We formally notified every service behind one dossier site. Here is what each one did, with dates.

By Ransom Watch | 12 October 2026 | Evidence review

Targets of anonymous "exposure" sites are often told that reporting is pointless: the publisher is hidden, the domain is offshore, nobody is responsible. That is not quite true. A website is a stack of services, and each layer has an operator that can be named, notified and put on the record. We recently ran that process end to end against one live dossier site, letmeexpose.is, on behalf of one of its subjects. This is the dated record of what each service did when formally noticed.

The notices

On 30 September 2026, formal notices went from our legal mailbox to every operator in the site's stack:

• ISNIC, the registry for Iceland's .is extension, received a formal notice and a supplement with case law. Its replies, logged under tickets #273632, #273671 and #273674, declined to suspend the domain. ISNIC's stated position is that it acts on a court ruling or a request from a competent authority such as the police, not on private complaint.
• Njalla, the privacy service listed as the domain's holder of record, received a notice and an evidence supplement including the subject's own statement.
• Cloudflare, the content delivery network in front of the site, received an abuse report, logged as report 1fab23d6df970ef0. Cloudflare's abuse process typically routes content complaints to the underlying host rather than acting on the content itself.
• UltaHost / First Colo, the hosting provider identified through the site's mail (SPF) records, received a notice on 30 September.
• The Icelandic police received a cybercrime tip with a screenshot supplement the same day, filed through a no-login reporting route. Of all the notices, this is the one aimed at the trigger ISNIC itself says it requires.

Also on 30 September, GoDaddy, which was approached about three other domains associated in reporting with the same ecosystem, declined to act: those domains were dead or parked, leaving nothing for a registrar to suspend.

What the responses establish

Three things, all documented.

First, every operator in the stack is now formally on notice, with ticket numbers and dated correspondence. Whatever happens next happens with their knowledge. That matters legally and it matters practically: abuse desks process queues, and a notice with a ticket reference is a record that can be escalated, quoted to a court and cited to journalists.

Second, the registry has stated its bar in writing. ISNIC will act on a court ruling or a police request. That is a high bar, but it is a defined one, and it converts the problem from "convince a company" into "obtain one of two specific instruments." The police tip filed on 30 September is directed at exactly that.

Third, the site remains live as of this writing. That is worth stating plainly, because notice campaigns are often described as takedowns. They are not. They are the first dated entries in a record.

Why publish this trail

Most targets never learn which levers exist, and most services never hear from targets at all. A dated notice trail does two jobs at once: it shows targets that the stack can be mapped and notified in a single day, and it shows the services that their response, or silence, is part of a public record.

We will update this record as replies arrive. If a court ruling or police response changes any provider's position, the dates here will show how long each layer held out after being formally told what it was carrying.

Ransom Watch documents reported reputation-extortion networks and the evidence around them. Records reviewed September and October 2026; ticket numbers and report IDs quoted above are from our own correspondence. Tips and documents: [email protected]. More: reputationransom.com.