After I wrote about the machine that assembled around Mullvad's bad week, the obvious next question was the one everyone asks about a pile-on: who's running it?
So I traced it. All of it. Every actor that showed up around that brand name while it was hot — the spam, the affiliate sites, the competitor, the inflated numbers. I went looking for the strings and the hand holding them.
I want to tell you what I found, including the part I was hoping not to find, because reporting the absence of your favorite theory is the entire job. Anyone can find a conspiracy. The discipline is being willing to lose one.
There is exactly one coordinated network here. It's real, and it's ugly, and it has nothing to do with Mullvad.
It advertises itself. Roughly twenty thousand links to Mullvad carry an anchor that is literally a sales pitch for a black-hat link service — a Telegram handle selling backlinks, PBNs, and "link indexing." I followed it home. Two hub domains, registered seven months apart at the same registrar, both hidden behind Cloudflare. And underneath them, a ring of about fifteen compromised third-party sites — a painting contractor, a soccer club, a university, a lottery site in Vietnam — all quietly injected with links pointing up at the hub. Break into small legitimate sites, borrow their credibility, funnel it to your money page. Classic, industrial, and years old.
Here's the part that kills the conspiracy: that network was running since October 2025, months before Berntsson's donation was ever reported. It doesn't target Mullvad. It targets everything — its pages are templated by country and category, spraying the same spam at every VPN and proxy brand on earth. Mullvad wasn't chosen. Mullvad was just standing there with high authority when the sprinkler swung past.
That's a real operation. It's just not this story's operation. It's weather, not a plot.
Then there's everyone else — the part that looks coordinated and isn't.
The affiliate sites that raced to publish "Mullvad alternatives" the week the story broke: I traced their plumbing. Where they link out. How they're registered. What tracking they run. Three of the loudest were born in 2003, 2019, and 2025. They sit on three different hosts, use three different affiliate systems, and route to three different sets of deals — one funnels to Nord and Express, another to Proton and Surfshark and Privado, another somewhere else again. No shared analytics. No shared affiliate IDs. No links between them. They have never coordinated anything, and the proof is that each is quietly stabbing the others in the back for the same commission.
They didn't need to coordinate. That's the whole unsettling point.
I even had a thread that looked like a smoking gun — two of these domains resolving to the same Cloudflare address. For about an hour I thought I had them wired together. Then I checked the registrations and the affiliate systems: six years apart, completely different machinery. It was Cloudflare stacking unrelated strangers on one shared IP, which it does to millions of domains. I killed the lead. A coincidence dressed as evidence is still a coincidence, and if I'd published it as a link I'd have been doing exactly what I accuse the spammers of — manufacturing a pattern because it was profitable to see one.
So here is the honest map. One genuine spam network, generic and indifferent, that would have hit Mullvad in any week. A crowd of independent scavengers who converged on the same carcass because the incentives pointed them all at it. A competitor mugging for the camera. And a backlink number inflated to seven figures by three sites auto-generating junk URLs.
No war room. No string-puller. No one to subpoena.
And that's scarier than a conspiracy, not less. A conspiracy has a head you can cut off. What actually happened to Mullvad is that the internet's incentive structure did the coordinating for the participants — automatically, leaderlessly, at the speed of a trending topic. Point enough independent actors at the same reward and you get behavior that looks orchestrated from the outside and is nobody's decision from the inside. You cannot behead a structure that has no head. You can only understand it, and refuse to be moved by it.
I wanted the conspiracy. The data said no. Printing the no anyway is the difference between an investigator and a man with a theory and a keyboard.
The one real network doesn't care about Mullvad, and the crowd that does isn't a network. Both of those are true, and holding both without flinching is the only honest way to read a pile-on — including the ones aimed at people you'd rather believe are guilty.