I have been monitoring this since December 2016 and it was on and off, but since January 2017 it was pretty much constant, this is exactly when the message "Jan-22: Search Console performed and infrastructure update that may cause a change in your data" appeared.
I have started to see links to our site from sources like the following:
hol .es - 69,223
zzz .com.ua - 26,070
hys .cz - 11,929
Just to clarify, when I click to see the actual links to our site I see that there is only one page on our site that all 69,223 link instances point to, but the most interesting part of it all is that when I click on the url to see those links, what I see is the following:
6ya.hol .es/balalara-arnalan-kz-turali-nder-mp3-skachat-besplatno.php
Via this intermediate link: transportationinchina .org/url?q= erketai .kz/balalarga/balalar-olenderi/balalar-aitatin-olender/&sa=U&ved=0ahUKEwjkz7DOs87RAhXp1IMKHWgVA14QFgg4MAY&usg=AFQjCNHca71CRuIVHi2tz-6iAPR3GNEnDQ
As you will notice, not a single one of the links is actually point to the page in question. More to it most of this is either non-existent page or if I dig into the source code to find any instances of linking to our site, I cannot find any links whatsoever.
Just to clarify, I am not on wordpress and we have not been hacked, it looks to me that it is some kind of anomaly in GSC.
Any ideas or input to shed a light on this?
[edited by: goodroi at 1:29 pm (utc) on Jun 28, 2017]
[edit reason] Delinked spam urls [/edit]