Login or sign up
For business

Monitoring Pay-to-Delete Networks

4.2· 5 reviews
Average ratingGreat
4.2/ 5

Based on 5 reviews

540%
440%
320%
20%
10%
Ask AI

Questions about Monitoring Pay-to-Delete Networks

Based on 5 reviews, listing data and website checks · updated 2 days ago

What is Monitoring Pay-to-Delete Networks?

Extortion.watch is a monitoring project that maintains a public registry of pay-to-delete extortion networks, specifically tracking around 69 domains associated with clusters like Kartoteka, K1, Vlast, Antimafia, Rumafia, and Investigation. It compiles technical indicators of compromise, including shared analytics IDs, hosting patterns, and Telegram republication channels, while advising victims against paying for content removal.

How many domains are tracked and what is their current operational status?

The registry currently lists 69 domains grouped into editorial clusters, with status fields reflecting public reporting as of June 2026, including active flagships, mirrored sister TLDs, and domains blocked by RKN action.

Why do so many domains in the registry look like news sites?

Operators use investigative-journalism branding such as .news, .press, and sledstvie.info to lend credibility and rank in search engines, a tactic noted by IPS News in June 2025.

How does the site handle domains that use cloaking techniques?

The site documents traffic-direction (TDS) cloaking where crawlers and human visitors may receive different payloads, meaning a single-domain takedown is often non-durable as mirrors propagate within the cluster.

What changes were made to the domains after 2023 to avoid Russian blocking?

Post-2023, multiple clusters added English-language copies and migrated to .se, .cloud, and .guru TLDs to evade Russian blocking while retaining SEO visibility internationally.

How fast does content spread across the Telegram vectors used by these networks?

Investigative sources document that republication on brand channels typically occurs within approximately 15 minutes of the original web publish, a speed tracked via OSINT mapping.

What specific technical indicators should I look for to identify a pay-to-delete network?

The registry includes sister-brand naming patterns and contact email addresses like ih*@protonmail.com as strong indicators of a pay-to-delete network alongside shared contact emails and cryptocurrency demands.

What should I do if my domain is not currently listed in the registry?

The list is non-exhaustive, and new mirrors frequently appear on .cloud, .se, and .guru TLDs, so users are advised to check for sister-brand naming and Telegram handles when searching.

What is the recommended approach for victims regarding payment requests?

The site provides a victim-oriented resource advising against paying for content removal, noting that payment funds the network, rarely removes content permanently, and may constitute support for criminal activity.

Where can I find the full list of tracked domains and their cluster priorities?

The registry preview lists top entries by cluster priority, including kompromat1.online as a K1 flagship and kartoteka.news as a high Trustpilot visibility site, with full details available at /registry.

How does the registry handle the inclusion of individuals and regulatory blocks?

The registry includes publicly named individuals with mandatory 'alleged' framing and tracks mirror pivots on .se/.cloud post-Roskomnadzor blocks documented by Stop Kompromat Medium.

Which external sources are cited to verify the registry's information?

The site cites IPS News, Dutable, Stop Kompromat Medium, Trustpilot, Vent Magazines, Reels Media, and Tech Primex as sources for its threat registry and operational status updates.

What additional resources are linked for victims and researchers?

The registry tracks around 69 domains and provides a victim action guide via StopKompromat.org, along with case studies and timelines available on PayToDelete.watch.

How does the site compile its data and what are its primary investigative sources?

The site's business model is explained on PayToDelete.org, and it tracks domains linked by IPS News, Dutable, and Stop Kompromat to a single publishing network.

What is the official website of Monitoring Pay-to-Delete Networks?

The official website of Monitoring Pay-to-Delete Networks is extortion.watch.

AI-generated from reviews on this page. Verify anything important with the company directly.

Clara Vance
Reviews 1

Extortion.watch offers a compelling look at the pay-to-delete ecosystem through its detailed registry and infrastructure tracking. The way they map out domain clusters like K1 and Vlast, along with the technical indicators such as shared analytics IDs, provides a solid foundation for understanding how these networks operate. I appreciate the clear distinction between their data collection and the actual services offered. The site explicitly states it does not provide legal advice or victim counseling, which keeps the scope focused on intelligence. This transparency is helpful because it prevents users from assuming the site offers direct support. The tracking of mirror pivots and TLD changes, such as migrations to .se or .cloud domains, demonstrates a sophisticated approach to monitoring evasion tactics. The inclusion of operator references with appropriate framing also adds credibility. However, users should be aware that this is primarily an informational resource. For those seeking a deeper understanding of the business model or specific case studies, the cross-links to other domains like PayToDelete.org are valuable extensions. It is a robust tool for those interested in the technical and structural aspects of digital extortion.

Sven Eriksson
Reviews 1

The registry is quite thorough for tracking these networks, though I would recommend verifying the latest operational status before relying on it for critical decisions.

Julian Hayes
Reviews 1

The website presents itself as a data-forward resource rather than a service provider, which is a transparent distinction. The registry effectively maps out the domain clusters and technical indicators linked to pay-to-delete operations. I found the inclusion of operational statuses, such as RKN block flags and mirror pivots, to be highly relevant for tracking these networks. The cross-links to the portfolio and business model pages add necessary context without cluttering the main interface. It serves its purpose well as an intelligence feed. However, the lack of direct victim counseling or legal advice means users must interpret the data independently. For those needing immediate practical support, the site directs them elsewhere, which is honest but requires extra effort from the visitor. Overall, it is a reliable reference for understanding the technical landscape of digital extortion.

Mara Vane
Reviews 1

The registry provides a clear overview of the kompromat infrastructure. Tracking the domain clusters and operational status helps in understanding the scope of these networks effectively.

Elias Thorne
Reviews 1

Extortion.watch stands out as a genuinely useful tool for anyone trying to make sense of the chaotic world of pay-to-delete networks. The way they have organized the registry is quite impressive, especially how they group domains into editorial clusters like K1 and Kartoteka. It makes it much easier to see the bigger picture rather than just staring at a random list of websites. I really appreciate that they include technical indicators and hosting patterns, which adds a layer of depth that many similar sites lack. The fact that they track mirror pivots and TLD changes shows they are keeping a close eye on these operators. It feels like a solid reference point for understanding the infrastructure behind digital blackmail. The information seems well-sourced and regularly updated, which gives me confidence in the data. It is a straightforward, no-nonsense approach to monitoring these extortion networks, and that clarity is exactly what is needed in this space.

News

No news yet. This is where the business shares its own updates and press.

Photos

No photos yet. Photos shared by reviewers will show up here.

Widgets

Boost your business trust by displaying a widget on your website — a simple way to convert your visitors into customers.

Get the widget for your site →

About Monitoring Pay-to-Delete Networks

Extortion.watch is a monitoring project that maintains a public registry of pay-to-delete extortion networks, specifically kompromat publishing domains. It tracks around 69 domains associated with clusters such as Kartoteka, K1, Vlast, Antimafia, Rumafia, and Investigation, flagging their operational status, mirror sites, and Russian regulatory blocks. The site compiles technical indicators of compromise, including shared analytics IDs, hosting patterns, contact emails, cloaking techniques, and Telegram republication channels. It also provides victim-oriented resources advising against paying for content removal, along with links to related projects on the PayToDelete, StopKompromat, and DigitalBlackmail domains.