Registry methodology.
The Campaign Registry is a reference artifact, not a blog. Entries exist to be cited: by researchers, by brokers doing due diligence on a domain, by hosting abuse desks, and by our own monthly measured reports. What separates a registry from a content marketing page is this page.
What qualifies as a campaign
A numbered entry requires all of the following:
- A repeatable fingerprint — the wave shares infrastructure, artifacts, or templated content across observations, strongly enough that a second sighting is recognisably the same operator.
- Time bounds — a first-seen and a last-seen window, from our own telemetry or dated third-party exports.
- Scale — enough distinct source hosts that the activity is industrial, not a single bad actor with one domain.
- Behaviour class — the wave fits the measured taxonomy on attack types, or the taxonomy is extended to fit it.
Wave-like activity that fails any criterion is not registered. Months with no qualifying activity publish nothing — an empty month is part of the record, not a gap in marketing.
Confidence tiers
| Tier | Meaning |
|---|---|
| Candidate | Candidate — signals observed, linkage not yet established. |
| Corroborated | Corroborated — linkage established across at least two independent signals. |
| Confirmed | Confirmed — cross-victim linkage proven (shared infrastructure and byte-identical artifacts). |
Tiers only ever move up. A confirmed campaign is never demoted to candidate; new evidence that contradicts an attribution opens a correction, not a quiet edit.
What we publish — and what we never publish
Always exact: host counts, time windows, behaviour and anchor classes, confidence, abuse-filing status, version history.
Never: the source-host list itself, IP addresses, attribution methods or fingerprint logic, the identities of protected properties, or victim identities. Victim detail is sector-level at most, and named only with the victim's consent. Publishing the list would hand the farm its own burn notice; publishing the method would teach it to mutate. The conclusions are public; the camera stays hidden.
Embargo on active campaigns
A campaign marked active renders aggregates only. Full infrastructure characterisation releases 30 days after the campaign is marked dormant. We never tell an attacking farm, mid-campaign, what we can see.
Corrections, disputes, retirement
Every entry carries a public version history. A material change increments the version and records what changed and why. Campaign IDs and codenames are never recycled; a retired entry stays at its permalink with its status changed, not deleted. Disputes and correction requests go to the contact page — an operator who believes they were misattributed gets a human review, and the version history shows the outcome either way.
Citing the registry
Each entry has a stable permalink, a machine-readable record in the JSON feed, and an RSS feed for new entries. Cite by campaign number and codename — e.g. Campaign #1 "POWERPLAY", The SEO Sink Campaign Registry — with the permalink. The registry is free to cite, including commercially.
Why the public registry is deliberately thinner than what we hold
The published record is the floor of what we know, not the ceiling. The full evidence graph — host-level linkage, cross-victim anchor sets, live timing — is what tenants' protection runs on. Thin public pages are a feature: the moat is the historical record itself, and every month of telemetry banks more of it.