{"table":"excluded_candidates","columns":["name","occurred_on","classification","reason"],"row_count":13,"research_cutoff_on":"2026-08-21","generated_on":"2026-08-21","terms":"Free to reuse with attribution to the Internet Takedown Index. A research aggregation of public reporting, not a legal reference.","rows":[{"name":"OFAC sanctions on Hydra Market and Garantex","occurred_on":"2022-04-05","classification":"excluded","reason":"Sanctions-only action. The designation itself did not seize, redirect, or disable internet infrastructure. The German server seizure on the same date is recorded separately as td_2022_hydra."},{"name":"OFAC sanctions on Genesis Market","occurred_on":"2023-04-11","classification":"excluded","reason":"Sanctions-only action, separate from the domain seizure recorded as td_2023_genesis."},{"name":"OFAC and OFSI designations of Khoroshev, Sungatov, and Kondratyev","occurred_on":"2024-05-07","classification":"excluded","reason":"Sanctions-only. Recorded as person_actions of type sanctioned rather than as takedowns."},{"name":"OFAC designation of Integrity Technology Group","occurred_on":"2025-01-03","classification":"excluded","reason":"Sanctions-only action following the Raptor Train disruption."},{"name":"Mikhail Matveev US indictment","occurred_on":"2023-05-16","classification":"excluded","reason":"Indictment with no accompanying infrastructure seizure. Recorded as a person_action against td_2024_cronos_w1 rather than as its own takedown."},{"name":"LockBit administration panel compromise","occurred_on":"2025-05-07","classification":"excluded","reason":"The compromise was carried out by an unknown actor, not by a law-enforcement or government-backed authority. Fails the government-action requirement."},{"name":"Sky Global chief executive US indictment","occurred_on":"2021-03-12","classification":"excluded","reason":"Indictment only. Not merged into td_2021_sky_ecc, which records the separate infrastructure and interception action."},{"name":"Microsoft civil botnet disruptions without law-enforcement participation, including Waledac, Rustock, and Necurs","occurred_on":null,"classification":"probable_edge_scope","reason":"Purely private civil takedowns under US civil process with no material law-enforcement-controlled infrastructure action. Excluded per the stated scope. Rustock involved some law-enforcement support and is flagged as a probable edge case for reassessment."},{"name":"National website-blocking orders against piracy sites","occurred_on":null,"classification":"excluded","reason":"Blocking orders that restrict access within a single jurisdiction without a broader infrastructure disruption are excluded by the stated scope."},{"name":"DNSChanger and Operation Ghost Click","occurred_on":"2011-11-08","classification":"unresolved","reason":"Strong verified-core candidate involving court-authorized replacement DNS servers. Not promoted in this pass because the primary sources were not opened and verified."},{"name":"Coreflood botnet disruption","occurred_on":"2011-04-13","classification":"unresolved","reason":"Strong verified-core candidate involving a court-authorized stop command issued to infected machines. Not promoted in this pass for the same reason."},{"name":"Operation PowerOFF waves in 2019, 2023, and May 2025","occurred_on":null,"classification":"unresolved","reason":"Identified as real waves belonging to um_operation_poweroff but not verified to incident standard in this pass."},{"name":"2019 Islamic State online-content referral action","occurred_on":"2019-11-25","classification":"excluded_after_reverification","reason":"Official source documents more than 26,000 content referrals to nine online service providers for terms-of-service review, not a government seizure, takeover, sinkhole or compelled infrastructure shutdown. It fails the dataset inclusion definition."}]}