First 48 Hours: Emergency Playbook

You just found the article. These ten steps are ordered by urgency. Complete steps 1–6 within the first few hours. Steps 7–10 can run in parallel over the next two days.

Stop and breathe
Do not pay. Do not reply with anger or threats. Pause before acting — panic leads to payments that rarely help.
Screenshot every URL
Capture full-page screenshots of every article URL, including the address bar, publication date if visible, and any author bylines.
Archive the pages
Submit URLs to archive.today or the Internet Archive. Save the archive links in a secure document.
Preserve all contact
Export or screenshot every email, Telegram message, and social-media contact. Note wallet addresses, amounts demanded, and deadlines stated.
Run WHOIS lookup
Identify the domain registrar and hosting provider. Save registrar abuse@ and hosting abuse contact addresses.
Document Google visibility
Search your name and capture screenshots of search results showing which domains rank and for which keywords.
File Google removal request
Start Google legal removal or personal-information requests the same day. See our Google guide for form links and wording.
Send hosting abuse report
Email the hosting provider abuse desk with evidence of extortion and defamation. Use our hosting template.
File police report
Submit to FBI IC3, Europol, Action Fraud, or Ukrainian cyber police depending on your jurisdiction and the operator location.
Secure your accounts
Change passwords on email and social accounts. Enable two-factor authentication. Warn family or colleagues if operators threaten to contact them.

Hour-by-hour priority

Hours 0–4: Steps 1–5. Evidence preservation is non-negotiable. Once pages are edited or taken down, you may lose proof of what was published.

Hours 4–24: Steps 6–8. Platform and hosting reports begin the official takedown process. Google delisting can reduce discovery even before the host acts.

Hours 24–48: Steps 9–10. Police reports create an official record. Account security limits further harassment vectors.

What not to do

Do not send cryptocurrency to any wallet address.
Do not agree to a "purge contract" — it is not enforceable across mirror sites.
Do not publicly engage with operators on social media unless advised by counsel.
Do not assume one takedown ends the campaign — monitor sister domains listed on extortion.watch.

Next: Report to Google · Report to hosting · Report to police · Email templates

Reporting portals to bookmark

Official intake sites victims use during the first 48 hours after discovering a kompromat article.

Google legal removal

Official troubleshooting flow for defamation and personal-info delisting.

Open evidence source

FBI IC3 portal

US cybercrime intake for extortion with preserved wallet addresses and headers.

Open evidence source

Action Fraud (UK)

National reporting line for fraud and online blackmail complaints.

Open evidence source

Trustpilot evidence archive

Screenshot before filing platform abuse or police reports.

Open evidence source