# E16. Retraction of an earlier campaign attribution

## Withdrawn claim

A July analysis associated a domain family, mostly registered in September 2025, with the recruitment campaign based on hosting overlap, closely spaced registrations and persona-like subdomains. A subsequent review withdrew that earlier-phase attribution. The preprint does not extend the campaign timeline to September 2025 on this evidence. [S1]

## Reassessment evidence

The record identifies a domain family with Portuguese-language consumer names, beauty-related naming and numbered mail-sender subdomains. Historical resolutions also connected the family to demonstrably shared hosting. Its observed activity preceded the July recruitment infrastructure by months. Batch registration and persona-style subdomains are not sufficiently distinctive to overcome those differences. [S1]

Counts of domains returned by a passive-DNS service reflect that service's coverage, not a complete tenant inventory. The earlier assertion that an address was dedicated because few domains appeared in one search was therefore unsupported. Shared provider space and later reuse of an address permit unrelated tenants and successive occupants.

## Uncertainty in the alternative explanation

The retraction describes the family as consistent with affiliate or consumer spam. However, the source explicitly states that substantive page content was not recovered: one retained capture was empty and another was a connection-timeout page. The alternative business interpretation rests on naming, subdomains, mail patterns and hosting behavior. It should not be reported as direct observation of functioning affiliate pages. [S1]

## Consequence

Positive evidence was insufficient to sustain the original campaign attribution, even without proving the exact alternative operation. The family and other weak co-residence leads should not be treated as campaign indicators on that basis. This withdrawal does not negate independently supported July payload, resolver or administration observations.

## Limits

This report documents a correction to the analytical record. It does not prove that every third-party site in the hosting neighborhood was benign, and it makes no current infrastructure-status claim. Unrelated domains and personal-looking subdomain labels are omitted to avoid carrying the withdrawn attribution into a new indicator list.