Site under negative SEO attack right now. Trying to keep G updated.

[trezcan]

I have a review site in a very competitive niche, and I am experiencing a negative SEO attack that looks to have started the end of July / early August. I finally noticed this week with the help of ahrefs.com and CognitiveSEO.

Ahrefs is finding between 50-100 new spam links every day. In the morning I add the new ones to the disavow list and upload to all 4 versions of my site in GWT:

http://domain.com
http://www.domain.com
https://domain.com
https://www.domain.com

I have scoured the web and read everything I can find, but its all such high level and generic content that it is hard to find definitive info on what to do. The site is relatively small, so the link profile was already little. These spam links are absolutely dwarfing the natural links. My fear is that Google is finding way more than ahrefs and cognitiveseo, but I could be wrong there.

So is uploading a new copy of disavow daily a good idea? If I waited even a week between updates, there could be close to a thousand new links.

Any advice on the best approach to mitigate this?

Thanks in advance.

[FranticFish]

I've never seen anything that said updating daily was bad, I'd update as often as I had new data.

There anything about the link anchor text, or the content surrounding it, or the sites it's placed on, that would allow you to try to develop a query for Google that might uncover more of these and see if there are more that the link research tools aren't getting?

Is GWT showing any links that the third party services aren't?

[Shai]

As above, submit a disavow as often as you like. Very important in the beginning stages of link discovery. Make sure you use GWT and majestic as well as the ones you already using.

Can you tell us a little more about the anchor text that is being used? Is it the ones you are targeting or ranking for? Or are they non-relevant #*$! type anchors? Where are those links pointing to? Money pages? Home page? Are they mostly no followed pingbacks and comments?

Sometimes people who find weaknesses in your install will inject a few pages and then build thousands of links to those in an attempt to ride your own domains authority. This parasite seo techniques can be dealt with in slightly differing ways.

In the meantime, disavow at least once a week.

[McMohan]

Ahrefs is finding between 50-100 new spam links every day

Are those links from 50-100 unique domains or pages?

[Robert Charlton]

Excellent suggestions by Shai and FranticFish.

To expand on one thought... if those links are targeting, say, money keywords that you don't associate with your site, then also check your site with fetch as Googlebot to make sure you haven't been hacked.

Hacking might include additional target text or pages to work with the spammy inbounds, and/or new content including outbound links, and it is usually done so it's visible to Googlebot but not to you.

[Rob_Banks]

Jeez.
Nobody sees an issue with submitting a disavow to 4 different domains?
Figure out which is the main domain, establish preferred domain in WMT and make sure internal site redirects reflect the same site.

Google has most likely crawled all the links that exist, including the ones that WMT and other private services aren't showing at this time. McMohan implies you should be using domain:example.com disavow rather than example.com/2009/cats/page disavow Domain disavow is much more efficient, make sure you know how to use it.

Shai mentions injections. Big difference between someone pointing links to your site and someone pointing links to pages they have injected on your site. You need to supply a bit more information to get better responses. I'd agree with the once a week disavow concept.

FranticFish asks the basics. The more information you can provide on the type of links you don't want makes it easier for others to make educated opinions on your issue.

My .02 - figure out which site is yours. Get everything sorted so all variations point to the right site. Then worry about the potential spam links.

[Robert Charlton]

Nobody sees an issue with submitting a disavow to 4 different domains?
Figure out which is the main domain

Rob_Banks makes me ask a question that should have been obvious, but kind of slid by. Here it is with different wording from his post, maybe slightly different emphasis, in large part the same issue....

Is the OP concerned about spam content, or is he concerned about non-canonical links? The canonicalization should be handled by 301 redirects using mod_rewrite (assuming apache), so these inbounds don't mess up how users or the engines perceive what your canonical is. The rel=canonical tag might help with the engine indexing, but I would strongly suggest canonicalization on the server.

So yes, absolutely pick a canonical form and get that established, whatever else is done.

[trezcan]

There anything about the link anchor text, or the content surrounding it, or the sites it's placed on, that would allow you to try to develop a query for Google that might uncover more of these and see if there are more that the link research tools aren't getting?

That is a good sugestion. There is certainly patterns in the types of links with some of them. There are about 10 templates that seem to appear a lot.

One is a certain type of user profile that can be created on websites using a specific template. I am trying to determine which template it is, but I hadn't seen it before so its proving a little difficult. Another that pops up a lot seems like its an exploit that allows them to add pages to peoples websites. They use some sort of content spinner software that sort of rewrites a content piece and then plasters links in them. Some of these pages will have every link in the piece point to me, others will have multiple domains linked.

There is a pattern, but there is also a lot of variation.

Is GWT showing any links that the third party services aren't?

I am not sure yet. The export from GWT has about 18k links right now, and I haven't been able to sort by domain only yet. The export gives me every individual link so it swamps the report.

Can you tell us a little more about the anchor text that is being used? Is it the ones you are targeting or ranking for? Or are they non-relevant #*$! type anchors? Where are those links pointing to? Money pages? Home page? Are they mostly no followed pingbacks and comments?

The anchor text doesn't target anything of real value for me, but there are certainly different patterns. The site has hundreds of content pieces, and does a lot of long-tail traffic.

There is a review about a specific company on the site, and in a roundabout way, their name seems to be one of the strongest patterns. When I say roundabout I mean their name is also a common word with a generic meeting, and that word comes up more than most other words.

Example:

Imagine the company was Apple. Keywords like "apple sauce" "apple slicer UK" "apple slices review"

These probably make up 10-15% of all the links. Their pattern stands out more than most.

They point to what appears to be arbitrary pages on the website. Including the homepage, there about 15 random pages most of the links point to. They are insignificant pages in the grand scheme of things.

There are over a thousand nofollowed links that have also been added. I haven't addressed them yet. I would say the split between do follow and nofollow is roughtly 50/50.

Are those links from 50-100 unique domains or pages?

Domains. In fact, these are only the dofollow ones. I haven't even started with the nofollows yet (I keep finding competing info on whether they matter or not.)

To expand on one thought... if those links are targeting, say, money keywords that you don't associate with your site, then also check your site with fetch as Googlebot to make sure you haven't been hacked.

Hacking might include additional target text or pages to work with the spammy inbounds, and/or new content including outbound links, and it is usually done so it's visible to Googlebot but not to you.

Great suggestion. Thanks.

Nobody sees an issue with submitting a disavow to 4 different domains?
Figure out which is the main domain, establish preferred domain in WMT and make sure internal site redirects reflect the same site.

I have the preferred domain tagged in GWT. I can't find the sources right now, but I had read that you should have all four variations in GWT - the primary is:

https://www

Yesterday I could have sworn I watched a Matt Cutts video saying something along the lines of "If you are really concerned, just go ahead and upload the disavow to all variations." But I can't find that now.

Google has most likely crawled all the links that exist, including the ones that WMT and other private services aren't showing at this time. McMohan implies you should be using domain:example.com disavow rather than example.com/2009/cats/page disavow Domain disavow is much more efficient, make sure you know how to use it.

I am disavowing the domains.

Shai mentions injections. Big difference between someone pointing links to your site and someone pointing links to pages they have injected on your site. You need to supply a bit more information to get better responses. I'd agree with the once a week disavow concept.

I haven't noticed any links to pages that I didn't publish.

Thank you all for the insight thus far. I really appreciate it.

[trezcan]

Oh, one more keyword variation that pops up a lot is forex:

forex trading, forex strategies, etc.

[Shai]

The vast majority of times we have seen anchor texts such as [forex trading] which is not related to the host site, it has turned out to be parasite SEO. Either via clear injection of pages or cloaked. The links that have anchor text [forex trading]... where are they pointing to? Definitely fetch those pages as Robert Charlton suggests ASAP.

With regards to the http. https www and other variations, its always good practice to have them all listed in your WMT account and also to add the disavow to at least the www/http:// variations. If your site has https:// then that also. This has been confirmed by John Muller and Matt Cutts on several occasions and although I agree it may be going a little overboard, as it only takes a couple of minutes to do, surely its better to remove that variable from the equation?

[trezcan]

The vast majority of times we have seen anchor texts such as [forex trading] which is not related to the host site, it has turned out to be parasite SEO. Either via clear injection of pages or cloaked. The links that have anchor text [forex trading]... where are they pointing to? Definitely fetch those pages as Robert Charlton suggests ASAP.

So I fetched the two pages with the most inbound links overall (from the spam links). The first one seemed ok. I scoured the code google sees and didn't notice anything out of place.

The second page led me on a bit of a goose chase. I noticed in the render that the name, email and website in the comment form were pre-filled. When I visited the site from an incognito browser, sure enough it was pre-filled. Here is a screen grab:

[imgur.com ]

The rendered code presented by google had the same values inserted in the comments section (value=). I remember seeing this in the past once (before these links started showing up) but it went away and I forgot to dig into it. So it may be unrelated. It only appears on some pages right now.

Regarding the forex links, there about 50 or so keyword variations coming from around 75-100 domains that ahrefs has found so far. There seems to be a pool of 15-20 pages most of them link to, but the handful I spot checked don't seem to have anything out of the ordinary in the render from GWT.

[not2easy]

Not to move off topic but to expand on Rob's and Robert's comments -just my 2 cents - it is not really best practice to list all forms of your domain in GWT if they cannot be reached because you are properly rewriting all to your preferred domain. Canonical rewrites are the best practice. If you land on http://example.com, you should be 301 redirected to https://www.example.com and not even realize it. That would make multiple versions of disavows unnecessary. Search the forums here for canonical rewrite, or www rewrite or even https rewrite and you can see how easy it is to avoid having four versions (or more) of your domain being crawled. I have seen this fix ranking problems in more than one case - when no other significant changes were done.

[trezcan]

Not to move off topic but to expand on Rob's and Robert's comments -just my 2 cents - it is not really best practice to list all forms of your domain in GWT if they cannot be reached because you are properly rewriting all to your preferred domain. Canonical rewrites are the best practice. If you land on http://example.com, you should be 301 redirected to https://www.example.com and not even realize it. That would make multiple versions of disavows unnecessary. Search the forums here for canonical rewrite, or www rewrite or even https rewrite and you can see how easy it is to avoid having four versions (or more) of your domain being crawled. I have seen this fix ranking problems in more than one case - when no other significant changes were done.

The cononical rewrites are set up correctly. All forms of urls forward to https://www.example.com. I was always under the assumption that having the final landing only in GWT was correct. However, some time about a year ago I came across info saying to put them all in GWT anyways. I believe it was from the google webspam team but can't find the source right now.

[not2easy]

They request that you add all domains if they are finding URLs that are not redirecting as expected. If you type in a URL to a page within a folder - http://example.com/foldername/page.html for example - and it does not redirect you to the [www....] version via 301 redirect as expected then you need to add other versions of the domain.

Google advises to add all forms of the domain in case they are not all properly redirecting. When you are in the GWT "Search Console", look at those other versions you have listed there and see if anything at all is being reported there. If it is, the URLs are not all being redirected correctly. If nothing is being reported there, then all URLs are redirecting properly and there is no need to disavow for that version.

[seoskunk]

If someone really wants to damage your site, I don't think there is allot you can do about it to be honest. At the end of the day its Google that will decide if you get a manual penalty or algorithmically penalised. I don't suppose your site will be missed and there will be a public outcry, after all there are plenty more websites to fill any niche.

I wouldn't worry about it as its to late to do anything about it anyway. Best thing to do in my opinion is forget it.

[netmeg]

Have you done a site:yourdomain.com just to see if everything looks mostly okay? I'd go five or ten pages in, probably.

[Rob_Banks]

@seoskunk,

It took two tries for me to get a site with a manual penalty released from that penalty. I got the message that the penalty was removed yesterday, I haven't seen improvements yet, but I'm sure they will come. The penalty didn't appear to be based on injected pages on the site, but more on the links pointing to those pages. The point being that you can get manual penalties lifted with sufficient documentation.

Algorithmic penalties is where I think Google jumped the shark. No, I'm not going to explain that.
In many ways, I believe they've embraced a YouTube perspective of the world where popular and trending are important while significant information doesn't get the page views to be considered important.
It really makes no difference however, as we deal with the environment as it changes, yes?

Apologies for the thread semi-hijack.

[Nutterum]

I have a question about negative SEO. I`ve seen link bombs being pushed in a very short order. Like more than 50k links in less than a week. From what I gather these are largely ignored by Google, but still the best practice is to disavow them. My question is, how can one easily disavow 50k backlinks?

[Splugged]

Hello Trezcan,

for what is my own experience: disavowing those links is pretty unuseful. I don't know why and how but my site is under attack since August 2013. I receive from 10K to 50K spammy links every month (no links from the past two months, luckily). I tried to disavow them all but nothing seems to work.

As for now, my business is completely destroyed.
I asked Google directly (JMu) on what to do on this case (early 2014) providing them also all proofs I had my hand (in Penguin's time I should be a fool doing such things, don't do?).
They told me: "Contact all webmasters asking them to remove all SPAM"... 50K per month? "Otherwise, disavow them but prior delete those backlinks"

Result?
From 3K+ unique per day to 5(five!) to 30 per day...

I'm destroyed, nearly killed for doing NOTHING! I swear on the son that I will never have, and I would so!

Killed .
I take this opportunity also to humbly ask for help ( in private) but I can not give money because now close to bankruptcy ...

[Discount Mall]

Hi Splugged,

I really feel your pain. I was looking all over your post to see any clues that this post was written by me.
We are in the same boat and i swear on the 2 sons and 2 daughters i have. It is frustrating to have a business since 2001 and all the sudden (in my case, started around the middle of 2013 and start going down) you need to start looking for another job to feed your family.

I never gave up on it and I have been searching high and low with my limited resources without any luck of finding the problem or the solution. I want to wish you the best of luck buddy and if i ever find out anything i will be glad to share it with you.

[FishingDad]

Having been the wrong side of a spam links penalty 2 years ago we are now ok, not that it effected us badly compared to others I have read, I am still sceptical.

Google have made their system so it is possible to sabotage a business, an organisation, a government any web site?

Their many things but I refuse to believe Google provides a platform and support illegal activity.

[Discount Mall]

This is the bad side of doing internet business, you are not a 100% driving your success and failure.
I wish Google will provide some information when something like this happen, at least webmaster/business owner know what to fix if something require fixing, after all, not all of us are a good SEO's.

[trezcan]

Have you done a site:yourdomain.com just to see if everything looks mostly okay? I'd go five or ten pages in, probably.

I reviewed all the pages in Google's index. Nothing out of the ordinary.

[seoskunk]

@Rob_Banks

Google will either penalize a site or not and that's out of your control. Google will if not manually penalize enforce algorithmic penalization. That again is out of your control.
Best thing to do is forget things out of your control.

[Discount Mall]

At least when you know that there is a penalty you can work on getting out of that and that might take time, at lease you know that the count down has started.

When there is no penalty listed and your site seems to be in good standings, indexed in Google, crawled in a regular basic, has a PR of 3/10 and holding that for years, have a fairly fast website that can be browsed by multiple devices including mobile device but there is less than 10% of the traffic i used to get is a mind boggling.

It is like being sick and in one case you know the cause and you taking medication for and the second case you do not know why you are sick and you can not treat it but you are hoping that it will go a way by itself.

[Rob_Banks]

My question is, how can one easily disavow 50k backlinks?

You can't easily.
In WMT, you have three choices of obtaining backlinks, the left choice is domains, the middle is more sample links(I think) and the right is latest backlinks. I download the domain list which is ordered by number of links, remove any domains that are legitimate or desirable links, then alphabetize the list.

Then I add "domain:" to the beginning of each line using search and replace.
That gives me a list that will disavow subdomain variations along with folder and page variations.
Then I'll use private services and look for more domains which is pretty easy to check against an alphabetized list.
Once a week I check the WMT "latest backlinks" and add new undesired domains to my domain disavow list, then resubmit.

Google cautions that mistakes using this tool can be harmful, double check your work.

[Planet13]

Just a reminder that according to John Mu, the disavow tool can take months to actually make a positive affect on algorithmic penalties, if I remember correctly from what he said in a video (and I am 99% sure I remember correctly).

[Discount Mall]

If a site is penalized for other sites linking to it, would that be listed under the Manual Actions?

[Rob_Banks]

Google will provide a notification in WMT if a site has a manual action. If the site isn't signed up/verified with WMT, you can do a Google search for "site:example.com". If nothing from the site shows up, that is usually a pretty good indicator of a manual action(penalty).

Algorithmic adjustments have no notification or method of reconsideration. If it is suspected that inbound links may be the problem, some people audit the inbound links and disavow the links/domains they think might be problematic. As Planet13 mentioned, it's not always a quick or guaranteed process.

[Discount Mall]

Thanks Rob,

I have nothing under manual action, my site is indexed, the only problem is the lack of traffic. Some suggested that inbound links could be the problem, looking at that in WMT there are links coming from

(Mod's note: Specifics not allowed. I have changed or removed some of the following. See my followup post on m.biz)
m.biz - 130
209.xx.x.123 - 100
tackyplace-name.fl.us - 69
scraped-stuff4fun.com - 43
viewsites-like-we-scrape.cctld - 43
and more ......

(by the way, these links was never asked for, as a matter of fact most of them can not be found)

I submitted a disavow links/domain last month and i am waiting.

[edited by: Robert_Charlton at 10:01 pm (utc) on Sep 13, 2015]
[edit reason] removed specifics, per forum Charter [/edit]