Methodology: How AdFection Research Evaluates Evidence and Attribution

We prioritize original research publications (Citizen Lab, Microsoft, Google TAG, Amnesty, Recorded Future, Avast, Confiant, CISA, NIST/NVD, MITRE ATT&CK) over secondary reporting. Reputable journalism is used for contemporary context, not as primary authority when an original publication exists.

Attribution is presented as documented in primary sources, with confidence levels. We distinguish infrastructure association from operational attribution and from customer/operator attribution.

We explicitly distinguish advertisement impression, profiling, target selection, exploit delivery, successful compromise, and active C2 communication. An ad impression is not infection.

We use a defined set of evidence labels: CONFIRMED, HIGH CONFIDENCE, ASSESSED, REPORTED, ALLEGED, UNCONFIRMED, HISTORICAL, NO LONGER ACTIVE, CURRENT STATUS UNKNOWN.

Indicators change rapidly. Historical association does not prove current malicious use. We label indicators as historical where appropriate and do not imply every hostname under a parent domain is malicious.

Errors are corrected promptly and transparently. A dated changelog is maintained on each major page. See the corrections page.

Where sources disagree or claims are disputed, we present the range of positions and identify what is and is not established.

We cite primary sources with stable URLs where available and describe the source's role in supporting each claim.