Median 71 days, across the 20 returns this index can actually date. That denominator is most of the story, so it goes in the same breath as the number.
Date completeness
The index holds 61 successor records. 22 carry a first-seen date. The rest record that a return happened without recording when, because the source establishing the return did not fix a date and the counting rules forbid inventing one. Where only a month is known, the date field stays null rather than taking a guessed day.
So this median describes a minority of known returns, and not a random minority. A return gets a date when somebody noticed it and wrote the date down, and loud, fast, obvious returns get noticed. A service that quietly reconstitutes eighteen months later under a different name gets dated to whenever a researcher happened to connect the two, if at all.
The shape is lumpy, not centred
The dated intervals cluster at both ends rather than piling in the middle. A group returns almost immediately, sometimes within the same week as the announcement, then there is a thin stretch, then a long tail running past a year.
The fast cluster is what a takedown looks like when nobody was in custody and the infrastructure was cheap to replace. Replacement domains get registered while the seizure wave is still running. Forums relaunch within days. The long tail is a different animal: a service that took a year or more to reappear usually did so because the people behind it were waiting, not because the assets were hard to rebuild.
Intervals that run negative
A few dated returns predate the action they follow. That is a reporting artifact rather than a contradiction: the public announcement lags the operation, and replacement infrastructure is sometimes registered before the seizure becomes public. Those rows are recorded as they are, and excluded from the median rather than clamped to zero.
How to cite this
With the denominator welded on: a median of 71 days across the 20 returns the index can date, of 61 recorded. On its own the figure reads as a benchmark for how fast criminal infrastructure comes back in general, and it is not one.
20 intervals will not support a survival curve, a mean, or a per-category breakdown, and this page does not publish one. What they support is the narrower claim that a substantial share of dated returns appeared within weeks, and that the index cannot date the rest. The reasons it cannot are in coverage gaps.