The ecosystem map shows where to push. This instrument measures whether pushes do anything: how long the ecosystem takes to heal after each public pressure episode. The unit is the ecosystem node, not the brand, so a customer base moving from one bulletproof hoster to another correctly reports as displacement, near zero. The honest signal is twofold: closed intervals (the node healed, measured in days) and censored intervals (no reconstitution observed yet, shown as lower bounds). The successes never close their clocks, so a median of closed intervals alone would be survivorship bias. Both are shown.
One lane per ecosystem node, time across the page. Each episode drops a bar in every lane it touched, running from public action date to migration evident. Simultaneity is shown, not averaged away: multiple lanes lighting up in the same week is thirty-plus entities acting at once, and this instrument declines to untangle credit. Repeated pressure on one node reads as repeated bars in one lane. Click any bar for the full episode record.
Per-episode detail, newest first: constituent actions with sources, both dates where observed (replacement live, migration evident: the gap between them is trust damage), co-occurring actions inside a 14-day window, confidence labels, and an explicit non-attribution note. An episode is a coordinated push evidenced by same-window cross-referencing announcements and shared targets, never mere calendar proximity.
What is measured
The reconstitution interval: how long the ecosystem takes to heal after public pressure. This is a property of the system, not a grade on any operation. It requires no interagency coordination to compute and assigns no credit. Lengthening intervals mean the ecosystem is degrading; persistently short intervals mean displacement only. Moving a customer base between providers is not degradation, and the node-level unit makes that impossible to miscount as a win.Rules
1. The unit is the episode-node pair, not the episode and not the brand. A multi-node package runs one clock per lane touched, and substitution inside a node reports as near-zero recovery.2. The clock starts at the public action date (press release). Covert action precedes announcement, so every published interval is a lower bound; classified detail can only lengthen it.
3. The clock stops when customers have visibly moved to a replacement, not when a replacement merely exists.
4. Two dates are recorded where observable: replacement live, and migration evident. The gap between them is trust damage, measured.
5. No attribution. Every episode record lists co-occurring public actions inside a 14-day window and explicitly declines to assign cause.
6. Episodes are constructed from coordination evidence: same-window announcements that cross-reference each other or share targets. Calendar proximity alone never merges actions.
7. Court-process events (pleas, sentencings, extraditions), interception sweeps, attribution strikes, and actions against state entities carry no clock: there is nothing to reconstitute. They enter the record as markers and personnel-exposure context.
8. Censoring: an interval with no observed reconstitution stays open and is reported as a lower bound with an as-of age. Open intervals are excluded from the rolling median and shown separately; episodes under 90 days old sit in an assessment window and are excluded from both.
Evidence standard: the clock only moves on artifacts
Every date must come from something a skeptic can pull up independently. Government press releases for actions. Machine-recorded, timestamped artifacts for replacements and migration. Assessed absorption without a dated artifact leaves the clock open, with the assessment confined to commentary. Analyst judgment never touches the clock. Minimum acceptable migration evidence by node type:| Node type | Replacement live | Migration evident |
|---|---|---|
| Hosting / VPN / proxy | BGP or ASN announcement, new prefixes routing | Customer infrastructure observed on the new prefixes (passive DNS, scan data, threat-intel telemetry) |
| Malware / MaaS | New C2 domains or panels live | Campaign telemetry: detections of new builds at scale |
| Forums / markets | Mirror or successor site reachable | Posting volume and vendor activity resuming (not mere reachability) |
| RaaS brands | Leak site or panel live | Victim posts resuming on the new infrastructure (ransomware.live feed) |
| Financial rails | Successor venue or contract live | On-chain flow migration (TRM, Chainalysis, Global Ledger reporting with dates) |