Four companies stand between a dossier site and its readers. Each one is a lever.

By Ransom Watch | 12 October 2026 | Evidence review

Anonymous "exposure" sites present themselves as voiceless operations: no masthead, no named authors, no office. But a website is not anonymous infrastructure. Between the person who writes the article and the person who reads it sit a chain of identifiable companies, each selling a different layer of the stack, each with its own abuse policy and its own legal exposure. Mapping that chain is the first technical step in any response. Here is the chain behind one live dossier site, letmeexpose.is, as we documented it in September and October 2026.

Layer 1: The registry

Every domain sits inside a registry, the organisation that operates the extension itself. For letmeexpose.is that is ISNIC, the registry for Iceland's .is. The registry is the deepest lever: it can suspend the name entirely, making the site unreachable at that address regardless of who hosts it.

ISNIC's position, stated in writing in response to our formal notice (tickets #273632, #273671, #273674), is that it acts on a court ruling or a request from a competent authority such as the police. That makes the registry a slow lever but a decisive one, and it explains why experienced operators choose extensions whose registries demand legal process: it buys them time.

Layer 2: The registration and its privacy holder

A domain must be registered to someone. Dossier operators rarely register in their own names. The holder of record for letmeexpose.is is Njalla, a privacy service that registers domains on customers' behalf and sits in the record in their place. This is a legal service with legitimate uses, but in practice it means the public record names an intermediary, not the operator.

A privacy holder can be formally noticed, as Njalla was on 30 September 2026. Whether it acts is a separate question, but the notice establishes that the intermediary knew what its service was carrying, and when.

Layer 3: The CDN

Most dossier sites sit behind a content delivery network, commonly Cloudflare, which serves the site's pages from its own network and shields the true hosting server from casual inspection. Cloudflare's abuse process generally forwards content complaints onward rather than adjudicating them, but its report route creates a dated record (ours is logged as report 1fab23d6df970ef0) and the act of reporting sometimes surfaces the origin provider behind the shield.

Layer 4: The host

Somewhere behind the CDN is a server. Finding it takes more than a browser: in this case the site's own mail (SPF) records pointed to UltaHost / First Colo in Frankfurt, a provider the website layer alone did not reveal. The host is the most practical lever. Hosting companies run acceptable-use policies, and documented payment demands attached to a site are the kind of evidence those policies are written for. The host received formal notice on 30 September 2026.

What the stack view changes

Each layer controls a different lever: the registry controls the name, the privacy holder controls the record, the CDN controls delivery, the host controls the server. A report that asks the wrong layer for the wrong remedy fails; one that asks each layer for what it alone can do builds a record that converges. And when one layer finally acts, the dates on the notices show who acted early and who waited.

For targets, the lesson is procedural: before reporting anything, map the stack. The registry is in the RDAP record. The CDN and host can be identified from DNS and mail records. None of it requires specialist tools, only the knowledge that the chain exists and that every link in it is a company with a log of its own.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Technical details above were recorded from public DNS, RDAP and mail records in September and October 2026; infrastructure can change. Tips and documents: [email protected]. More: reputationransom.com.