By Ransom Watch | 12 October 2026 | Evidence review
Most takedown reports fail for a simple reason: they assert a conclusion instead of meeting a standard. Every intermediary in a website's stack has a written or de facto threshold for action, and they are not the same threshold. A report that works at a hosting provider is ignored by a registry; a document that satisfies a registry may not satisfy a search engine. Here is what we have learned, from dated correspondence, about what each desk actually asks for.
The registry wants legal process
ISNIC, the .is registry, told us in writing that it will not suspend a domain on private complaint. Its stated requirement is a court ruling or a request from a competent authority such as the police (tickets #273632, #273671, #273674, September and October 2026). No volume of screenshots, however damning, substitutes for one of those two instruments at that desk.
The practical consequence: a police report is not a courtesy copy, it is the active ingredient. If the registry you face has a similar policy, the police filing is the report that matters, and the registry notice exists to put the outcome of that filing to use.
Search engines want specificity, then a court order
Google and Bing run legal-removal processes that start with exact URLs, not site descriptions: each page to be delisted must be identified individually, with the claimant identified as the subject. For defamation-based removal, both have in our experience escalated to the same demand ISNIC makes: a court order from the relevant jurisdiction. A report filed in early October 2026 against a dossier page ranking first for the subject's name drew, within days, a request for a court order or similar documentation, with a deadline.
Two lessons follow. File with exact URLs from the start; vague reports stall. And treat the search-engine route as parallel to, not instead of, the legal route: the form buys time and a case number, but the court order is the currency.
Hosts want a policy violation they can verify
Hosting providers act under their own acceptable-use policies, and the fastest-moving evidence is a documented payment demand: the original message with full headers, the sender handle, any payment address or wallet, and the dates. That converts "the article is unfair", which a host will not adjudicate, into "this site is being used for suspected extortion", which its policy desk can. Mail (SPF) records can reveal a host the website itself hides, which is how one Frankfurt provider was identified and noticed on 30 September 2026.
CDNs and privacy holders create records, rarely removals
Cloudflare's abuse route typically forwards content complaints to the underlying host. Privacy services such as Njalla can be put on notice but are structured to resist acting on content. At these layers the realistic goal is different: a dated ticket, a logged report (ours: Cloudflare report 1fab23d6df970ef0), and an intermediary on record as knowing what it carries. Those records become exhibits in the court process the other layers demand.
The meta-lesson
Build the evidence pack once, to the highest standard in the chain: dated captures of the page, preserved demands in original form, exact URLs, the mapped stack, a police reference number. Every desk then gets a version of the same pack cut to its threshold, and each refusal is itself dated and quotable. The process rewards documentation over volume. Ten reports asserting a conclusion are worth less than one report meeting a standard.
Ransom Watch documents reported reputation-extortion networks and the evidence around them. This article reflects correspondence and filing outcomes from September and October 2026; intermediary policies change and this is not legal advice. Tips and documents: legal@reputationransom.com. More: reputationransom.com.
Top comments (0)