Public record database
Corrections log
Every record in the index was read back against its sources. Where a value did not survive that check it was changed, and every change is listed here: the record it belongs to, the field, the value before, the value now, the reason, and the source that settled it.
138 corrections across 45 of the 108 records in the index, in 14 fields.
In 10 of them the value recorded before and the value recorded after are the same. The audit dataset carries them that way and this log does not alter them.
Showing 51 to 100 of 138 corrections
-
WeLeakInfo seizure
Start date
Was: 2020-01-15
Now: 2020-01-16
Corrected to match the cited source.
WeLeakInfo domain seizure announcementOpen WeLeakInfo domain seizure announcement at the publisher -
WeLeakInfo seizure
End date
Was: 2020-01-15
Now: 2020-01-16
Corrected to match the cited source.
WeLeakInfo domain seizure announcementOpen WeLeakInfo domain seizure announcement at the publisher -
WeLeakInfo seizure
Announcement date
Was: Not recorded
Now: 2020-01-16
Corrected to match the cited source.
WeLeakInfo domain seizure announcementOpen WeLeakInfo domain seizure announcement at the publisher -
WeLeakInfo seizure
Reported apprehended count
Was: 2
Now: 2
Two arrests occurred in Northern Ireland and the Netherlands as part of international action; the U.S. release itself does not name them.
WeLeakInfo domain seizure announcementOpen WeLeakInfo domain seizure announcement at the publisher -
Cyclops Blink disruption
Start date
Was: 2022-04-06
Now: 2022-03-18
Initial Rule 41 authorization issued March 18, 2022; operation occurred during March before April 6 announcement.
Court-authorized disruption of Cyclops BlinkOpen Court-authorized disruption of Cyclops Blink at the publisher -
Cyclops Blink disruption
End date
Was: 2022-04-06
Now: 2022-04-06
Public release does not identify a single completion date; April 6 is retained as announcement/outer bound.
Court-authorized disruption of Cyclops BlinkOpen Court-authorized disruption of Cyclops Blink at the publisher -
Cyclops Blink disruption
Announcement date
Was: Not recorded
Now: 2022-04-06
Corrected to match the cited source.
Court-authorized disruption of Cyclops BlinkOpen Court-authorized disruption of Cyclops Blink at the publisher -
FluBot disruption
Announcement date
Was: Not recorded
Now: 2022-06-01
Corrected to match the cited source.
FluBot: Europe's most spread mobile malware disrupted through international police cooperationOpen FluBot: Europe's most spread mobile malware disrupted through international police cooperation at the publisher -
FluBot disruption
Start date
Was: 2022-06-01
Now: Not recorded
Europol states infrastructure was rendered inactive earlier in May; exact action date not publicly specified.
FluBot: Europe's most spread mobile malware disrupted through international police cooperationOpen FluBot: Europe's most spread mobile malware disrupted through international police cooperation at the publisher -
FluBot disruption
End date
Was: 2022-06-01
Now: Not recorded
Exact technical action date not publicly specified; June 1 is announcement date.
FluBot: Europe's most spread mobile malware disrupted through international police cooperationOpen FluBot: Europe's most spread mobile malware disrupted through international police cooperation at the publisher -
RSOCKS proxy botnet disruption
Start date
Was: 2022-06-01
Now: 2022-06-16
Official DOJ announcement/action date; no official support found for June 1.
RSOCKS residential proxy botnet dismantledOpen RSOCKS residential proxy botnet dismantled at the publisher -
RSOCKS proxy botnet disruption
End date
Was: 2022-06-16
Now: 2022-06-16
Corrected to match the cited source.
RSOCKS residential proxy botnet dismantledOpen RSOCKS residential proxy botnet dismantled at the publisher -
RSOCKS proxy botnet disruption
Announcement date
Was: Not recorded
Now: 2022-06-16
Corrected to match the cited source.
RSOCKS residential proxy botnet dismantledOpen RSOCKS residential proxy botnet dismantled at the publisher -
Nemesis Market seizure
Start date
Was: 2024-03-21
Now: 2024-03-20
BKA states concerted seizure action occurred March 20; release published March 21.
Nemesis Market darknet marketplace shut downOpen Nemesis Market darknet marketplace shut down at the publisher -
Nemesis Market seizure
End date
Was: 2024-03-21
Now: 2024-03-20
Corrected to match the cited source.
Nemesis Market darknet marketplace shut downOpen Nemesis Market darknet marketplace shut down at the publisher -
Nemesis Market seizure
Announcement date
Was: Not recorded
Now: 2024-03-21
Corrected to match the cited source.
Nemesis Market darknet marketplace shut downOpen Nemesis Market darknet marketplace shut down at the publisher -
BreachForums portal seizure (2025)
Start date
Was: 2025-01-01
Now: 2025-10-10
The Salesforce-related BreachForums domain seizure occurred October 10, 2025; January 1 was an unsupported placeholder.
Specialist reporting on the 2025 BreachForums portal seizureOpen Specialist reporting on the 2025 BreachForums portal seizure at the publisher -
BreachForums portal seizure (2025)
End date
Was: Not recorded
Now: 2025-10-10
Corrected to match the cited source.
Specialist reporting on the 2025 BreachForums portal seizureOpen Specialist reporting on the 2025 BreachForums portal seizure at the publisher -
BreachForums portal seizure (2025)
Announcement date
Was: Not recorded
Now: 2025-10-10
Corrected to match the cited source.
Specialist reporting on the 2025 BreachForums portal seizureOpen Specialist reporting on the 2025 BreachForums portal seizure at the publisher -
BreachForums portal seizure (2025)
Legal mechanism
Was: US seizure process with French judicial cooperation reported
Now: FBI/DOJ domain seizure with French BL2C and Paris prosecutor/JUNALCO participation; no operation-specific official press release located.
Corrected to match the cited source.
Specialist reporting on the 2025 BreachForums portal seizureOpen Specialist reporting on the 2025 BreachForums portal seizure at the publisher -
BreachForums portal seizure (2025)
Confidence
Was: low
Now: medium
Corrected to match the cited source.
Specialist reporting on the 2025 BreachForums portal seizureOpen Specialist reporting on the 2025 BreachForums portal seizure at the publisher -
Operation Endgame wave 3
Start date
Was: 2025-11-10
Now: 2025-11-10
Corrected to match the cited source.
Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and ElysiumOpen Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium at the publisher -
Operation Endgame wave 3
End date
Was: 2025-11-14
Now: 2025-11-13
Europol states action ran 10-13 November 2025.
Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and ElysiumOpen Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium at the publisher -
Operation Endgame wave 3
Announcement date
Was: 2025-11-14
Now: 2025-11-13
Europol publication date.
Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and ElysiumOpen Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium at the publisher -
Operation Endgame wave 3
What came down
Was: More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
Now: 1,025 servers taken down or disrupted; 20 domains seized; one VenomRAT suspect arrested in Greece on 2025-11-03.
Corrected to match the cited source.
Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and ElysiumOpen Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium at the publisher -
Operation Stream / Kidflix
Start date
Was: 2025-04-02
Now: 2025-03-10
Europol states action weeks ran March 10-23, 2025.
Kidflix: one of the largest child sexual exploitation platforms taken downOpen Kidflix: one of the largest child sexual exploitation platforms taken down at the publisher -
Operation Stream / Kidflix
End date
Was: 2025-04-02
Now: 2025-03-23
Corrected to match the cited source.
Kidflix: one of the largest child sexual exploitation platforms taken downOpen Kidflix: one of the largest child sexual exploitation platforms taken down at the publisher -
Operation Stream / Kidflix
Announcement date
Was: Not recorded
Now: 2025-04-02
Corrected to match the cited source.
Kidflix: one of the largest child sexual exploitation platforms taken downOpen Kidflix: one of the largest child sexual exploitation platforms taken down at the publisher -
Operation Stream / Kidflix
Reported apprehended count
Was: Not recorded
Now: 79
Corrected to match the cited source.
Kidflix: one of the largest child sexual exploitation platforms taken downOpen Kidflix: one of the largest child sexual exploitation platforms taken down at the publisher -
Operation Stream / Kidflix
What came down
Was: Server infrastructure and extensive evidentiary material seized.
Now: Server seized March 11, 2025; 79 arrests, 1,393 suspects identified, more than 3,000 devices seized, and 39 children protected as of announcement.
Corrected to match the cited source.
Kidflix: one of the largest child sexual exploitation platforms taken downOpen Kidflix: one of the largest child sexual exploitation platforms taken down at the publisher -
Phobos/8Base ransomware disruption
Start date
Was: 2025-02-10
Now: Not recorded
Europol says the coordinated action occurred during the prior week but does not publish one exact action date.
Law enforcement disrupts Phobos ransomware and 8Base groupOpen Law enforcement disrupts Phobos ransomware and 8Base group at the publisher -
Phobos/8Base ransomware disruption
End date
Was: 2025-02-10
Now: Not recorded
Corrected to match the cited source.
Law enforcement disrupts Phobos ransomware and 8Base groupOpen Law enforcement disrupts Phobos ransomware and 8Base group at the publisher -
Phobos/8Base ransomware disruption
Announcement date
Was: Not recorded
Now: 2025-02-11
Corrected to match the cited source.
Law enforcement disrupts Phobos ransomware and 8Base groupOpen Law enforcement disrupts Phobos ransomware and 8Base group at the publisher -
Phobos/8Base ransomware disruption
Reported apprehended count
Was: Not recorded
Now: 4
Four alleged 8Base leaders arrested in the coordinated action.
Law enforcement disrupts Phobos ransomware and 8Base groupOpen Law enforcement disrupts Phobos ransomware and 8Base group at the publisher -
Phobos/8Base ransomware disruption
What came down
Was: More than 100 servers disrupted.
Now: 27 servers linked to the criminal network were taken down in the February 2025 action; the prior >100 figure was not supported by the official release located.
Corrected to match the cited source.
Law enforcement disrupts Phobos ransomware and 8Base groupOpen Law enforcement disrupts Phobos ransomware and 8Base group at the publisher -
Amaq propaganda infrastructure takedown
Start date
Was: 2018-04-27
Now: 2018-04-25
Corrected to match the cited source.
Islamic State Amaq propaganda infrastructure disruptedOpen Islamic State Amaq propaganda infrastructure disrupted at the publisher -
Amaq propaganda infrastructure takedown
End date
Was: 2018-04-27
Now: 2018-04-26
Corrected to match the cited source.
Islamic State Amaq propaganda infrastructure disruptedOpen Islamic State Amaq propaganda infrastructure disrupted at the publisher -
Amaq propaganda infrastructure takedown
Announcement date
Was: Not recorded
Now: 2018-04-27
Corrected to match the cited source.
Islamic State Amaq propaganda infrastructure disruptedOpen Islamic State Amaq propaganda infrastructure disrupted at the publisher -
Islamic State web infrastructure takedown
Start date
Was: 2019-11-25
Now: 2019-11-21
Corrected to match the cited source.
Coordinated action against Islamic State online propaganda infrastructureOpen Coordinated action against Islamic State online propaganda infrastructure at the publisher -
Islamic State web infrastructure takedown
End date
Was: 2019-11-25
Now: 2019-11-24
Corrected to match the cited source.
Coordinated action against Islamic State online propaganda infrastructureOpen Coordinated action against Islamic State online propaganda infrastructure at the publisher -
Islamic State web infrastructure takedown
Announcement date
Was: Not recorded
Now: 2019-11-25
Corrected to match the cited source.
Coordinated action against Islamic State online propaganda infrastructureOpen Coordinated action against Islamic State online propaganda infrastructure at the publisher -
Islamic State web infrastructure takedown
What came down
Was: Web/media distribution infrastructure disrupted.
Now: More than 26,000 items of Islamic State-supporting content were referred to nine online service providers for terms-of-service evaluation/removal; the located official source does not establish a government seizure or takeover of infrastructure.
Corrected to match the cited source.
Coordinated action against Islamic State online propaganda infrastructureOpen Coordinated action against Islamic State online propaganda infrastructure at the publisher -
Islamic State web infrastructure takedown
Record kind
Was: incident
Now: excluded_candidate
The action was a content-referral/platform-moderation campaign and fails the dataset’s stated infrastructure-action inclusion test.
Coordinated action against Islamic State online propaganda infrastructureOpen Coordinated action against Islamic State online propaganda infrastructure at the publisher -
INTERPOL Synergia II
Start date
Was: 2024-11-05
Now: Not recorded
INTERPOL states only that the operation ran from April through August 2024; no exact start day is published.
INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countriesOpen INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries at the publisher -
INTERPOL Synergia II
End date
Was: 2024-11-05
Now: Not recorded
INTERPOL states only that the operation ran from April through August 2024; no exact end day is published.
INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countriesOpen INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries at the publisher -
INTERPOL Synergia II
Announcement date
Was: Not recorded
Now: 2024-11-05
INTERPOL publication date.
INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countriesOpen INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries at the publisher -
INTERPOL Synergia II
Reported apprehended count
Was: Not recorded
Now: 41
INTERPOL reported 41 arrests.
INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countriesOpen INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries at the publisher -
INTERPOL Synergia II
What came down
Was: More than 22,000 malicious IPs, domains, servers, and related infrastructure disrupted across the campaign.
Now: More than 22,000 malicious IP addresses or servers taken down; 59 servers and 43 electronic devices seized.
Replaced the less specific input figure with the official breakdown.
INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countriesOpen INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries at the publisher -
INTERPOL Operation Secure
Start date
Was: 2025-06-11
Now: Not recorded
INTERPOL states the operation ran January-April 2025; no exact start day is published.
Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domainsOpen Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains at the publisher -
INTERPOL Operation Secure
End date
Was: 2025-06-11
Now: Not recorded
INTERPOL states the operation ran January-April 2025; no exact end day is published.
Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domainsOpen Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains at the publisher
Showing 51 to 100 of 138 corrections