How an attack actually works

Five stages. Knowing which one you are in determines everything that happens next.

1 · The trigger. Rarely spontaneous. A commercial conflict, a former partner, a competitor, a rival, a fixated individual, or someone being paid. There is a person with a motive.

2 · The asset. A site, a video, a review profile — built to rank, and often hosted deliberately where legal removal is close to impossible.

3 · The amplification. Paid advertising against your own brand terms. Seeded comments and reviews. Sometimes real press carrying commissioned material.

4 · The reach-out. Your investors, bank, partners and clients get the link. This is the payload. The site was only ever the delivery mechanism — which is why a campaign can be devastating while ranking nowhere.

5 · The escalation. Anonymous threats. Contact with your family. A criminal filing somewhere one can be arranged.

What people get wrong

Panic-buying removals before anyone has asked whether removal is even available. Responding publicly in the first 48 hours, when nothing said should be permanent and everything said is. Suing the wrong party in the wrong jurisdiction — which in 2026 can end with you paying your attacker's costs. Removing an asset early and alerting an attacker who then rebuilds it better hidden.

The question nobody asks first: why does this exist?

Destruction — no demand, no contact. The only exit is attribution and consequences. Extortion — pay and it disappears. Better news than it feels: he has to talk to you, and every message is evidence. Leverage — the campaign exists to move a dispute. Ending the dispute ends the campaign.

Two identical-looking attacks can need opposite responses. Establishing which one you face is the first thing we do.