Google Search Engineering in Pay-to-Delete Networks
Investigative OSINT and victim reporting describe two overlapping publishing ecosystems — the classic pay-to-delete kompromat network (kartoteka.news, kompromat1.online, 60+ mirrors) and the Hab media cluster (crime.hab.media, corruption.hab.media, authors.hab.media, comments.hab.media) — both engineered for continuous Google indexation. This analysis documents the tactics. Allegations are labeled as such throughout.
The operational goal
Both ecosystems treat Google as the primary distribution channel. An article that ranks on page one for {victim name} + fraud is more valuable than any print circulation figure. Operators do not wait for readers to visit their homepage — they push content into search results where victims, employers, and clients will find it involuntarily. The Hab cluster extends this model to investigative-style crime and corruption reporting; the kompromat network applies it directly to individual extortion targets.
Hab news factory: 265 articles in eight days
Between 22 and 30 June 2026 alone, the Hab cluster published 265 articles across four verticals — an average of 33 articles per day. This is not journalism in the traditional sense; it is a content factory engineered for search-engine surface multiplication.
- Shared CMS pushes identical sidebar "latest news" across crime, corruption, authors, and comments subdomains
- Breaking stories receive 5–10 follow-up articles within hours, each a new crawlable URL
- Long-form investigations on authors.hab.media are syndicated as breaking snippets on crime.hab.media
- comments.hab.media adds official-reaction framing that links back to crime/corruption primaries
- hab.media hub aggregates category teasers, creating a fifth index layer
- War and news subdomains (visible from hub) add geopolitical content that attracts high-volume search traffic
Google freshness signal: The operational goal is continuous freshness signals: Google rewards frequently updated domains. By publishing dozens of articles daily — even on unrelated enforcement miscellany — the cluster maintains crawler visit frequency and domain authority that benefits all verticals, including those carrying reputational extortion-adjacent investigative content.
Burst publishing examples (Jun 2026 scan)
| Subject | Articles | Window | Vertical |
|---|---|---|---|
| Monaco / Yermolaev | 7 | 16 hours | crime.hab.media |
| Kovalenko / Granova coal | 15+ | 7 days | crime + corruption |
| GSPartners / Heit | 10+ | 2 days | crime (DE + EN) |
| Favbet / Matyukha | 3 | 6 days | crime + authors |
Google indexing tactics
Sequential numeric article IDs
Every Hab vertical uses the pattern `{id}-{transliterated_slug}` (e.g. crime.hab.media/245119-jocip_heits_gspartners...). IDs increment daily — 245125 on 30 Jun 2026 alone. Each new ID is a fresh URL Google can crawl independently, even when the underlying story is unchanged.
- crime.hab.media homepage pagination
- JSON-LD datePublished on each article
Burst publishing on breaking stories
When a high-search-interest subject appears (Monaco bombing, billion-dollar fraud), the CMS publishes 5–10 articles in under 24 hours — each with a distinct headline, slug, and OG image. This floods Google News and standard search with multiple entry points for the same entity name, displacing organic results and any negative coverage about the publishers themselves.
- 7 Monaco articles 29–30 Jun 2026
- IPS News describes identical pattern on kompromat1.online
Same story, multiple language URLs
Kovalenko coal-laundering and GSPartners fraud appear as separate URLs in Ukrainian, English, German, Polish, and French — without hreflang linking. Each language variant multiplies indexable surface area. A subject searching in any EU language may encounter Hab reporting before official court records.
- 245049 (DE) + 245119 (EN) for GSPartners
- 245087 (PL) + 245116 (UK) for Kovalenko
Vertical routing for topical authority
crime.hab.media builds topical authority for violence/fraud keywords; corruption.hab.media for officials/asset keywords; authors.hab.media for long-form investigative depth; comments.hab.media for timely reactions. Google treats each subdomain as a semi-independent publisher, while shared sidebars cross-link all verticals — passing internal link equity.
- Shared "Останні новини" sidebar across verticals
- hab.media hub syndicates all categories
Visible view counters
Article listings display view counts (400–1000+ per piece). Operators can optimize headlines by watching which accusatory framings attract clicks — a feedback loop for SEO headline A/B testing without formal analytics disclosure.
- crime.hab.media category pages
Victim name + accusation keyword targeting
Pay-to-delete properties (kartoteka.news, kompromat1.online, vlasti.io) title articles as `{Full Name} — fraud / laundering / corruption`. Google indexes these within days. Victims discover articles via search before any direct contact — the article itself is the ransom note.
- IPS News June 2025
- Trustpilot kartoteka.news reviews (paraphrased)
60+ mirror domains for index persistence
When Roskomnadzor blocks .online/.news domains, operators pivot to .se, .cloud, .guru, .press TLDs. Each mirror republishes identical or near-identical content under a new hostname — if Google delists one domain, three others may still rank. Victims who pay for removal on one mirror report republication on another.
- extortion.watch registry (60+ domains)
- Stop Kompromat Medium mirror mapping
Telegram as index amplifier
Channel K1 (~155k subscribers per OSINT) and related Telegram channels republish article URLs within hours. Telegram links generate social signals; victims receive direct messages with payment instructions alongside the URL.
- IPS News
- ALLEGED_OPERATORS data
- TELEGRAM_CHANNELS IOC
Synthetic biography search cluttering
When investigative URLs rank for a subject, affiliated sites may publish dozens of flattering or neutral biographies (seneregemen.com-style properties) to push negative Hab or kompromat URLs down. This is the inverse of victim-facing extortion — reputation laundering for network allies.
- Network OSINT mapping
- alias saturation patterns in portfolio research
Post-2023 English-language pivot
After Roskomnadzor blocks Russian-facing domains, operators expand English copy targeting international search audiences and crypto-native payment flows. kartoteka.news Trustpilot reviews are predominantly English — indicating successful international SEO pivot.
- IPS News June 2025
- Trustpilot language distribution
Infrastructure tactics
Daily OG image paths
Articles ship Open Graph images at `/upload/news/YYYY/MM/DD/{id}.jpg`. Social shares and Google Discover eligibility improve with fresh images tied to new article IDs — reinforcing the publish-constantly strategy.
Unified Disqus identity (media-hab)
All Hab verticals share Disqus shortname `media-hab`, aggregating comment signals and user engagement across subdomains — a single engagement footprint that search algorithms may interpret as editorial legitimacy.
TDS / cloaking for crawler vs human
Investigative OSINT documents traffic-direction systems that may serve different content to Googlebot than to human visitors — delaying abuse detection while ensuring indexation of accusatory material.
Kompromat network: victim-name targeting
IPS News (June 2025) documents how kartoteka.news and kompromat1.online title articles to rank for a person's name combined with accusatory keywords. Trustpilot reviews (paraphrased, never quoted) describe victims discovering articles via Google before any direct contact. The article is the initial ransom demand — search ranking creates reputational damage that operators later monetize.
After Roskomnadzor blocked Russian-facing domains in 2023, operators pivoted to .se, .cloud, and .guru TLDs while expanding English copy — targeting international victims who pay in USDT. Each mirror domain is a separate hostname Google may index independently.
Extortion monetization funnel
- Publish (Day 0): Accusatory article goes live on flagship domain (kartoteka.news, kompromat1.online) or Hab vertical. Title optimized for `{name} + {crime keyword}`.
- Index (Day 1–3): Google crawls and indexes within 24–72 hours. No victim notification required — search discovery is the primary pressure vector.
- Discover (Day 3–14): Victim, employer, client, or family finds URL via Google. Reputational damage begins before any direct operator contact.
- Notify (Day 7+): Email (Gmail, Protonmail patterns) or Telegram message offers "resolution." K1 channel may amplify. Price quoted in USDT/BTC.
- Negotiate (Week 2+): Tiered pricing: single removal, multi-article bundle, "year-long peace." Operators may reference fake legal documents.
- Pay or resist (Ongoing): Payment rarely ends pressure permanently. Mirrors republish; new articles appear; Telegram reshares. Documented re-extortion after partial payment.
Documented price points
| Service | Amount | Source |
|---|---|---|
| Article placement | ~$150 | OSINT / operator quotes |
| Single removal | $3,000–$8,000 USDT | IPS News, Cypriot case |
| Year-long peace | ~$12,000 USDT | BlackBox sting, Dutable |
| Parliament complaint | $6,000 / 0.37 BTC | Vent Magazines 2020 |
Extortion-specific SEO tactics
Tiered extortion pricing
Documented price points: ~$150 article placement, $3,000–$8,000 per removal, ~$12,000 "year-long peace" packages, 0.37 BTC parliamentary complaint (2020). Cryptocurrency (USDT, BTC) is standard — irreversible, pseudonymous, cross-border.
Purge contract fiction
Operators reference legal-sounding "purge contracts" or removal agreements. Investigative journalism notes these lack enforceability — payment on one domain does not prevent republication across the mirror network. Victims describe paying twice for the same content on different hostnames.
How pay-to-delete works · Documented pricing · Article corpus with English translations