Through analyst written signatures, sites are categorized and broken apart to track threat actors and TTPs.  Default pages and takedown pages are measured multiple times to understand the lifecycle of the attack.