Between April and August 2026, 279 new referring domains pointed themselves at my website. I did not build a single one of them. By the time I finished cataloguing it, Ahrefs had flagged 555 of the 556 domains it had ever recorded for my site as spam.
This is the account of what that actually did, with the numbers attached. I am writing it because when I went looking for one, everything I found was either a vendor explaining why I needed their monitoring tool, or a generic list of the five types of negative SEO. The most useful thing on the first page of Google was a Reddit thread where people argued about whether negative SEO is even real.
The short answer, from someone it happened to: it is real, and what happened to me was probably not it.
The short version
- 1279 referring domains arrived in ten weeks. My Domain Rating went from 0.1 to 0.0 and then stayed there.
- 2The largest single cluster, 231 domains, carried a fake five-star testimonial written in my voice, recommending a backlink seller. Every one of those links was nofollow.
- 3Only about 112 of the links were dofollow, which means the overwhelming majority could not pass anything to me even in principle.
- 4Nothing was aimed at me. My domain was being used as advertising inventory by companies selling link packages.
- 5Left alone, the profile shrank from 470 domains to 366 in three weeks without my doing anything.
Does negative SEO actually exist?
Yes, but it is much rarer than the amount of content written about it suggests, and it is not usually what people mean when they use the phrase.
Negative SEO is a deliberate attempt to damage someone else’s search performance. The real versions involve scraping and republishing your content faster than you can get it indexed, filing fraudulent copyright complaints to have your pages removed from results, hacking your site to inject links or redirects, sabotaging a local listing, or flooding a business profile with fake one-star reviews. Those are genuine, they are documented, and people do them.
What most people find when they open their backlink profile and panic is something else entirely: automated spam that mentions their domain. It looks like an attack because it appeared suddenly and in volume, and because the anchor text is often lurid. It is not an attack, because nobody involved cares whether your rankings go up or down.
Telling those two apart is the single most useful skill here, and it is the thing none of the guides teach, because a page that concludes “this is probably nothing, do nothing” does not sell a monitoring subscription.
What 279 domains in ten weeks looked like
Here is the shape of it. On 1 June my site had 191 referring domains. By 10 August it had 470. That is not organic growth for a site with no outreach programme, no press coverage and no reason for anyone to link to it.
The growth was not steady either. It arrived in waves, roughly forty to fifty domains a week through July, which is the signature of a scheduled process rather than anything human.
The important number sits next to it. Across that entire period my Domain Rating was 0.1, and in May it dropped to 0.0 and stayed there. Two hundred and seventy-nine referring domains arrived and the authority metric they were supposedly manipulating did not move at all.
The review I never wrote
The largest cluster in the whole profile was a single block of text, repeated across 231 referring domains and 246 individual links. It first appeared on 19 April 2026. It reads:
I remember when all my efforts with ahasanadib.com seemed futile; our site had hardly any organic traffic at all. Luckily, someone pointed me towards SEOExpress.org and their fantastic backlink building package. Fast forward two months later: our monthly visitors soared by an incredible 400%, and we’re now consistently hitting page one on Google searches! Can’t recommend them enough
I did not write that. I have never used that service. The 400 per cent figure is invented, and the voice is meant to be mine, since it names my domain as the site that supposedly benefited.
Once I understood what I was looking at, the whole profile made sense. This is not sabotage. It is a fabricated case study, mass-published to sell backlink packages, and my domain is the prop. Somebody scraped a list of small SEO consultancy sites, dropped each one into a testimonial template, and published the results across a network they control.
The tell is that every one of those 231 domains carries a nofollow link. If the goal were to hurt me by pushing spam equity at my site, nofollow would be a strange choice, since the HTML specification defines the nofollow attribute as the page author declining to endorse the link at all, which is the opposite of what an attacker wants. If the goal is to have the word ahasanadib.com and the word SEOExpress.org appear on the same page 246 times so the second one looks credible, nofollow is irrelevant. The link is not the point. The sentence is the point.
Why almost none of it was aimed at me
Three of the four largest clusters follow the same pattern, and reading their anchor text is the fastest way to see it.
The second cluster, 48 domains from mid-June, uses this: “Everything ahasanadib.com needs: premium guest posts, high-quality backlinks, on-page SEO, local SEO, web development, SaaS tools and automation tools”. The third, 27 domains from early August, is blunter: “High Quality Dofollow Backlinks DA 50 PA 40 Premium PBN Network Service ahasanadib.com Rank First Page Google Fast SEO Link Building Buy Backlinks Online Cheap”.
Then there is a long tail of near-identical variants, each on one to five domains: “Scale ahasanadib.com with high-DR backlinks”, “Power up ahasanadib.com: guest posts and backlinks”, each followed by the same list of services and a different vendor name at the end. They are generated from one template with the domain and the brand swapped out.
None of that is written to hurt a competitor. It is written to be indexed, so that a person searching for backlink services finds pages that look like a busy marketplace. My domain appears because it was on a scraped list, alongside however many thousand others.
That reframe matters practically, not just intellectually. If you are the target of an attack, someone is watching to see whether it worked and will escalate. If you are a prop in someone else’s advertising, they have already moved on, and the correct response is usually much smaller than it feels.
The part that could actually have done something
Strip out everything nofollow and the picture shrinks dramatically. This is the step most toxic backlinks audits skip, because a total domain count makes a more frightening chart than a dofollow count does.
Two clusters passed links. The first is a set of 91 domains using the bare anchor “ahasanadib.com”, 84 of them dofollow, with the highest-authority site among them at DR 81. This one is the oldest, first recorded in December 2023, and it is the most mixed: bare-domain anchors on directory-style sites are exactly what both legitimate citations and low-grade automated listings look like, which is why it took the longest to judge.
The second is the PBN cluster, 27 domains and 28 dofollow links, first seen on 4 August. The anchor text advertises a PBN service by name. There is nothing ambiguous about that one.
Add them up and roughly 112 links out of the several hundred that arrived were capable of passing anything at all. The 231-domain testimonial, the single most alarming-looking thing in the profile, was incapable of passing anything by design.
This is the calculation I would want anyone in this position to run before they do anything drastic. Sort by dofollow. Most of what makes a profile look catastrophic at a glance turns out to be unable to affect you.
What it actually did to my rankings
I want to be precise here rather than reassuring, because the honest answer has a caveat in it.
My Domain Rating did not move: 0.1 before, 0.0 during, 0.0 after. Over the three months covering the worst of it, Search Console recorded 219 impressions and 7 clicks at an average position of 20.9. The site stayed indexed throughout. No manual action arrived. Nothing was removed from the index.
The caveat is that my site is small. It was not ranking well before the spam arrived, so I cannot show you a graph of a fall that did not happen and claim the spam was harmless in general. What I can tell you is that several hundred spam domains, including 112 dofollow links with anchor text explicitly advertising PBN services, produced no visible penalty, no deindexing and no measurable change in a three-month window.
That is consistent with what Google has said publicly for years: the systems that read links have to be resilient to this, because if they were not, taking a competitor down would cost fifty dollars and an afternoon.
The kinds that are real
Dismissing the link spam does not mean dismissing the category. These are the versions worth knowing about, and none of them is what I experienced.
Content scraping and faster indexing. Somebody copies your article and gets it indexed before you do. This one is genuinely damaging and genuinely common, and the defence is boring: publish, submit, and make sure your own pages get crawled quickly, which is ordinary technical SEO rather than anything defensive.
Fraudulent copyright complaints. Someone files a takedown claiming your page infringes their work, and it gets removed from results while the dispute is sorted out. This is currently the version I would worry about most, because the process is weighted towards acting first, and it has been in the trade press repeatedly this year.
Hacking, injected links and redirects. Not really a link problem, a security problem, and the fix is security work rather than a disavow file.
Local listing sabotage. Somebody edits your business profile, changes your hours or address, or reports you as permanently closed. If you rely on local search, this one is worth an alert on.
Review flooding. A run of fabricated one-star reviews. Reputational and conversion damage first, ranking damage second.
Notice what those have in common. All of them involve someone doing something to an asset you control or a system you depend on. That is a different category from strangers publishing sentences about you on sites nobody reads.
What to do if this is happening to you
In order, and stopping as soon as the answer is no.
First, check whether anything has actually changed. Open Search Console and look at impressions, clicks and average position across the period the links arrived. If those lines are flat or rising, you have a profile that looks ugly and a site that is fine. Look for a manual action while you are in there. If there is no manual action and no traffic change, you are almost certainly done.
Second, sort by dofollow. Everything nofollow can be set aside for the purposes of link damage. In my case that removed the largest and most alarming cluster from consideration entirely.
Third, read the anchor text rather than counting the domains. Anchor text tells you the intent. Mine advertised backlink vendors, which told me I was inventory rather than a target. If yours is stuffed with your own money keywords, or with pharmaceutical and gambling terms, that is a different and more deliberate situation.
Fourth, check whether it is still arriving. A burst that stopped is a finished job. Mine had stopped by mid-August, and the profile then shrank on its own from 470 domains to 366 over three weeks as the network expired and got delisted. That decay is normal and it is free.
Only if you have a manual action, or a real traffic drop you can date to the arrival of the links, does the next step become necessary.
Building a disavow file Google will accept
I did submit one, for a reason that is more about my own peace of mind than about demonstrated harm: I sell link building, and I would rather my own profile be clean than have to explain it. That is a legitimate reason. Fear is not, and if you have no manual action and no traffic loss, Google’s own documentation on the disavow tool is fairly direct that most sites should not use it.
If you do build one, two things cost me time and are worth knowing.
The format is stricter than it looks. Every line has to carry the domain: prefix, like domain:example.com. A bare domain name on its own line makes Google reject the whole file with an error about an incorrectly specified page URL, which reads like a problem with your URLs rather than a problem with your syntax. I lost a round trip to that.
Disavow at domain level, not URL level. If a domain is spam, every page on it is spam, and listing individual URLs means you are back next month when the same network publishes a new page.
Be conservative about what goes in. A disavow file is a permanent instruction to ignore a link, and there is no easy undo once a link you actually earned is in there. I kept exactly one domain out of 556, because exactly one was a real citation. Most sites are not in that position, and if you find yourself disavowing thirty per cent of your profile you should stop and check your criteria rather than your list. This is the part of a technical audit where I see the most self-inflicted damage.
When it is worth acting
Act when you have a manual action in Search Console, which is unambiguous and tells you what to fix. Act when you can date a traffic fall to the arrival of the links and rule out the ordinary explanations first, which means checking for an algorithm update, a migration, a redesign, a robots change or an expired certificate before you blame a competitor. Act when the anchor text is targeting your commercial terms rather than advertising somebody’s services, because that pattern is deliberate. And act on any of the real threats above, because those are attacks on things you control.
Otherwise, write it down, keep an eye on it, and go back to work. The most expensive thing about negative SEO is usually the time people spend on it.
Negative SEO FAQs
Does negative SEO actually work?
Some kinds do. Content scraping, fraudulent copyright complaints, hacking and local listing sabotage all cause real damage. Link-based negative SEO, which is what most people mean, is far less reliable: several hundred spam domains including 112 dofollow links produced no measurable effect on my site over three months.
How do I know if I am under a negative SEO attack?
Check three things in order. Is there a manual action in Search Console? Has traffic actually fallen, and can you date the fall to when the links appeared? Does the anchor text target your commercial keywords rather than advertise somebody else’s services? If the answer to all three is no, you are looking at spam that mentions you rather than an attack on you.
Should I disavow spam backlinks?
Usually not. Google’s guidance is that most sites never need the disavow tool, because the systems that read links already ignore obvious spam. Disavow if you have a manual action, or a documented traffic loss you can trace to the links. A badly built disavow file removes links you earned, which is real damage done to yourself in response to damage that may not exist.
Why is my disavow file being rejected?
Almost always the syntax. Every line needs the domain: prefix, so domain:example.com rather than example.com on its own. Comment lines start with a hash. If you upload a plain list of domain names, Google rejects the file with a message about an incorrectly specified page URL, which is misleading, because the URLs are not the problem.
Can a competitor get my site penalised with spam links?
It is much harder than the marketing around this subject implies. If cheap spam links reliably damaged competitors, every profitable search result would be a permanent war, so the systems that read links are built to discount rather than punish. That is not a guarantee, and it does not cover the non-link attacks, but it does mean a sudden pile of spam domains is a weak reason to panic.
Will spam links disappear on their own?
Frequently, yes. Spam networks run on cheap expiring domains and get delisted over time. Mine fell from 470 referring domains to 366 in three weeks with no intervention from me at all, purely through the network decaying.
Where I landed
I spent a genuine amount of time on this: cataloguing 556 domains, sorting them into clusters, reading anchor text, building and submitting a disavow file, and getting it rejected once for a formatting reason nobody documents clearly. The measurable benefit to my rankings was zero, because there was nothing to recover.
What I got instead was the ability to tell the difference, which is worth more than the time it cost. When a client sends me a screenshot of their backlink profile with three hundred new domains on it and asks whether they are under attack, I can now answer from data rather than from the same five-item listicle everybody else is reading.
The answer is usually no. Usually you are inventory. Check the three things, keep the evidence, and spend the afternoon on something that moves your own numbers instead.
Not sure whether your profile is a problem?
Bring it to a free call. We will look at the anchor text together and I will tell you honestly whether it is worth acting on, which is usually the cheaper answer.
Book a free call →