Outcomes
Do takedowns hold?
What the index records about services documented operating again afterwards, and what that evidence will not support.
Outcomes / Method
Original research
Research
Studies computed from the published tables. Every figure on these pages is derived from the same data you can download, at the research cutoff shown, and moves when the data moves.
Research cutoff August 23, 2026. Figures are computed at the moment you load the page, from the tables published at /data.
Method
Why no documented return does not mean permanent
The index holds three states, not two, and the middle one is the part almost every citation gets wrong.
Method / Outcomes
Taxonomy
Same service, same operators, rebrand, or copycat?
Four tiers hide inside eight relationship labels. Conflating them is the most common error in writing about takedowns.
Taxonomy / Outcomes
Network analysis
The repeat-seizure loop
Successors that were themselves targeted later, traced as chains with named edges rather than impressions.
Outcomes / Enforcement
Outcomes
How long does criminal infrastructure take to reappear?
A median measured across the returns the index can actually date, published with the denominator attached.
Outcomes / Method
Infrastructure
What law enforcement actually seizes
Domains, servers, wallets, accounts and devices, counted by what the records say was acted on.
Infrastructure
Enforcement
Who leads cybercrime takedowns?
Agencies, courts, coordinators and technical partners, and the records where no lead was ever named.
Enforcement
Method
Unknown is not zero
How to read missing counts in this dataset without turning silence into a finding.
Method
Read the counting rules and the known limitations before citing anything here.