$ cat Case Database
Structured incident and policy-event records with dates, source scope, confidence, outcomes and related chapters; unresolved fields are explicit.
2,471 words~11 min readREFERENCE
╔══════════════════════════════════════════════════╗
║ DATE · TECHNIQUE · TARGET · OUTCOME · SOURCE ║
╚══════════════════════════════════════════════════╝
filter & sort documented incidents · confidence tagged
INCIDENTS, POLICY EVENTS & RESEARCH LEADS
Each record distinguishes what its source establishes from missing outcomes. Policy events and unresolved historical leads are not verified incidents. Record count is not a count of convictions, search penalties or independently measured effects. Follow the narrative analysis in Case Studies.
Brand, publisher and archive records
BMW Germany
- Date / period
- 2006-02-07 (reinclusion statement)
- Platform
- Google Search
- Technique
- Doorway pages / JavaScript redirects
- What is documented
- Matt Cutts, then at Google, reported that BMW removed redirecting pages and bmw.de was reincluded.
- Impact / enforcement / outcome
- Removal and reinclusion are documented; traffic loss and general recovery times were not measured.
- Policy and scope
- Doorway and deceptive-redirect guidance; consult current policy separately.
- Confidence / limitations
- High for the reported reinclusion; no universal duration inferred.
- Source
- Primary participant statement
- Related chapter
- Doorway pages / JavaScript redirects
J.C. Penney
- Date / period
- February 2011 (historical reporting)
- Platform
- Google Search
- Technique
- Paid-link scheme
- What is documented
- The linked investigation describes paid links and an ensuing search penalty.
- Impact / enforcement / outcome
- Exact scale, ranking deltas and recovery timeline remain unverified here; the source returned an access restriction during the audit.
- Policy and scope
- Link-spam policy context; do not infer the detection algorithm from the report.
- Confidence / limitations
- Unresolved beyond the historical report reference.
- Source
- Original investigative reporting; access restricted
- Related chapter
- Paid-link scheme
Overstock
- Date / period
- 2011-04-25 (company release)
- Platform
- Google Search
- Technique
- Reported link-policy penalty
- What is documented
- An SEC-filed company release says the penalty imposed in late February had been lifted.
- Impact / enforcement / outcome
- The company reports release from the penalty; this source does not quantify revenue impact or independently establish the alleged link acquisition details.
- Policy and scope
- Link-policy context; exact violation mechanism needs a separate source.
- Confidence / limitations
- High for the existence of the company statement; company attribution retained.
- Source
- Company statement filed with SEC
- Related chapter
- Reported link-policy penalty
Interflora
- Date / period
- 2013; precise event dates unresolved
- Platform
- Google Search
- Technique
- Reported advertorial / paid-link incident
- What is documented
- Historical report retained as a research lead; the previous edition supplied only a confirmed badge.
- Impact / enforcement / outcome
- Penalty mechanism, start/end dates and recovery are not independently verified in this edition.
- Policy and scope
- Potential link-spam context; policy is not proof of this incident.
- Confidence / limitations
- Unverified; not usable as completed case evidence.
- Source
- Primary case source still required
- Related chapter
- Reported advertorial / paid-link incident
Rap Genius
- Date / period
- 2013–2014; duration not independently verified
- Platform
- Google Search
- Technique
- Reported promotional link scheme
- What is documented
- A company account is identified, but it was not retrievable during this correction pass.
- Impact / enforcement / outcome
- The previous approximately ten-day penalty claim has been withdrawn pending dated evidence.
- Policy and scope
- Link-spam context; not proof of a particular recovery process.
- Confidence / limitations
- Unverified outcome and duration.
- Source
- Company account; retrieval failed
- Related chapter
- Reported promotional link scheme
Publisher coupon / review sections
- Date / period
- 2024; policy treatment updated August 2026
- Platform
- Google Search
- Technique
- Site reputation abuse
- What is documented
- Google’s policy addresses qualifying third-party content arrangements. The old row grouped unnamed publishers.
- Impact / enforcement / outcome
- This is a policy/campaign record, not a verified named-publisher incident. Entity-specific enforcement and impact require separate records.
- Policy and scope
- Current editorial criteria and regional enforcement differ from the 2024 framing.
- Confidence / limitations
- High for policy existence; incomplete for individual outcomes.
- Source
- Current primary policy
- Related chapter
- Site reputation abuse
LendEDU
- Date / period
- 2020-05-26 (FTC final settlement announcement)
- Platform
- Comparison publishing / consumer protection
- Technique
- Compensated rankings and fake endorsements
- What is documented
- FTC finalized a settlement addressing allegedly deceptive comparison rankings and reviews.
- Impact / enforcement / outcome
- Final order and a $350,000 payment reported by FTC; no search penalty or ranking effect established.
- Policy and scope
- FTC Act consumer-protection context; unrelated to a finding under Google spam policy.
- Confidence / limitations
- High for the published settlement; allegations retain attribution.
- Source
- FTC final settlement announcement
- Related chapter
- Compensated rankings and fake endorsements
The Hairpin archive
- Date / period
- Early 2024 repurposing; later restoration account, publication date unstated
- Platform
- Web publishing / domain continuity
- Technique
- Domain repurposing and disrupted archive access
- What is documented
- Archivist Eli Dickinson describes expiry, changed pages and preserving an alternative archive.
- Impact / enforcement / outcome
- Archive access and changed content are described; no authenticated Google enforcement or revenue record.
- Policy and scope
- Repurposing is documented by the source; this is not an adjudicated expired-domain-abuse violation.
- Confidence / limitations
- First-hand archive work; ownership and ranking conclusions are bounded.
- Source
- Archivist account
- Related chapter
- Domain repurposing and disrupted archive access
Policy events, campaign reports and studies
Penguin launch
- Date / period
- 2012-04-24
- Platform
- Google Search
- Technique
- Webspam algorithm / manipulative links
- What is documented
- Google announced an algorithm change aimed at webspam and guideline violations.
- Impact / enforcement / outcome
- A dated platform announcement, not an individual site’s penalty record. Later Penguin versions must be treated separately.
- Policy and scope
- Historical webspam policy; avoid importing later devaluation behavior into the launch description.
- Confidence / limitations
- High for the announcement; no site-level causal outcome inferred.
- Source
- Primary platform announcement
- Related chapter
- Webspam algorithm / manipulative links
PBN manual-action reports
- Date / period
- September 2014 (industry reporting)
- Platform
- Google Search
- Technique
- Private blog network links
- What is documented
- Contemporaneous industry reporting described manual actions involving PBNs.
- Impact / enforcement / outcome
- The linked report was access-restricted during the audit. Network scale, detection method and downstream impact are not independently established here.
- Policy and scope
- Link-spam enforcement context, not evidence that every network or target was affected.
- Confidence / limitations
- Historical reporting; independent case verification incomplete.
- Source
- Industry report; access restricted
- Related chapter
- Private blog network links
March 2024 core update and spam policies
- Date / period
- 2024-03-05 announcement
- Platform
- Google Search
- Technique
- Scaled content, expired domains and site reputation abuse
- What is documented
- Google announced the core update and named the three policy areas.
- Impact / enforcement / outcome
- This record verifies the announcement, not a particular domain’s traffic collapse or a completed experiment.
- Policy and scope
- Policy-event record; also see expired-domain-abuse.html and parasite-seo.html.
- Confidence / limitations
- High for the announced policy event.
- Source
- Primary platform announcement
- Related chapter
- Scaled content, expired domains and site reputation abuse
European policy scrutiny / regional enforcement
- Date / period
- 2025 inquiry reported; 2026-08-30 revised treatment
- Platform
- Google Search / EEA
- Technique
- Site reputation abuse enforcement
- What is documented
- Google’s August 2026 statement describes discussions with the European Commission and revised regional treatment.
- Impact / enforcement / outcome
- Policy change verified from the platform statement; this does not establish a legal finding against Google or a specific publisher’s recovery.
- Policy and scope
- Separate regional search effects from the underlying policy criteria.
- Confidence / limitations
- High for announced treatment; legal proceeding outcome not asserted.
- Source
- Primary platform announcement
- Related chapter
- Site reputation abuse enforcement
Originality.ai named-domain study
- Date / period
- Initial article-scoring run 2024-03-07
- Platform
- Public Google observations / vendor detector
- Technique
- Index-removal observations and AI-content attribution
- What is documented
- Researcher names domains including fresherslive.com and reports public-search checks and detector classifications.
- Impact / enforcement / outcome
- Historical reported observations; no authenticated per-domain manual-action notice or isolated cause.
- Policy and scope
- A policy announcement cannot establish why any sampled domain disappeared.
- Confidence / limitations
- Primary for vendor method and observations; detector vendor conflict, selected sample and no representative controls.
- Source
- Original vendor study
- Related chapter
- Index-removal observations and AI-content attribution
Hacklink injection marketplace
- Date / period
- Documented reporting (Netcraft)
- Platform
- Compromised third-party sites
- Technique
- Injected-link SEO poisoning as a service
- What is documented
- Netcraft documented a marketplace selling injected links on compromised sites (listings from about $1, more for .gov/.edu authority), with online gambling, pharma and adult as the primary buyer verticals and operators claiming access to 15,000+ hacked sites.
- Impact / enforcement / outcome
- Illustrates the industrialization of the pharma-hack tactic into self-serve injection. The 15,000+ figure is an operator claim, not verified.
- Policy and scope
- Unauthorized access underlies the service; documentation is defensive.
- Confidence / limitations
- Practitioner/vendor reporting; site counts are operator-claimed estimates.
- Source
- Security-vendor investigation
- Related chapter
- Injected-link SEO poisoning as a service
2025 SEO-poisoning campaign (Oyster/Broomstick)
- Date / period
- January-April 2025 (reported)
- Platform
- Poisoned search results / trojaned installers
- Technique
- SEO poisoning (malware delivery)
- What is documented
- Reporting attributed to Kaspersky described an SEO-poisoning campaign impersonating IT and AI tools (PuTTY, WinSCP, and others) that reportedly reached 8,500+ SMB users and delivered the Oyster/Broomstick backdoor.
- Impact / enforcement / outcome
- Shows the pharma-hack mechanics (compromised hosts, long-tail targeting, arrival cloaking) repurposed for malware. Scope figures are from vendor reporting.
- Policy and scope
- Malware distribution is criminal; record is incident context.
- Confidence / limitations
- Vendor threat reporting; campaign bounds and totals are as reported, not independently verified.
- Source
- Vendor threat reporting
- Related chapter
- SEO poisoning (malware delivery)
Adult data-PR earned coverage
- Date / period
- Recurring (annual data releases)
- Platform
- Mainstream press / earned links
- Technique
- Digital PR (data asset)
- What is documented
- Practitioner sources document large adult platforms and adult e-commerce brands earning mainstream press citations by releasing behavioral and sexual-health data (for example annual 'Year in Review' style releases), gaining links that mainstream publishers would not otherwise give an adult site.
- Impact / enforcement / outcome
- Demonstrates the most durable adult-SEO tactic: genuinely earned editorial citations that survive core updates. No specific ranking figure is asserted.
- Policy and scope
- Legal, age-verified content; policy-compliant tactic.
- Confidence / limitations
- Practitioner case reporting; illustrative rather than measured.
- Source
- Practitioner case reporting
- Related chapter
- Digital PR (data asset)
Massachusetts ABC DTC compliance sweep
- Date / period
- Reported (2023 checks)
- Platform
- Alcohol e-commerce / DTC shipping
- Technique
- Gray-market DTC shipping + weak age verification
- What is documented
- Industry reporting cited a Massachusetts ABC compliance check in which the large majority of tested e-commerce platforms accepted a direct-to-consumer alcohol order placed by an underage test buyer.
- Impact / enforcement / outcome
- Documents the age-verification failure at checkout that regulators are targeting; enforcement sits at the carrier/payment and licensing layer, not in search.
- Policy and scope
- Unlicensed DTC shipping and underage sales are enforced under state law.
- Confidence / limitations
- Industry-body and trade reporting of a regulator action; specific per-platform outcomes summarized.
- Source
- Industry-body reporting
- Related chapter
- Gray-market DTC shipping + weak age verification
Security, litigation and criminal records
GootLoader mothership reporting
- Date / period
- 2021-08-12 report; campaign bounds not established
- Platform
- Compromised web pages / search / endpoints
- Technique
- SEO poisoning
- What is documented
- Sophos described centrally controlled malicious content on compromised sites.
- Impact / enforcement / outcome
- The specific endpoint timed out during the audit. The record preserves attribution and does not claim a continuous 2018–present campaign or universal ransomware outcome.
- Policy and scope
- Security incident context; technical reporting is not a court finding.
- Confidence / limitations
- Original technical reporting; source accessibility unresolved.
- Source
- Responder threat intelligence
- Related chapter
- SEO poisoning
Search-delivered malware campaigns
- Date / period
- Report date and incident bounds require verification
- Platform
- Search results / compromised pages / endpoints
- Technique
- SEO poisoning
- What is documented
- The linked security report describes malicious search delivery.
- Impact / enforcement / outcome
- Retained as a campaign research lead; affected entities, event dates, measured impact and remediation outcome are incomplete.
- Policy and scope
- Malware delivery must be separated from ordinary ranking-policy violations.
- Confidence / limitations
- Secondary report; incomplete incident record.
- Source
- Security reporting
- Related chapter
- SEO poisoning
Web-based indirect prompt injection
- Date / period
- Reported observations; consult source-specific dates
- Platform
- AI agents reading web content
- Technique
- Indirect prompt injection
- What is documented
- Unit 42 documents instruction-bearing web content and agent-manipulation objectives.
- Impact / enforcement / outcome
- Observation of injected content does not by itself prove successful compromise for every agent or target. Model-specific outcomes require the source’s exact test context.
- Policy and scope
- Trust-boundary incident; criminal classification requires separate facts and law.
- Confidence / limitations
- Original technical reporting; scoped to documented observations.
- Source
- Primary security research
- Related chapter
- Indirect prompt injection
Google v. Hu / GMBEye / Rafadigital
- Date / period
- 2023-06-16 (Google announcement)
- Platform
- Google Business Profiles / civil litigation
- Technique
- Alleged fabricated profiles, reviews and lead sales
- What is documented
- Google announced a lawsuit and said it removed deceptive profiles and reviews.
- Impact / enforcement / outcome
- Removal is attributed to Google; a final court outcome and ranking effect are not established here.
- Policy and scope
- Platform rules and civil claims; this record does not allege a criminal conviction.
- Confidence / limitations
- High for the existence of the Google statement; factual allegations are not adjudicated findings.
- Source
- Plaintiff announcement; complaint linked in the local chapter
- Related chapter
- Alleged fabricated profiles, reviews and lead sales
William Stanley
- Date / period
- 2016-01-04 sentencing; DOJ release 2016-01-05
- Platform
- US federal court / search-related extortion
- Technique
- Threats of reputational and economic harm
- What is documented
- DOJ reports a Hobbs Act extortion guilty plea and sentence.
- Impact / enforcement / outcome
- 37 months imprisonment and $174,888 restitution reported; these are case outcomes, not typical penalties.
- Policy and scope
- Specific criminal case; a search-policy violation alone is not Hobbs Act extortion.
- Confidence / limitations
- High for the official sentencing report; no independent ranking dataset.
- Source
- US Attorney sentencing announcement
- Related chapter
- Threats of reputational and economic harm
GlavMed / SpamIt partnerka networks
- Date / period
- 2007-2010 (measured); investigation opened Sep 2010
- Platform
- Email spam + SEO + compromised hosts
- Technique
- Pharma affiliate (partnerka) traffic generation
- What is documented
- Leaked ledgers analyzed by SophosLabs and academics documented an affiliate network that processed 1.5M+ orders from 800K+ customers; Russian authorities opened a criminal investigation into operator Igor Gusev and SpamIt announced closure.
- Impact / enforcement / outcome
- Measured revenue in the tens of millions across the programs; closure coincided with a documented drop in global spam volume. Leak analysis is not a court verdict.
- Policy and scope
- Unlicensed-pharmacy and anti-spam context; criminal investigation is not a completed conviction record here.
- Confidence / limitations
- High for the leaked-ledger figures and the investigation; individual attribution beyond named operators is limited.
- Source
- Leaked-data academic analysis + journalism
- Related chapter
- Pharma affiliate (partnerka) traffic generation
RX-Promotion controlled-substance program
- Date / period
- Measurement era ~2007-2010
- Platform
- Affiliate storefronts
- Technique
- Pharma affiliate (controlled substances)
- What is documented
- The PharmaLeaks analysis of leaked ledgers found RX-Promotion carried controlled substances (e.g. oxycodone) that were about 10% of orders but roughly 26% of revenue.
- Impact / enforcement / outcome
- Documents abuse-driven demand as a revenue driver distinct from the ED-drug volume of other programs. Figures are from leaked business records.
- Policy and scope
- Controlled-substance sale is criminal; the record documents research findings, not a prosecution.
- Confidence / limitations
- High for the ledger-derived proportions; not an independent audit.
- Source
- Leaked-data academic analysis
- Related chapter
- Pharma affiliate (controlled substances)