$ cat Methodology & Scope
Research questions, source standards, scope, cutoff dates, evidence categories, uncertainty and the limits of the archive’s local demonstrations.
This edition combines a secondary-source account of search manipulation with six synthetic offline demonstrations and one completed descriptive evaluation of the archive’s own search. It contains four proposed public-web studies and no completed original ranking or AI-search experiment. The method below defines the standard for reading and updating claims. A heading, evidence badge, build date or successful HTTP response does not establish that the underlying claim has been verified.
1 · Scope and research questions
“Black hat SEO” is used here for practices intended to manipulate search visibility contrary to a platform's published rules. The archive also covers adjacent threats, including prompt injection and malware delivery through search, which are not equivalent to ordinary ranking-policy violations. The purpose is explanation, source evaluation and defense.
- Which mechanisms and policy boundaries are documented, and which remain interpretations?
- What observable evidence can distinguish manipulation or compromise from normal site behavior?
- What does a case or study actually measure, and how far can its conclusion extend?
- What can a defender safely reproduce locally, and which real-world questions remain unanswered?
The review includes traditional search, link schemes, local/affiliate abuse, AI-search retrieval, indirect prompt injection and search-delivered threats. It is not an exhaustive census of vendors, operators, incidents or every engine's private ranking implementation. No interviews, privileged access to search systems, paid operator datasets or live manipulation campaigns were used.
2 · Evidence categories and claim scope
Evidence labels describe a source's relationship to a specific claim; they are not a universal ranking of truth. An official policy can establish what a platform prohibits while saying little about prevalence or enforcement accuracy. A well-designed experiment may establish an effect for its tested conditions, while an API field name establishes only that a field appeared in a particular document.
| Label | What it can support | What it does not establish alone |
|---|---|---|
| documented | A stated rule, documented interface or attributed official account. | Independent confirmation of vendor performance or undisclosed production behavior. |
| leak-indicated | A preserved field/schema in an identified leaked version; analysis must identify its source. | Current deployment, weighting or a successful manipulation tactic. |
| interpretation | An inference with an explicit chain from evidence to conclusion. | A settled implementation detail or measured causal effect. |
| measured | A completed test with inspectable data, method, conditions and limitations. | Transfer to other products, versions, tasks or populations. |
| operator report | What an identified operator reports observing. | Independent verification, representative frequency or a controlled comparison. |
| unverified | A clearly attributed unresolved claim or hypothesis. | A recommendation, success rate or factual conclusion. |
The 45-record archive-search study uses preserved real index snapshots, a fixed query set and inspectable results. Its scope is local retrieval and text alignment. The local kit's outputs are measured executions on invented fixtures. They verify the supplied arithmetic and rules, not a real search-engine effect. No public-web experiment receives a measured-result label in this edition. Older chapter labels must be read with the linked source and the qualifications in the text; this method does not claim that every sentence has a completed claim-level verification record.
3 · Demonstration boundaries
Tier A · authorized observation
Read-only inspection of assets and accounts the investigator is authorized to inspect. Owning a domain does not prevent effects on users, advertisers or other search participants.
Tier B · synthetic demonstration
Invented pages, logs and data kept offline. The supplied kit illustrates mechanisms without publishing deceptive pages, generating false engagement or contacting third parties.
Tier C · incident analysis
Source-backed accounts and inert indicators of compromise. No malware payload, unauthorized access or live exploit is needed to inspect the defensive reasoning.
The archive explains mechanisms at the level supported by its evidence. A topic requiring unavailable data is marked unresolved. It does not substitute an unsafe live campaign, a toy simulator or a protocol outline for actual evidence. Local cleanup simply removes the kit's output folder; no disavow submission or live-site deindexing is needed.
4 · Dates, status and maintenance
Research cutoff: 2026-09-17 for this correction edition. This is the latest material considered, not a claim that every source was checked that day. Build date: when generated files were produced. Verification date: only a dated source/claim check with recorded scope can support one. Rebuilding must not advance research or verification dates.
Status labels such as active, declining or emerging are editorial context unless a defined dataset supports a trend. “Documented use” means a cited source records use, not that a tactic reliably works now. “Discontinued” requires evidence about the specific product. A timeout or blocked request is unresolved access; HTTP 200 alone does not prove product operation. Policy accounts need a date, geography and product scope.
5 · Source selection, conflicts and records
- Select sources for the claim. Prefer the platform's current rule for a policy statement, a regulator/court record for a legal event, original research for study results, and dated incident analysis for technical observations. A vendor page can support product identity or its advertised offer, not independent efficacy.
- Record provenance. Capture author/publisher, title, publication/update date, access date, URL, the supported proposition and limits. Preserve a relevant excerpt or local artifact/hash where permitted. Link analyses of a leak as secondary analyses unless the cited artifact is the actual schema.
- Exclude unsupported precision. A success rate, detection window, audience count or price needs a source, date, denominator/unit and applicable conditions. Remove figures without a basis; an “estimate” badge alone cannot rescue them.
- Resolve conflicts explicitly. Check whether sources discuss different dates, regions, product versions or definitions. Present genuinely conflicting interpretations separately. Do not promote the more convenient claim to confirmed status.
- Handle inaccessible and anonymous material. Record access failure and retain unresolved status. Anonymous operator claims need a disclosed collection/verification method before use as evidence. No operator interviews or anonymous testimony were conducted for this edition.
- Report the limits. Primary does not mean unbiased; vendor assertions and official self-descriptions still require attribution. Preprints must be identified as such unless publication status is verified. An incident cannot estimate general prevalence.
The correction pass addresses identified errors and supplies traceable sources where used. It is not a systematic literature review or a completed claim-by-claim census. Outstanding unsourced assertions should be removed, narrowed or tracked for verification rather than silently treated as true. The bibliography is a finding aid; the chapter reference and nearby claim define relevance.
6 · Reading, reproducing and extending the archive
Read definitions before workflow, then inspect the cited mechanism, the conditions of any example and the detection limits. Use Labs for the runnable kit and its actual outputs. Use Proposed Research Protocols for the completed local evaluation and unanswered external questions; none reports completed public-web ranking measurements. A case must identify the event and source rather than borrow a policy announcement as proof of an unnamed incident.
A future empirical addition should include a dated protocol, predefined outcomes, justified sampling/assignment, raw data, analysis code, exclusions, uncertainty and null results. A second reviewer or independent rerun would strengthen verification; neither is implied by the current authoring run. See the kit README for tested runtime details and the scope of its assertions.