T-1
Site migration
A one-to-one 301 map for 1,912 legacy URLs, built from logs, backlinks and archived sitemaps, served at the edge with no chains. Canonicals, hreflang and sitemaps were rewritten to the new paths in the same release.
File GROT/CS-0417 · Technology & SaaSClassification: client-sensitive → declassified
Subject: Brezo Systems · Managed cybersecurity provider · Sofia
How a security firm fixed a botched migration and won back its threat-research traffic
+96%
organic traffic recovered · in 6 months
§01The incident
A rebrand that deleted the sales pipeline.
A rebrand moved 1,900 URLs with no redirects, wiping out the threat-intel library that drove most of Brezo's inbound leads.
Brezo's research team had spent four years publishing ransomware write-ups, IOC feeds and NIS2 guides. Those reports ranked for the exact searches IT managers make the morning after an incident, and each one funnelled readers to the Managed SOC offer.
The new site launched on a different URL scheme. Within three weeks organic sessions fell to 38% of baseline, Search Console reported 1,870 not-found errors, and the inbound enquiry form went almost quiet.
§02Diagnosis · audit findings
Five entries in the case file.
- F-01 · MIGRATIONCritical
1,900 legacy URLs moved with zero redirects
The rebrand swapped /blog/threat-intel/* for /insights/* and /research/* for /labs/*. No 301 map shipped, so every backlink and ranking for the library pointed at a 404.
- F-02 · LOGSCritical
Googlebot spent 61% of its crawl on dead URLs
Four weeks of access logs (2.3M bot hits) showed the crawler hammering old paths while 400 new /labs pages had never been requested once.
- F-03 · LINKINGHigh
Threat reports orphaned from service pages
The new nav dropped the research hub. 72% of reports sat five or more clicks deep with no links into Managed SOC or MDR, so authority never flowed to the pages that convert.
- F-04 · PERFORMANCEHigh
Mobile LCP of 4.6s on report templates
A 1.4MB hero animation, render-blocking web fonts and a client-side IOC table rendered after hydration pushed every report into the Poor band.
- F-05 · INDEXINGMedium
Canonicals pointed at the staging domain
Template canonicals still referenced staging.brezo.bg, and the XML sitemap listed 340 URLs that returned 404.
Exhibit C · crawl map
The network, before and after.
A sample of the site graph rebuilt from crawl and log data. After the rebrand the homepage still resolved, but every path into the research library hit a dead end. Switch exhibits to see the restored graph and the new cross-links from reports into service pages.
- Live 404s
- 1,870
- Library reachable
- 0%
- Report → service links
- 0
§03The operation
Four tactics, one objective: get the library back.
Run on our Signal plan (technical seo): recovery first, then speed, then structure, with logs as the source of truth throughout.
T-2
Core Web Vitals
Report templates lost the 1.4MB hero animation, fonts were subset and preloaded, and IOC tables were rendered on the server. Mobile LCP moved from Poor to Good on every template.
T-3
Internal linking
A restored threat-intel hub in the main nav, plus contextual links from each report into the service that answers it, so research authority reaches Managed SOC, MDR and pentest pages.
T-4
Log-file analysis
Weekly parsing of raw access logs to see what Googlebot actually requests, so we could prove the redirects worked, find missed URLs and reclaim crawl budget wasted on dead paths.
§04Operations log · 6 months
Month by month.
M01
OP-REDIRECT
Logs pulled, redirect map built
Reconciled the Wayback index, backlink data and 2.3M log lines into a 1,912-row old→new map; one-to-one 301s, no blanket redirects to the homepage.
> 1,858 redirects staged
M02
OP-RESTORE
Redirects live, canonicals fixed
Shipped the map at the edge, purged staging canonicals, resubmitted clean sitemaps and requested recrawl of the 120 highest-value reports.
> 404s 1,604 → 212
M03
OP-MESH
Research hub rebuilt
Restored a threat-intel hub in the main nav; every report now links to the matching service (ransomware → MDR, IOC feeds → Managed SOC).
> Avg click depth 5.4 → 2.6
M04
OP-VITALS
Core Web Vitals sprint
Replaced the hero animation with a static SVG, subset and preloaded fonts, server-rendered the IOC tables and lazy-loaded charts.
> LCP 3.1s → 2.3s
M05
OP-WATCH
Crawl budget recovered
Weekly log reviews confirmed Googlebot had shifted to the live library; pruned 140 thin tag pages and merged duplicate CVE digests.
> Bot hits on 200s: 39% → 94%
M06
OP-HOLD
Monitoring and hand-over
Automated 404 and redirect-chain alerts in CI, plus a migration checklist so the next redesign can never repeat the incident.
> 404s held at 12
End of log · status nominal
§05Findings of fact · results
Declassified results.
Modelled scenario for a fictional business — not a client result. Rankings and traffic are never guaranteed; see our Terms.
Exhibit E-1 · Organic traffic vs pre-migration
+96%
Exhibit E-2 · 404 errors
1,870 → 12
M0
M1
M2
M3
M4
M5
M6
Exhibit E-3 · LCP (mobile)
4.6s → 1.9s
0sGood · 2.5sPoor · 4s5s
Exhibit E-4 · Inbound SOC leads
+58%
Before38/mo
Month 660/mo
Exhibit F · rankings register
| Query | Vol/mo | Post-rebrand | Month 6 |
|---|---|---|---|
| managed soc bulgaria | 880 | lost | #2 |
| ransomware threat report 2025 | 2,400 | lost | #4 |
| mdr provider sofia | 320 | #38 | #3 |
| nis2 compliance guide | 1,900 | lost | #5 |
| ioc feed free | 1,300 | lost | #7 |
| phishing kit analysis | 590 | #71 | #6 |
| пентест фирма софия | 260 | #24 | #2 |
| apt groups balkans | 210 | lost | #1 |
brezo.bg › blog › threat-intel › ransomware-2025
404 — Page not found | Brezo
The page you are looking for may have been moved or deleted. Return to the homepage.
brezo.bg › labs › ransomware-2025
Ransomware Threat Report 2025: Balkan TTPs & IOCs | Brezo Labs
Group-by-group breakdown of the ransomware crews targeting SMEs in the region, with downloadable IOC lists and MDR playbooks.
Open a new file
Get a plan like this
Planning a migration, or cleaning up after one? Signal starts with your logs and ends with every URL accounted for.