DEV Community: Ransom Watch

The counter-attack: documented tactics dossier operations use against removal

Ransom Watch — Tue, 13 Oct 2026 11:58:26 +0000

By Ransom Watch | 13 October 2026 | Evidence review

Targets of dossier sites tend to imagine removal as a request: prove the article false, and someone takes it down. Documented cases show something else - a playbook of counter-measures that begins the moment a target pushes back. Knowing the plays in advance is most of the defense.

The forged-order claim

In Goldstone Financial Group LLC and Anthony Pellegrino v. FinanceScam.com (N.D. Ill., case 1:25-cv-07283), the complaint describes a striking move: FinanceScam publicly asserted that the plaintiff and "his reputation managers" had sent a forged court order to the site's hosting provider - an accusation the complaint states is false. The documented effect is the point. The moment a target seeks removal, the operation reframes the removal effort itself as the fraud, and the target must now defend the legitimacy of his own paperwork in addition to his name.

How one post becomes many

The New York Times' investigation of the slander industry documented how a post multiplies: a constellation of copy sites duplicates it, and removal is then priced per post. For a target, every copy is one more search result to chase and one more item a removal service can price. The duplication is documented in the reported cases; new posts cost the operation very little.

The reprice

In the case this project monitors directly, businessman Priven Reddy states that demands following articles about him moved from $50,000 to $5,000 and then to a monthly fee when he refused. We have not independently established who sent those demands and do not claim that any particular site sent them. The documented shape, across his account and the reported cases above, is consistent: refusal is treated not as an answer but as a negotiation position, and the price adjusts until it finds the number a target will pay to make the pressure stop.

What this means for a target

Three practical conclusions follow. First, expect the removal request itself to be attacked; every notice you send should be factual, dated and written as if a judge will read it, because one may. Second, never fabricate anything - not a document, not a claim, not an affiliation. A single false item hands the operation the defense it wants, and the Goldstone docket shows exactly how that defense is used. Third, use the instruments with documented effect. ISNIC, the .is registry, states in its published domain rules that it closes a domain on a court decision or a final ruling of a competent body, or on a police request made after a court ruling. And in the Goldstone case it was a court, not a complaint, that acted against the operation: a temporary order finding likelihood of success on claims including cybersquatting, defamation per se and trade libel, then a default judgment awarding $100,000 in statutory damages on each of the eight cybersquatted domains. The documented cases point to formal instruments, not outrage. In our reading, the counter-attack playbook feeds on emotional reaction; a dated record and a court filing give it much less to work with.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Court references are to the public docket in case 1:25-cv-07283 (N.D. Ill.); statements attributed to Mr Reddy are his account, given on the record. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

When they name your family: the harassment layer of reputation ransom

Ransom Watch — Tue, 13 Oct 2026 11:52:34 +0000

By Ransom Watch | 13 October 2026 | Evidence review

The article is the visible half of a reputation-ransom operation. The other half is the approach - and the approach frequently does not stop with the target. Documented cases and victims' accounts describe pressure widened to family, friends and business contacts. That widening is not incidental. It is the mechanism that converts embarrassment into fear.

A dated example

One target of the live dossier site letmeexpose.is, businessman Priven Reddy, states that after articles about him appeared he was contacted repeatedly with demands for payment. A screenshot he has shared, dated 10 November 2025, shows a sender identifying itself as "financescam" threatening his family and friends and setting a 24-hour deadline. We have reviewed that screenshot. We have not independently established who operated that sender identity, and we do not claim that any particular site sent it. What is documented is the shape of the message: not a dispute about facts, but a threat against the people around him, on a clock.

A documented pattern

The widening shows up beyond one case. The New York Times' investigation of the slander industry documented how a single post multiplies across a constellation of copy sites, with removal then priced per post. In victims' accounts across this reporting, spouses, children, colleagues and investors are named precisely because they are the people a target cannot shield from a search result. The publisher's leverage, in these accounts, is not only the article. It is the target's relationships.

Why this layer matters

A defamation dispute is about whether statements are true. What the documented cases describe goes further: anonymous publication, followed by contact, followed by priced removal, followed by threats aimed at the people a target loves. In victims' accounts, that sequence is the point where the demand stops sounding like a business offer and starts sounding like what it is reported to be - extortionate pressure with a reputation as the hostage. Families are not bystanders in this model. They are part of the delivery mechanism, and they deserve to be told what may arrive before it arrives.

What we advise

Preserve originals: messages, headers, dates, sender identities, exactly as received. Do not reply from an address that reveals more than the sender already has. Report threats to the police where you live, and keep the reference number - a dated report is where the formal record starts. The .is registry ISNIC, for example, states in its published rules that it acts on a court decision or on a police request made after a court ruling. And tell your family early. The first person a threatened spouse should hear about this from is you.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Statements attributed to Mr Reddy are his account, given on the record. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

Dead, parked, for sale: what one dossier network's infrastructure shows today

Ransom Watch — Tue, 13 Oct 2026 11:52:02 +0000

By Ransom Watch | 13 October 2026 | Evidence review

Domains in this ecosystem are disposable, and their states change. The useful habit is not to celebrate a dead domain or despair at a live one, but to read the board on a date and say exactly what is on it. These are the dated readings for the set of sites associated in reporting and in court records with the dossier ecosystem we monitor, checked on 13 October 2026.

The board as of 13 October 2026

Two names fail to resolve at all: financescam.com and intelligenceline.com return DNS failures, and have for some time - the failure of financescam.com predates our formal notices, and we do not attribute it to any action of ours. Two names redirect to for-sale listings: criticalintel.com and proconsumer.com both land on a domain marketplace page offering the name for purchase. One, cybercriminal.com, is parked with a domain broker. Two remain live and publishing: fintelegram.com and letmeexpose.is.

What each state means

A DNS failure means the name currently answers nothing: expired, broken or withdrawn - the cause is not knowable from outside, and we do not guess it. A parked or for-sale name is inventory: someone holds it as an asset, and it can be reactivated or sold at any time. A live site is the only state that is actively publishing. Everything else is storage.

That distinction matters for how "progress" is counted. A network shedding names is not a network dismantled. The content a dead domain carried persists in archives and reposts, and a for-sale name can return under new management. In the public record of this ecosystem, the remedies with force behind them were not notices or complaints. They were court orders: in Goldstone Financial Group LLC and Anthony Pellegrino v. FinanceScam.com (N.D. Ill., case 1:25-cv-07283), a temporary order found a likelihood of success on claims including cybersquatting, defamation per se and trade libel, and the court's default judgment awarded $100,000 in statutory damages for each of the eight cybersquatted domains named in the complaint.

Why we publish the readings

Claims about takedowns decay fast; dated observations do not. We re-run these checks daily, and we will report the day any name on this board changes state - a dead domain answering again, a parked domain going live, a live domain going dark. The record, not the mood, is the measure.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Court references are to the public docket in case 1:25-cv-07283 (N.D. Ill.), courtlistener.com/docket/70655954. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

Three documented business models, one pressure point: the market around reputation ransom

Ransom Watch — Tue, 13 Oct 2026 11:46:58 +0000

By Ransom Watch | 13 October 2026 | Evidence review

Reputation harm for money is not one industry. Independent reporting over the past several years documents at least three distinct business models that turn a person's name into revenue. They differ in scale, clientele and technique. What they share is the pressure point: a search result a target cannot easily ignore.

The removal market

The New York Times' investigation of what it called the slander industry documented operators whose business begins where damaging posts appear. In one reported case, removal of 17 posts was quoted at $14,800; in another, total removal costs reached roughly $20,000. The same reporting documented how posts multiply as a constellation of copy sites duplicates them. The article is the hook; the removal fee is the product.

The reputation-laundering market

The Washington Post's investigation of Eliminalia, a Spain-based reputation firm, reported close to 1,500 clients over six years and roughly $2.7 million in declared revenue in 2020-21, earned in part from disinformation services. This was a different operation with a different model: clients paid to reshape what search results said about them, not to escape a demand. It matters here for one reason - it demonstrated, with company records, that the manipulation of name-based search results is a multimillion-dollar, international commercial activity, not a fringe practice.

The commissioned dossier

Jack Poulson's July 2026 investigation of Investigations.org reported paid crypto dossiers: commissioned negative articles about a chosen subject, purchasable in cryptocurrency. Here the article itself is the product, sold to whoever wants a target damaged. Content first, payment first in fact - the pressure on the subject is the deliverable.

What this does and does not establish

The three models are documented separately, by separate newsrooms, and we do not claim they are connected to each other or to the specific sites this project monitors. What they establish together is narrower and more useful: a functioning market exists in which anonymous damaging content, name-targeted search placement and payment demands combine into repeatable mechanics. When a new dossier site appears with the same shape - content first, contact second, payment demanded - it is not an anomaly to be explained away. It is an instance of a documented pattern, and it can be documented in turn.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Figures cited are from the published reporting named above. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

Why one dossier article can outrank everything true about you

Ransom Watch — Tue, 13 Oct 2026 11:46:46 +0000

By Ransom Watch | 13 October 2026 | Evidence review

A single anonymous page, on a domain with no author and no address, can rank first for a person's name - above a career, a company record and decades of real presence. This is not an accident of quality. It is consistent with how search tends to treat a little-contested name - and exploiting that tendency is, in our reading, what a dossier page is built for.

Why it ranks

A private person's name tends to be a thin search term: few pages are written about one individual, so a page built specifically to target that name can face little competition for it. The dossier pages we monitor are engineered for exactly this: the name in the title, the name in the address, the name repeated through the text. That is our reading of the mechanics behind the observation below - an interpretation, not a finding by any search engine or court.

The dated observation in the case we monitor: as of 6 October 2026, the letmeexpose.is article about businessman Priven Reddy ranked first for his name, above his own LinkedIn profile. One anonymous page, outranking the verified record of a public business career.

The routes that exist

Both major search engines run formal removal routes, and both are in dated use in this case.

A legal-removal request was filed with Google on 6 October 2026 by the subject himself, from his own account. A content-review request was filed with Microsoft's Bing the same day; it was acknowledged on 6 October at 12:02 under case SIR24809672, and Microsoft's content team asked on 7 October for a court order or similar documentation to support the request. Each route has its own bar, and the correspondence is a dated record either way.

What a search fix is - and is not

A delisting removes a page from search results. It does not remove the page from the site, and the site we monitor remains live as of this writing. Search action changes what a stranger finds; it does not change what the publisher holds. Both matter, and they are different jobs: the search layer decides visibility, the infrastructure layer decides existence. Anyone promised that one fixes the other is being sold something.

It is also worth knowing that a documented market trades on exactly this confusion. The New York Times' investigation of the slander industry reported removal offers priced in the thousands of dollars - in one case a $14,800 quote covering 17 posts - from operators whose business begins where the articles appear. A target offered paid removal by parties connected to the publisher is not being offered a service. In the documented cases, that is the second half of the same transaction.

What we advise

File both search routes, keep the case numbers, and date everything. Treat any unsolicited offer of paid removal as evidence, not help: preserve it with its headers and its date. And remember the ordering - a granted delisting removes the article from that engine's results for the queries it covers, while it stands; the notice trail, the police report and the court route are what address the operation behind it.

Six markers that an "exposure" article is a dossier product, not journalism

Ransom Watch — Mon, 12 Oct 2026 09:52:40 +0000

By Ransom Watch | 12 October 2026 | Evidence review

The sites documented in reputation-ransom cases are designed to pass a five-second credibility test. They borrow the vocabulary of consumer advocacy and financial-crime reporting: "watchdog", "alert", "why people should be cautious". Readers encountering one article in isolation, as a search result, have no frame of reference. These six markers, drawn from sites named in court filings and investigations we have reviewed, are that frame of reference.

1. No masthead, no names

Legitimate watchdog and investigative outlets name their reporters, editors and organisation, because accountability is their product. Dossier sites publish under the site's own voice, unsigned. If every article on a site is bylined to the site itself, or to rotating generic personas, the reader has no author whose record can be checked. That is a design choice, and it is the first marker.

2. Real events, missing outcomes

The effective dossier article does not invent events; it truncates them. A dispute is described but not its settlement. A case is cited but not its result. In one documented example, an article references a domain dispute, an arson attack and an insolvency matter involving businessman Priven Reddy, while omitting that the domain was handed over voluntarily, that he was the arson victim who reported it to police, and that the insolvency matter was defended and won. Every sentence can be technically true while the article is false. Check whether the article tells you how each story ended. If none of the stories have endings, you are reading a dossier.

3. The verdict is in the headline

"Why people should be cautious." "What you need to know before dealing with." Journalism reports; dossier products instruct. When the headline delivers a conclusion about a named private individual and the body supplies atmosphere rather than evidence, the article is performing a warning, not documenting one.

4. A registration designed to be unhelpful

Look up the domain. Dossier sites cluster behind privacy registration services and extensions whose registries require court process to act, and behind CDNs that shield the host. None of this is illegal and all of it has legitimate uses, but the combination, on a site that also publishes unsigned accusations, means the reader cannot learn who is speaking. Anonymous speech is a right; anonymous accusation presented as consumer protection deserves scrutiny proportional to its anonymity.

5. A target list, not a beat

Real outlets have a beat: an industry, a region, a subject. Dossier sites publish about whoever appears in the funnel: a financier one week, a software founder the next, a doctor the week after, across unrelated countries. In documented cases the same small cluster of sites recurs across unrelated targets, sometimes cross-citing each other to simulate corroboration. If a "watchdog" site's only consistent subject is people, rather than a field, treat it accordingly.

6. The demand that follows

The final marker is not on the page. In documented cases, publication is followed by contact: a proposal that the content can be removed for payment, sometimes repriced downward when refused, sometimes converted to a monthly fee. A complaint filed in the Northern District of Illinois in June 2025 described this as a paid removal program; a July 2026 investigation by Jack Poulson reported another site offering commissioned dossiers payable in cryptocurrency. An article followed by an invoice is not journalism with a business model problem. It is the business model.

The use of these markers

None of these markers alone convicts a site; legitimate outlets can be anonymous-critical, privacy-protected or blunt. But six out of six is not a coincidence, it is a template. If you find an article about yourself or a partner that fits the template, preserve it with dates before doing anything else, and compare it against the documented cases. You are unlikely to be the template's first subject, and the record built by earlier targets is the strongest thing you can stand on.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Court and investigation references are to Goldstone Financial Group LLC v. FinanceScam.com, No. 1:25-cv-07283 (N.D. Ill.) and Poulson's July 2026 reporting. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

"This article is fake" is not a report. What each intermediary actually requires to act.

Ransom Watch — Mon, 12 Oct 2026 09:47:04 +0000

By Ransom Watch | 12 October 2026 | Evidence review

Most takedown reports fail for a simple reason: they assert a conclusion instead of meeting a standard. Every intermediary in a website's stack has a written or de facto threshold for action, and they are not the same threshold. A report that works at a hosting provider is ignored by a registry; a document that satisfies a registry may not satisfy a search engine. Here is what we have learned, from dated correspondence, about what each desk actually asks for.

The registry wants legal process

ISNIC, the .is registry, told us in writing that it will not suspend a domain on private complaint. Its stated requirement is a court ruling or a request from a competent authority such as the police (tickets #273632, #273671, #273674, September and October 2026). No volume of screenshots, however damning, substitutes for one of those two instruments at that desk.

The practical consequence: a police report is not a courtesy copy, it is the active ingredient. If the registry you face has a similar policy, the police filing is the report that matters, and the registry notice exists to put the outcome of that filing to use.

Search engines want specificity, then a court order

Google and Bing run legal-removal processes that start with exact URLs, not site descriptions: each page to be delisted must be identified individually, with the claimant identified as the subject. For defamation-based removal, both have in our experience escalated to the same demand ISNIC makes: a court order from the relevant jurisdiction. A report filed in early October 2026 against a dossier page ranking first for the subject's name drew, within days, a request for a court order or similar documentation, with a deadline.

Two lessons follow. File with exact URLs from the start; vague reports stall. And treat the search-engine route as parallel to, not instead of, the legal route: the form buys time and a case number, but the court order is the currency.

Hosts want a policy violation they can verify

Hosting providers act under their own acceptable-use policies, and the fastest-moving evidence is a documented payment demand: the original message with full headers, the sender handle, any payment address or wallet, and the dates. That converts "the article is unfair", which a host will not adjudicate, into "this site is being used for suspected extortion", which its policy desk can. Mail (SPF) records can reveal a host the website itself hides, which is how one Frankfurt provider was identified and noticed on 30 September 2026.

CDNs and privacy holders create records, rarely removals

Cloudflare's abuse route typically forwards content complaints to the underlying host. Privacy services such as Njalla can be put on notice but are structured to resist acting on content. At these layers the realistic goal is different: a dated ticket, a logged report (ours: Cloudflare report 1fab23d6df970ef0), and an intermediary on record as knowing what it carries. Those records become exhibits in the court process the other layers demand.

The meta-lesson

Build the evidence pack once, to the highest standard in the chain: dated captures of the page, preserved demands in original form, exact URLs, the mapped stack, a police reference number. Every desk then gets a version of the same pack cut to its threshold, and each refusal is itself dated and quotable. The process rewards documentation over volume. Ten reports asserting a conclusion are worth less than one report meeting a standard.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. This article reflects correspondence and filing outcomes from September and October 2026; intermediary policies change and this is not legal advice. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

Four companies stand between a dossier site and its readers. Each one is a lever.

Ransom Watch — Mon, 12 Oct 2026 09:45:09 +0000

By Ransom Watch | 12 October 2026 | Evidence review

Anonymous "exposure" sites present themselves as voiceless operations: no masthead, no named authors, no office. But a website is not anonymous infrastructure. Between the person who writes the article and the person who reads it sit a chain of identifiable companies, each selling a different layer of the stack, each with its own abuse policy and its own legal exposure. Mapping that chain is the first technical step in any response. Here is the chain behind one live dossier site, letmeexpose.is, as we documented it in September and October 2026.

Layer 1: The registry

Every domain sits inside a registry, the organisation that operates the extension itself. For letmeexpose.is that is ISNIC, the registry for Iceland's .is. The registry is the deepest lever: it can suspend the name entirely, making the site unreachable at that address regardless of who hosts it.

ISNIC's position, stated in writing in response to our formal notice (tickets #273632, #273671, #273674), is that it acts on a court ruling or a request from a competent authority such as the police. That makes the registry a slow lever but a decisive one, and it explains why experienced operators choose extensions whose registries demand legal process: it buys them time.

Layer 2: The registration and its privacy holder

A domain must be registered to someone. Dossier operators rarely register in their own names. The holder of record for letmeexpose.is is Njalla, a privacy service that registers domains on customers' behalf and sits in the record in their place. This is a legal service with legitimate uses, but in practice it means the public record names an intermediary, not the operator.

A privacy holder can be formally noticed, as Njalla was on 30 September 2026. Whether it acts is a separate question, but the notice establishes that the intermediary knew what its service was carrying, and when.

Layer 3: The CDN

Most dossier sites sit behind a content delivery network, commonly Cloudflare, which serves the site's pages from its own network and shields the true hosting server from casual inspection. Cloudflare's abuse process generally forwards content complaints onward rather than adjudicating them, but its report route creates a dated record (ours is logged as report 1fab23d6df970ef0) and the act of reporting sometimes surfaces the origin provider behind the shield.

Layer 4: The host

Somewhere behind the CDN is a server. Finding it takes more than a browser: in this case the site's own mail (SPF) records pointed to UltaHost / First Colo in Frankfurt, a provider the website layer alone did not reveal. The host is the most practical lever. Hosting companies run acceptable-use policies, and documented payment demands attached to a site are the kind of evidence those policies are written for. The host received formal notice on 30 September 2026.

What the stack view changes

Each layer controls a different lever: the registry controls the name, the privacy holder controls the record, the CDN controls delivery, the host controls the server. A report that asks the wrong layer for the wrong remedy fails; one that asks each layer for what it alone can do builds a record that converges. And when one layer finally acts, the dates on the notices show who acted early and who waited.

For targets, the lesson is procedural: before reporting anything, map the stack. The registry is in the RDAP record. The CDN and host can be identified from DNS and mail records. None of it requires specialist tools, only the knowledge that the chain exists and that every link in it is a company with a log of its own.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Technical details above were recorded from public DNS, RDAP and mail records in September and October 2026; infrastructure can change. Tips and documents: legal@reputationransom.com. More: reputationransom.com.

The money ladder: how removal demands escalate in documented reputation-ransom cases

Ransom Watch — Mon, 12 Oct 2026 09:38:06 +0000

By Ransom Watch | 12 October 2026 | Evidence review

The article is the visible half of a reputation-ransom operation. The other half is the approach: a message, sometimes from the site, sometimes from a third party offering help, proposing that the problem can be made to disappear for a price. Documented cases show that price moving in a consistent direction. It starts high, drops when refused, and converts to a subscription.

One subject's ladder

A subject of articles on the live dossier site letmeexpose.is, businessman Priven Reddy, states that after articles about him appeared he was contacted multiple times with demands for payment to remove posts. The sequence he describes: first $50,000, then $5,000, then a monthly fee, with further articles threatened if he did not pay. He declined at every step.

One demand from this sequence exists in dated form. A screenshot he has shared, dated 10 November 2025, shows a sender identifying itself as "financescam" threatening his family and friends and setting a 24-hour deadline. We have reviewed that screenshot. We have not independently verified who operated that sender identity, and we do not claim that any particular site sent it. What is documented is the shape of the demand and the timing: negative articles appeared, and payment demands followed.

The same shape in court records and investigations

The ladder is not unique to one case. In Goldstone Financial Group LLC and Anthony Pellegrino v. FinanceScam.com, filed 27 June 2025 in the Northern District of Illinois, the complaint described a paid program for removing adverse content, referred to as a "Citizen Advocacy Program". On 16 October 2025 the court entered an $800,000 civil default judgment against FinanceScam.com on theories including defamation per se and false light, and ordered eight impersonating domains transferred to the plaintiffs.

Jack Poulson's July 2026 investigation of Investigations.org reported paid crypto dossiers offered by that site: commissioned negative articles, purchasable in cryptocurrency. Again: content first, payment structure attached.

Across these documented cases the mechanic repeats. An opening figure large enough to anchor the negotiation. A discount, to convert refusal into a bargain. Then the recurring fee, which converts a one-time payment into permanent exposure: pay monthly, or new articles appear.

Why paying does not end it

The ladder's last rung is the tell. A publisher selling a one-time removal sells something that ends. A publisher proposing a monthly fee is describing a business model in which the target is the customer and the article is the product, restocked as needed. In the documented sequence above, refusal of the first figure did not end the contact; it repriced it. Payment, on the same logic, does not retire the threat. It confirms the target responds to it.

There is a second cost. A target who pays has usually paid anonymously, without a receipt, to a party that cannot be named later. The payment buys no enforceable promise and no evidence. The demand itself, preserved, is worth more: full headers, sender handle, payment address or wallet, and dates. That is the material abuse desks, registries and police can act on.

What we advise documenting

If a demand follows an article about you: preserve it in original form before anything else. Do not reply from an address that reveals more than the sender already has. Do not pay without independent advice. And record the ladder: if the price moves, the dates and amounts of each step are themselves evidence of the model at work.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Statements attributed to Mr Reddy are his account, given on the record; court references are to the public docket in No. 1:25-cv-07283 (N.D. Ill.). Tips and documents: legal@reputationransom.com. More: reputationransom.com.

We formally notified every service behind one dossier site. Here is what each one did, with dates.

Ransom Watch — Mon, 12 Oct 2026 09:37:49 +0000

By Ransom Watch | 12 October 2026 | Evidence review

Targets of anonymous "exposure" sites are often told that reporting is pointless: the publisher is hidden, the domain is offshore, nobody is responsible. That is not quite true. A website is a stack of services, and each layer has an operator that can be named, notified and put on the record. We recently ran that process end to end against one live dossier site, letmeexpose.is, on behalf of one of its subjects. This is the dated record of what each service did when formally noticed.

The notices

On 30 September 2026, formal notices went from our legal mailbox to every operator in the site's stack:

ISNIC, the registry for Iceland's .is extension, received a formal notice and a supplement with case law. Its replies, logged under tickets #273632, #273671 and #273674, declined to suspend the domain. ISNIC's stated position is that it acts on a court ruling or a request from a competent authority such as the police, not on private complaint.
Njalla, the privacy service listed as the domain's holder of record, received a notice and an evidence supplement including the subject's own statement.
Cloudflare, the content delivery network in front of the site, received an abuse report, logged as report 1fab23d6df970ef0. Cloudflare's abuse process typically routes content complaints to the underlying host rather than acting on the content itself.
UltaHost / First Colo, the hosting provider identified through the site's mail (SPF) records, received a notice on 30 September.
The Icelandic police received a cybercrime tip with a screenshot supplement the same day, filed through a no-login reporting route. Of all the notices, this is the one aimed at the trigger ISNIC itself says it requires.

Also on 30 September, GoDaddy, which was approached about three other domains associated in reporting with the same ecosystem, declined to act: those domains were dead or parked, leaving nothing for a registrar to suspend.

What the responses establish

Three things, all documented.

First, every operator in the stack is now formally on notice, with ticket numbers and dated correspondence. Whatever happens next happens with their knowledge. That matters legally and it matters practically: abuse desks process queues, and a notice with a ticket reference is a record that can be escalated, quoted to a court and cited to journalists.

Second, the registry has stated its bar in writing. ISNIC will act on a court ruling or a police request. That is a high bar, but it is a defined one, and it converts the problem from "convince a company" into "obtain one of two specific instruments." The police tip filed on 30 September is directed at exactly that.

Third, the site remains live as of this writing. That is worth stating plainly, because notice campaigns are often described as takedowns. They are not. They are the first dated entries in a record.

Why publish this trail

Most targets never learn which levers exist, and most services never hear from targets at all. A dated notice trail does two jobs at once: it shows targets that the stack can be mapped and notified in a single day, and it shows the services that their response, or silence, is part of a public record.

We will update this record as replies arrive. If a court ruling or police response changes any provider's position, the dates here will show how long each layer held out after being formally told what it was carrying.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Records reviewed September and October 2026; ticket numbers and report IDs quoted above are from our own correspondence. Tips and documents: legal@reputationransom.com. More: reputationransom.com.