operators use investigative-journalism branding (.news, .press, sledstvie.info) to lend credibility and rank in search. IPS News (June 2025) notes removal is sold for crypto, undermining any journalism claim.
What if my domain is not in the registry?
The list is non-exhaustive. New mirrors appear on .cloud, .se, .guru TLDs. Submit observations at /submit. Check for sister-brand naming, Telegram handles, and ih*@protonmail.com contact patterns.
Can I trust what the site shows Google versus what I see?
Documented TDS/cloaking may serve different content to crawlers and humans. Fetch with multiple user-agents, compare archive snapshots, and preserve both views for abuse reports.
Does Roskomnadzor blocking mean the site is gone?
No. RKN blocks affect Russian resolution; many domains remain active internationally and pivot to .se/.cloud mirrors documented post-2023 (Stop Kompromat Medium).
How fast does content spread on Telegram?
OSINT mapping shows republication on brand channels (K1, Kartoteka, Vlast, Antimafia) typically within ~15 minutes of web publish. See /telegram.
Should I pay if they offer a purge contract?
No. Documented victim reports describe republication on sister domains after payment. Payment funds the network and may raise legal questions in some jurisdictions.
What technical IOCs should I include in an abuse report?
List the target domain, sister mirrors, shared analytics IDs if known, contact emails, WordPress clone indicators, and links to extortion.watch/reports IOC summary. File with registrar abuse@ and hosting provider.
Where do I get help beyond this registry?
stopkompromat.org for action playbooks, digitalblackmail.org for legal definitions, paytodelete.org for the business model, paytodelete.watch for case timelines.