Investigative Knowledge Base · June 2026

PayToDelete.org

The definitive reference on pay-to-delete extortion

How Pay-to-Delete Works

A step-by-step breakdown of the documented kompromat pay-to-delete playbook, based on IPS News, Dutable, and victim reports.

Phase 1: Discovery and indexing

Articles are optimized to rank for a victim's name plus accusatory keywords (fraud, corruption, money laundering). Google indexing is the primary discovery vector. Cloaking/TDS may delay or alter what crawlers index versus what humans see.

Phase 2: Notification

Victims receive email or Telegram messages pointing to the article. Channels such as K1 (~155k subscribers per OSINT) amplify reach. The message typically offers "resolution" via payment.

Phase 3: Pricing and negotiation

Documented price points include ~$150 placement, $3,000–$12,000 per removal, and ~$12,000 "year-long peace" packages (see pricing sheet). Cryptocurrency (USDT, BTC) is standard.

Phase 4: Purge contract fiction

Operators may reference contracts or legal-sounding "purge" language. Investigative journalism notes these lack enforceability — removal on one mirror does not prevent republication on 60+ sister domains.

Phase 5: Re-publication

Trustpilot reviews for kartoteka.news and IPS News case reporting describe content returning after payment. Mirror sites (kartoteka.press, kompromat1.one, etc.) sustain pressure.

Timeline diagram (text)

Day 0   → Article published on flagship domain
Day 1–3 → Google indexes; victim discovers via search
Day 3–7 → Contact via email/Telegram; price quoted
Day 7+  → Payment demanded; optional "insurance" upsell
Weeks+  → Mirror republication if unpaid or after partial payment

Publisher and reporting evidence

Screenshots of flagship domains and investigative sources that document the placement-to-repost cycle described above.

kartoteka.news live site kartoteka.news live site

Flagship publisher domain cited across investigative reporting and victim complaints.

View source
kompromat1.online portal kompromat1.online portal

Primary K1 cluster domain linked to Telegram republication and purge offers.

View source
Dutable infrastructure report Dutable infrastructure report

Shared analytics IDs and WordPress clone patterns across the network.

View source
Trustpilot complaint volume Trustpilot complaint volume

Public reviews documenting crypto removal demands and re-post cycles.

View source