Disavow Tool, and incoming link of hacked site

[vphoner]

Last spring I had a massive drop in SEO. This week I got a MOZ backlink profile and saw all the incoming links and page authority rankings of each page. I visited them one by one and found one site to be totally hacked with many warnings of Hijacked site coming from my Anti Virus and Malware software. So for the first time I used the Disavow tool on that site.

According to Moz this link was first noticed in early spring, just before my drop in rankings.

Could this hacked incoming link site be the cause of a drop in SEO rankings? Was my action correct to Disavow?

Has anyone used Disavow successfully, and had a big increase in traffic after using it? I guess the question is what links to disavow. In this case it was a no brainer, I believe.

[Robert Charlton]

vphoner, it sounds like what you did was a prudent thing to do. Since you hadn't received any word of a manual action from Google, though, I'm not sure it was necessary. No harm, however, in disavowing a clearly hacked site that's linking to you.

The subject of disavow has come up several times in the forums recently, and the following thread, which was one of the sources of my info, quoting Gary Illyes (and subsequently linking to comments by John Mueller) seems to be the latest word. My emphasis added to highlight Gary's quote....

Disavow tool being played down by Google
Nov 8, 2017
https://www.webmasterworld.com/google/4876055.htm [webmasterworld.com]

From Pubcon today, Google seemed to be playing down the use of disavow tool.
"If you do not have a manual action then you do not need to submit a disavow"

I myself don't use MOZ.... Page Authority is not a Google metric, and in a great many ways PA isn't similar to PageRank. In the past, I have used Majestic's fresh index to trace backlinks to a freshly hacked site back to their sources. At the time MOZ was not showing these links, and the hack was very fresh.

I have not used disavow in a very long time.

[JesterMagic]

You haven't hurt anything by disavowing the one link but then again Google probably has ignored the link already.

If your drop corresponds to a Google update then most likely it is not a bad incoming links issue but some other ranking factor that Google has decided either is more important or less.

[keyplyr]

As said, probably doesn't hurt you to use the disavow tool.

However, IMO there's plenty of evidence Google stopped applying any value to it.

I removed my disavow file from my 3 sites well over a year ago and did not notice any change at all.

[vphoner]

Thanks for the replies. I actually found 3 more sites that sent my antivirus and malware software screaming. So a total of 4 sites in the disavow file now.

[keyplyr]

If I came across sites like that, I'd use the Report This Site to Google: [support.google.com...]

[Robert Charlton]

I actually found 3 more sites that sent my antivirus and malware software screaming. So a total of 4 sites in the disavow file now.

vphoner - a quick thought here. If you've got a bunch of malware laden sites all linking to you, it might suggest that you may have been chosen (generally by chance, as these are bot-driven) to become a downstream target or relay site in a network of hacked or hijacked malware-laden sites.

No reason to panic, but... particularly if you're still having ranking problems... I'd suggest you fetch your site as Googlebot to see if any content, on old or new pages, which would be visible only to Google, might have been added. It would likely be in the form of target pages with content that would be relevant to the "toxic" inbound links, or with added outbound links pointing further into the network.

Also, be super cautious around infected sites. Some malware can be triggered simply by mousing over an iframed window. Consider using sandbox software (eg, Sandboxie) to run programs in an isolated space and prevent permanent changes to your hard-drive should you run into anything unpleasant.

As I understand disavow, it's not like a barrier or sandbox. Rather it's a virtual nofollow that's routed through a dedicated index table or database at Google... so it doesn't really do anything in realtime at your site.

Please report back on what you encounter with these hacked sites that possibly are on the attack.

[keyplyr]

...you may have been chosen... to become a downstream target or relay site in a network of hacked or hijacked malware-laden sites

@Robert Charlton - I'm not familiar with this scenario. What would be the purpose of 1.) such a network, and 2.) a "downstream target or relay site."