Original research
Do takedowns hold?
Enforcement actions are announced as endings. This page sets out what the index actually records about services and groups that were documented operating again afterwards, and what that evidence will not support.
How the cohort was selected
The cohort is every counted incident in the index at the August 21, 2026 research cutoff: 102 records. Umbrella campaigns are excluded so a multi wave operation is not counted once as a campaign and again as its waves. Candidates that were assessed and left out are excluded too, and are published with the reason each was rejected.
23 of those 102 records, 23 percent, carry at least one documented successor. Those successors are recorded as 25 separate rows, because a single action can be followed by more than one.
Read this before you cite it
The other 79 records are not evidence that those services stayed down. They are records with no documented successor, which is a different claim. Absence of a recorded return reflects what published sources establish, not a check on whether the service is running.
This is a floor, not a rate. Treating 23 percent as a return rate would assume the index sees every return, and it does not.
What kind of return
Not every successor is the same thing coming back. A market absorbing another market's users is not the original operators resuming, and the index grades the difference rather than collapsing it.
| Relationship to the original | Records |
|---|---|
| Relationship not established | 6 |
| Ecosystem successor | 5 |
| Same operators | 5 |
| Same service on replacement infrastructure | 5 |
| Partial operator continuity | 2 |
| Rebrand | 2 |
14 of the 25 successor records document continuity of the service or its operators. The rest record a weaker link, or none that the sources establish. The relationship and confidence vocabularies define each label.
How strongly each link is supported
Every successor row carries a confidence grade for the link between the original and the successor. A low or ungraded row is recorded so the possibility stays visible, not because it is established.
| Confidence in the link | Records |
|---|---|
| Medium | 13 |
| High | 11 |
| Low | 1 |
By category
Category totals are small. Read the counts, not a rate: a category with six records cannot support a percentage that means anything.
| Category | Records | With a documented successor |
|---|---|---|
| Darknet market | 12 | 5 |
| Malware and botnets | 19 | 4 |
| Fraud and stolen data | 11 | 4 |
| Ransomware | 7 | 3 |
| Criminal communications | 4 | 2 |
| Criminal hosting and proxies | 10 | 1 |
| Child sexual abuse material | 6 | 1 |
| State sponsored | 6 | 1 |
| DDoS for hire | 4 | 1 |
| Cryptocurrency laundering | 8 | 0 |
| Piracy and IP | 6 | 0 |
| Multi threat campaign | 5 | 0 |
What happened to the successors
10 of the 25 successor records are marked as having been acted on again in a later enforcement action. The remainder are either recorded as not seized again, or carry nothing on the question at all, and those two states are stored separately rather than merged into one.
Everything on this page is derived from the published tables and can be recomputed from them. Download the resurgences table to check the figures, and read the counting rules and known limitations before citing any of it.