Checklist when hit by negative SEO?

[McMohan]

The website is under severe negative SEO right now. It is in a highly commercial niche, occupying 1-2 positions for the main niche keyword for over 2 years. Several spam links are being built (perhaps from a competitor who couldn't unseat my site), with the exact keyword in anchor text in about 50% of the links. Daily I am unearthing about 50-60 new domains.

I have looked for backlinks from GSC and Majestic tool and disavowed the domains as I find them daily. I think this is all I can and need to do. Anything else to keep in mind?

[Shai]

I would also use Ahrefs for the initial 'explosive' period of around 3 to 6 weeks. <snip> I would do a disavow daily if possible to begin with. The trick is to try and disavow them before Google finds them. Obviously not always possible but the more you catch the better it is. Don't worry about it too much. if you make sure you keep on top of it, I doubt it will have any damage at all.

Is the attack only link based? Are you regularly checking content duplication? Anything in the logs that could help point out who carried this out? If you can prove the origins of the attack, you will be surprised what you can find out with a few letters from a legal company (if its worth it that is)

[edited by: Andy_Langton at 6:33 pm (utc) on May 9, 2016]
[edit reason] See stickymail [/edit]

[McMohan]

Shai - We are disavowing daily as we find the links. So far ranks haven't been affected, but it is early days still. Perhaps Google might shoot a warning link spam message in GSC.

So far the links are pointing only to the homepage, since that is the page that ranks for all the important keywords that competitors want to sabotage. Haven't checked logs yet. Thanks for the suggestion.

[3zero]

If the sites are newly created you will find a footprint if you look hard enough. And that will track you back to the cause of the issue.

[aristotle]

These could just be links that spammers are creating to try to make their spam look legitimate by linking out to some reputable sites. This has been going on for years, with thousands, or even millions, of links being created everyday, often by auto-generation programs. So it might look like a negative SEO attack, but not be.

[McMohan]

Aristotle - If I understand you correctly, you think it might be that the spammers have added links to their own site from these sites along with links to reputable sites such as mine?
I don't think that might be the case for two reasons. 1. I don't see popular brand name sites linked from these pages, which would have given them even more legitimacy. 2. If they think these links can help their ranks, they wouldn't link to a competitor and help his ranks too! All that I see are thousands of pages linking to my site suddenly in the last week or so, with meticulously thought out Anchor text, nearly half of them using "Money Keyword" and the other half random text, Names, Chinese alphabets etc.

[McMohan]

Update
After I started this thread, another of my site, in a similar niche, is attacked too. Same negative SEO strategy as before. There is no obvious connection between the sites to tell the owners are the same, unless someone looks for it very hard. I am not sure if it is related, but the main money keyword that was ranking 3-4, has dropped to 8 today.

[Robert Charlton]

McMohan, I remember that in December you were beginning to bear the fruit of lots of hard work and were in the process of recovering, so what a drag. :(

Since you're asking for a checklist, here are some quick thoughts that might not apply, but they may be helpful....

Negative SEO... crappy backlinks intended to look like spam

If they think these links can help their ranks, they wouldn't link to a competitor and help his ranks too!

That's been my reaction to most negative SEO talk I hear as well, so I assume that if this is a negative SEO attack, the links would be mostly crap links. Fiverr link packages are the most likely negative SEO attack vector. It doesn't really make sense to point good links at you. Is this what you see happening?

Check for possible hack that might be coming

All that I see are thousands of pages linking to my site suddenly in the last week or so, with meticulously thought out Anchor text, nearly half of them using "Money Keyword" and the other half random text, Names, Chinese alphabets etc.

The carefully thought out anchor text may suggest the possibility of something else. When a lot of target links are pointed at you, there's the possibility that there are plans for your site to serve as a target or relay station for a multi-faceted hack attack.

Check to see if there are pages or text added surreptitiously to your site as a target for those inbound "Money Keywords", and also see if any outbound links have been added. Since any hack is likely to be cloaked as Googlebot, view and explore your site as Googlebot, spidering with something like Screaming Frog's user agent switcher. Not to worry... just consider the possibility and put it on the checklist.

Also, of course, keep your servers patched, etc.

Check to see if your content is being scraped
If an exploit is being planned, the attacker might be duping your content. Use Copyscape to check.

Proxy hijacking
It seems to be going around. The hackers pretend that they are Googlebot and hijack your site. For pre-emptive defensive measures you should take to verify Googlebot, check this thread and the references it cites....

Proxy Server URLs Can Hijack Your Google Ranking - how to defend?
June, 2007
https://www.webmasterworld.com/google/3378200.htm [webmasterworld.com]

And yes, I would keep disavowing. Hope this helps. Please keep us posted.

[McMohan]

Robert, the second site that came under attack is that site which I reported in December for updating disavow file by mistake and traffic soaring! Glad you remembered that instance. The site went on to do very well and had its best ranks ever until this attack.

Thanks for the pointers!

so I assume that if this is a negative SEO attack, the links would be mostly crap links.

Yes, they are as crappy as they get. Most likely Fiverr kind of a gig.

When a lot of target links are pointed at you, there's the possibility that there are plans for your site to serve as a target or relay station for a multi-faceted hack attack.

I am almost certain it is not a hack attack. I am not saying so because no content or links are injected yet. It might happen later if they have found a loophole to inject some script. But I have seen such instances and it is most commonly Pharma hack. These anchor text are keywords my site ranks well for.
They are trying to Penguinize my site since Google knows those are the keywords my site stands for and most likely to have the temptation to build links around those anchor text. For a medium site, it distorts my anchor text distribution if you were to analyze the backlink. In the absence of disavow recourse, I wouldn't bet on Google identifying it as an instance of competitor sabotage and taking care of my ranks. It is a competitive ecom niche. If you couple that with Payday loan algorithm for competitive niches (my niche comes close to it), it makes for a potential penalty on my site.

[Shai]

I have had a look at the site and it definitely looks like a Negative SEO attack. A cheap and unsophisticated Fiverr one at that. Just lots of comment spam all using the main keyword of the site as anchor text. The site is in a very 'cut throat' niche. 95% of the links are NOFOLLOWED and the link velocity suddenly increases on the 2nd of May (2200 links discovered) where's before that hardly any link growth occurs. The spike is massive and obvious. It no natural occurring garbage links. Its a clear attack and done by someone who obviously has no clue (which is obviously a good thing.)

I would really not worry too much. I would disavow everything that comes across at domain level and keep at it. It will soon die down. If you have the inclination, you could try and trace it back by looking at the logs and seeing if you can see any unusual activities around 1 - 3 weeks prior to the link discoveries. You may be lucky and find referrals directly from Fiverr service provider.

I would also say that having had a look at your link profile, I would not be too quick to attribute any rank loses to this attack only. There are other issues that could have caused such rank drops and Google has been particularly turbulent over the last few days.

[3zero]

@Shai - Funny, very funny

I not gonna bow out of this discussion because I dislike paydayloan type industries so am not motivated to help.

[Shai]

Not sure anything I said meant to be funny. Also, the niche is NOT paydayloans and not related to it in any way so your departure may be a little premature. (it is as competitive and cut throat though)

[McMohan]

Yes, Shai, I don't see how could your comment be thought funny!
3zero, I am not sure as SEO professionals we choose what we promote. We promote what comes our way, as long as what you promote is not illegal. Competitive niches are not necessarily won through blackhat, if that is the reason why you don't like them.