This is the receipts drop. In The Conspiracy That Wasn't I said the Mullvad pile-on had exactly one genuinely coordinated network under it. Here it is, documented, with a disavow file anyone it targeted can use today.
↓ Download the disavow file — 125 domains
The operator. Two hub domains: seo-anomaly-d-1.xyz (registered 2026-04-23) and seo-anomaly-beijing.online (2025-10-06). Same registrar (NameCheap), both hidden behind Cloudflare. The links it plants advertise the business in their own anchor text — a Telegram handle, @seo_anomaly, selling "SEO backlinks, PBN, black-links, traffic boost, link indexing." The product isn't a service that produces spam as a side effect. The product is the spam.
The mechanism. The operator injects links into ~125 compromised third-party sites — the file above lists all of them — and points them up at the two hubs to launder authority. The hubs then run templated {country}_proxy_vpn_vps_hosting pages that spray high-authority brands so the spam gets crawled and indexed. Mullvad alone absorbed roughly 20,000 of these links. It wasn't chosen; it was a big target the sprinkler swung past. The network has been live since October 2025 — months before Mullvad was ever in the news.
The feeders are victims. This matters, so I'll be plain about it: the 125 domains in that file are, overwhelmingly, hacked — legitimate sites unwittingly injected with links. The list includes small businesses across roughly twenty countries, several universities, and at least one national government health domain. If you own one of these, you don't have a marketing problem, you have an intrusion. Disavowing them tells Google to ignore links from them; it is not an accusation against them.
Who should file it. Any site this network has targeted — Mullvad or otherwise — can drop the file straight into Google Search Console under Disavow Links. It's plain Google disavow format, header-commented, nothing to edit.
Method, so you can check me. Referring domains and anchor text from Semrush; registration dates and registrar from WHOIS; hosting and nameservers from live DNS/ASN lookups. Every number here is reproducible with those three tools and an afternoon.
One last thing, because it's the whole point of the trilogy. This network is real, coordinated, and ugly — and it has nothing to do with Mullvad's politics or its bad week. It would have hit them in any week that ended in a search spike. The outrage didn't summon a conspiracy. It just rang the dinner bell for a machine that was already running.
Take the file. Disavow the network. And when the next pile-on comes dressed as a movement, check whether anyone's actually holding the strings before you decide they are.