Investigative Desk

PayToDelete.watch

Investigative case studies and timeline

Kartoteka.news: A Case Study in Pay-to-Delete Publishing

Published June 2026 · Primary sources: IPS News (June 2025), Dutable, Stop Kompromat Medium, Trustpilot (paraphrased)

Among dozens of domains mapped to the kompromat pay-to-delete network, kartoteka.news stands out for one measurable reason: visibility. Trustpilot hosts a sustained volume of one-star reviews from individuals who say they discovered accusatory articles through Google, were contacted for cryptocurrency payment, and — in many paraphrased accounts — paid without lasting relief. Investigative outlets including IPS News and Dutable treat kartoteka.news as a core property in the Kartoteka cluster, alongside mirrors such as kartoteka.press, kartoteka.site, kartoteka.io, and kartoteka.cloud.

This case study synthesizes public reporting and victim-pattern analysis. We do not reproduce defamatory article text, do not treat unverified accusations as fact, and label alleged operator identities as journalism allegations rather than legal findings.

Discovery: how victims encounter kartoteka.news

The typical entry point described across sources is search. Articles are titled to rank for a person's or company's name combined with high-intent keywords — fraud, laundering, corruption, scandal. Victims report learning of an article only after clients, partners, or family members forward a link. IPS News describes Google indexing as the primary discovery vector for the wider network, with traffic-direction systems (TDS) potentially showing different material to crawlers than to human readers.

Once indexed, an accusatory headline can sit on the first page of results for months or years. The reputational damage begins before any direct contact from operators. That delay between publication and notification is itself documented as part of the pressure model: the subject stewards anxiety while the URL remains public.

Victims describe receiving emails from addresses matching documented IOC patterns, offering "resolution" or "legal cleanup" in exchange for USDT transfers — amounts frequently quoted between three and twelve thousand dollars. — Paraphrased from Trustpilot review patterns and IPS News victim interviews, 2024–2025

Trustpilot as a secondary signal

Trustpilot reviews for kartoteka.news are self-reported and unverified, but investigative journalists cite them because they cluster around consistent themes. Paraphrasing across dozens of reviews — never quoting specific defamatory claims — yields the following pattern:

We treat these accounts as experiential data, not adjudication of article truth. The relevant finding for victims is procedural: payment correlates with continued pressure in a substantial subset of reported cases.

Telegram: @kartoteka_news and the fifteen-minute mirror

OSINT mapping documents a dedicated Telegram channel, @kartoteka_news, that republishes web content on a short delay — approximately fifteen minutes after web publish, per IOC fingerprint documentation shared across the portfolio. The larger K1 channel (~155k subscribers in public estimates) further amplifies flagship kompromat1.online content, but kartoteka-specific distribution ensures victims who focus on a single URL still face multi-platform exposure.

Telegram posts are harder to delist than web pages. Screenshots circulate even if a channel message is deleted. Victims who pay for web removal alone often report Telegram as the channel where pressure resumes.

Infrastructure and sister domains

Technical reporting ties kartoteka.news to a mirror architecture:

The extortion.watch registry lists kartoteka.news as Roskomnadzor-blocked in Russia with status "active," reflecting continued operation through international TLD pivots. Sister properties include kartoteka.press (mirrored), kartoteka.se and kartoteka.cloud (pivot TLDs post-2023), and kartoteka.guru / kartoteka.live variants. Paying to remove one hostname does not deindex the cluster.

Documented pricing

ItemRangeSource
Placement / seed article~$150IPS News, Dutable
Single removal ("purge")$3,000–$12,000IPS News, Trustpilot victims
"Year-long peace" package~$12,000BlackBox OSINT sting (2024)
"Reputation insurance" upsell$6,000+IPS News, Vent Magazines

Trustpilot-derived patterns align with the mid-range removal quotes. Reviewers paraphrased in aggregate describe negotiations that start high and settle slightly lower, but still in four figures USD equivalent.

Alleged operators and contacts

IPS News (June 2025) alleges Konstantin Chernenko coordinates the broader network, with Lesia Zhuravska linked to cryptocurrency payment flows in documented cases. Serhii Khantil appears in OSINT reporting as handling infrastructure for mirrored domains. These names appear in journalism and OSINT — not in court judgments reproduced here.

Documented contact IOCs associated with the Kartoteka cluster include:

Timeline highlights for kartoteka.news

Full chronology: 2012–2026 timeline.

Comparison with kompromat1.online

Kartoteka.news and kompromat1.online share infrastructure allegations but differ in audience touchpoints. K1's Telegram channel is the flagship amplifier; kartoteka.news accumulates Trustpilot visibility that functions as a public warning board for victims. Some subjects appear on both properties simultaneously. See the kompromat1.online case study for flagship portal analysis.

What victims should do

  1. Archive the URL, HTML, and email headers; capture Telegram messages if present.
  2. Do not pay; read five documented reasons payment fails.
  3. File reports via Google legal removal and relevant cybercrime channels (FAQ reporting links).
  4. Consult the action guide and legal framework.

Related cases

Sources