A founder, an offshore host, and the site built to end him

The situation

The site had one purpose. It named the founder and his associates, carried stolen photographs, alleged fraud and money laundering, published cryptocurrency wallet addresses to trace his personal finances, made claims about drug use and rehab, solicited further material from readers through an anonymous mailbox and urged them to report him to law enforcement. A marketing agency was buying search ads against his name plus "reviews" to push it higher. He believed the operator was a specific, technically capable individual.

His first instinct was to leave it. Remove it and he builds another. We put the counter-argument plainly: delay favours the attacker, because every month the site stays indexed it gathers links, screenshots and readers, and a second site is easier to fight when the first has already been taken down on grounds that travel. Eighteen days later he instructed us.

Why a single-purpose attack site is different from bad press

A newspaper archive is indifferent to you. An attack site is designed around you. Every element of it, from the domain name to the page titles to the choice of photographs, is built so that a search for the founder's name returns it, and the operator maintains it in response to whatever the target does. That is a different problem from an article that was published once and forgotten.

It also escalates in ways press does not. Wallet addresses turn a reputational page into a financial surveillance tool. An anonymous mailbox soliciting further material turns readers into contributors, which is how a single-page site becomes an archive. An appeal to report the subject to law enforcement is an attempt to convert online allegations into official attention. Paid search against the name plus "reviews" buys visibility that the site could not earn.

The combination of health claims, criminal allegations and stolen photographs is also, in practical terms, an opportunity. Content that would be merely offensive on an ordinary complaint site becomes squarely regulated material once it publishes health information and criminal-offence allegations about a named living person.

The objection every founder raises

Cut one head off and two grow back. It is the most common reason founders leave an attack site up, and it is not silly. The operator here was active and technically capable and the founder said so in writing before instructing us.

The reason to act anyway is that time is not neutral. Every month a site stays indexed, it accumulates inbound links, cached copies, screenshots on other platforms and readers who will recognise it later. It also becomes reference material: a second site built on the remains of a first one starts with an audience and a set of allegations already in circulation, and the evidence you would need to fight it degrades as pages change.

The other half of the answer is that an argument that worked once can be used again quickly. Establishing that on the first site is what makes the second one a short matter instead of a long one.

The host said no

The site sat with an offshore host selected for exactly this situation. We did not argue that the page was untrue, because that is the argument such hosts are built to refuse. We found a ground the host could not dismiss as somebody else's business, drawn from its own published rules and from data protection law. It declined anyway, demanded a court order from its own jurisdiction and said the decision was final. We escalated past the abuse desk and rejected the finality.

Hosts that market themselves on resistance to takedown requests are advertising to exactly the customers who need it, and their public position is that they do not remove lawful content on a complainant's say-so. Arguing that a page is untrue invites the answer they have already prepared.

A refusal that says the decision is final is also not always final. Different functions inside the same company apply different standards, and one of them is paid to think about the company's own exposure rather than about customer service.

Why the argument was not about truth

Defamation asks whether something is false. That requires a decision about facts, which is why hosts and search engines point to courts, and why a host in a jurisdiction chosen for hostility can simply decline to engage.

Data protection asks a different question: whether there is any lawful basis for publishing this information about this identified living person. Health information and allegations about criminal offences are treated as especially sensitive categories, and the balance against freedom of expression is not automatically resolved in favour of an anonymous site with no publisher, no byline and no editorial process.

That framing has three advantages. It does not require the founder to prove a negative. It applies to the site and to the search results independently. It is portable, which matters when the operator is expected to try again.

Winning at Google

Three weeks after instruction Google confirmed removal of the site from results for the founder's name, and reconfirmed it a week later. Source removal continued against the host.

Working both layers at the same time rather than one after the other is deliberate. The host and the search engine are independent decision makers with different obligations, and a refusal by one says nothing about the other. Waiting for the host to answer first would have cost weeks on a site that was actively being promoted through paid search.

Why the record mattered here

The founder had retained two other vendors on the same target and initially credited them for the outcome. We showed him, with dated evidence, that the removal followed our submission and matched the reply we had received.

That is not a point about credit. It is a point about what happens when several parties work the same target at once, which is common for founders under sustained attack. Without dated before-and-after records tied to specific URLs and specific replies, nobody can tell which route worked, and the next matter gets planned on a guess.

Everything here was verified, evidenced to him and monitored, logged out and repeated after the confirmation, because a founder searching from his own machine sees a personalised version of the page. The reconfirmation a week later existed for exactly that reason.

Common mistakes that make it harder

The first is contacting the operator, replying to an anonymous mailbox, or paying anyone who offers to make it go away. Contact confirms the target is reading, which is the feedback an operator wants, and payment marks you as someone who pays.

Publishing a rebuttal is the second, since a public response gives the site a new hook and a fresh reason to be linked. Running several vendors on the same target without a single record of what was done and what changed is the third, because it makes the sequence unreadable afterwards. Scattershot do-it-yourself reports on grounds that do not fit are the fourth: refusals recorded against a URL make the properly built application that follows harder to get reviewed.

The one thing worth doing immediately is preserving everything, dated, and preserving more than you think you need. Attack sites are edited constantly, and the file collected on day one is the file every route is built on. It is also worth being clear with yourself about what is legally distinctive rather than what is most upsetting. The general accusation that you are dishonest, which is usually what the target fixates on, is the weakest part of the page.

Who makes first contact and what the 15-minute call covers

Founders in this position often make contact themselves, and often after weeks of deciding whether to act at all. Sometimes it is their lawyer, their chief of staff or their head of security, particularly where the site publishes financial identifiers or personal movements and the matter has become a safety question as much as a reputational one.

The 15-minute call covers what the site publishes, what of it is verifiably yours, who is hosting it, what is being paid to promote it, what you know about who is behind it, and what has already been tried. We say what we think is realistic, and we say plainly when the argument that feels right is the wrong instrument.

The free Exposure Scan afterwards maps the site, its copies, the search and advertising footprint around it and the related properties that usually accompany a single-purpose attack. It is written down and it is yours to keep. Confidentiality and an NDA are standard, and the work sits alongside your counsel, your public relations advisers and your security team rather than replacing any of them.

What this shows founders

A hostile host in a jurisdiction chosen for hostility was routed around by attacking its own published rules and its data-protection obligations rather than the content's truth. The site left Google inside three weeks of instruction. The objection every founder raises, that one head becomes two, is answered by acting while the grounds are fresh and the evidence is intact.

Two other vendors had been retained on the same target without achieving removal, which is worth reading as a comment on strategy rather than on effort. Against a host that has publicly committed to refusing takedown requests, the argument you choose decides the outcome, and the argument most firms reach for first is the one that host is built to reject.

The last point is about layers. Removal from search stopped the harm that was actually being done, because a site nobody can find on the founder's name reaches almost nobody. Source removal continued afterwards, and it should, because a page that still exists can still be linked, screenshotted and rediscovered.

If a site exists to attack you, read our attack website page or book the free Exposure Scan.