Taxonomy

# Same service, same operators, rebrand, or copycat?

Four tiers hide inside eight relationship labels. Conflating them is the most common error in writing about takedowns.

Computed from the published tables at the August 23, 2026 research cutoff. Last reviewed August 23, 2026.

"It came back" is doing far too much work in most writing about takedowns. It covers the same people running the same code on a new box, and it covers a competitor growing into a hole in the market. One means the action did not remove the operators. The other means the action worked exactly as designed and demand did not care.

The index uses eight relationship values across 61 successor records. They answer four genuinely different questions.

| Relationship | What continues | Records |
| --- | --- | --- |
| Same operators | The people | 14 |
| Partial operator continuity | Some of the people | 7 |
| Rebrand | The people, under a new name | 4 |
| Same service, new infrastructure | The service, not the assets | 15 |
| Ecosystem successor | The market, not the actor | 16 |
| Copycat | The idea only | 1 |
| Claimed return | An assertion, unverified | 3 |
| Relationship not established | Not established | 1 |

## Tier one: the operators are still there

Same operators, partial operator continuity and rebrand. This is the tier that means a takedown did not remove the people, and it is the best evidenced group in the index. Operator continuity gets established through concrete artifacts: reused wallets, reused code, reused infrastructure patterns, or the operators announcing themselves because they cannot help it.

Rebrand is the same thing wearing a hat. Use it when the identity changed and the operator evidence held. Partial operator continuity is the honest middle, for a return carried by some of the crew rather than all of it. If you find yourself reaching for it because same operators felt too strong, that reach is the point of the label.

## Tier two: the service is back, the hands are unproven

Same service on new infrastructure, 15 records. The thing itself is running again on assets that were not seized, and the record does not establish who is behind it. This is the class that traps writers, because the natural sentence sounds like operator continuity to a reader even when the citation does not support it. If the source establishes the operators it belongs in tier one. If it does not, say the service returned and stop there.

## Tier three: somebody else grew

Ecosystem successor, 16 records, and strictly speaking nobody came back. A displaced user base landed somewhere else. Counting these as failed takedowns is a category error, because the original was seized and stayed seized. Dropping them is also wrong, because displacement is how this ecosystem behaves and several of these successors were themselves seized later.

## Tier four: imitation and assertion

Copycat has 1 record in the whole index, which says more about how hard imitation is to evidence than about how rare it is. Claimed return has 3, and none of them are graded above medium. A claimed return is the actors saying they are back, and the index declines to promote an assertion to a fact because it was made loudly.

## Two things not to do with this taxonomy

Do not quietly drop the unknown bucket to make the other percentages sum tidily, and do not fold it into the nearest plausible class. A return the sources cannot classify is a real state, and inventing a class for it is the error this index exists to avoid.

Do not use the return class letters. They appear on 23 of 83 records with values from A to G, and the scale is defined nowhere in the dataset. The [coverage gaps](https://takedownindex.org/about/coverage-gaps) table records that records added during the audit were deliberately left ungraded rather than assigned a letter whose meaning nobody published.

## How strongly each link is supported

35 of 61 successor records are graded confirmed or high. The confidence value describes the link between the original and the successor, not how bad the successor is, and a low or disputed grade is recorded so the possibility stays visible rather than because it is established. The full vocabulary is defined on [classification labels](https://takedownindex.org/about/classification-labels).

Every figure above is derived from the published tables and can be recomputed from them. [Download the data](https://takedownindex.org/data), then read the [counting rules](https://takedownindex.org/about/counting-incidents) and the [known limitations](https://takedownindex.org/about/known-limitations) before citing any of it.