Massive Negative SEO Attack - What to do?

[westcoast]

We are a very old website, over 20 years old. Decently large. Over the past year our traffic has dropped sharply (-60%) and unexpectedly, and I had always felt something was off.

We have fought off negative-SEO attacks in the past, but this new one is just massive in scope.

It appears 10,000+ hacked domains are being used to generate spam links to our site. The pages use lifted text mushed up from a bunch of sites like ours, and then a link at the bottom pointing to our site. When I look at Google, I see that there are 160,000 such links to our site currently INDEXED by Google from these domains.

It is completely out of control, and there are far, FAR too many to even work out what all these domains are, let alone disavow them all.

Are there any suggestions on what can be done? It is a clear case where we are just being steamrolled by this negative SEO, our rankings are sharply down, and there is no obvious way for us to escape.

Please help?

[lammert]

How do you know there are 10000+ domains, and these are the reason for the fall in traffic? During the last year the pandemic caused a large shift of traffic between areas on the internet for example.

Do you have a list with the names? If so, with some fiddling with tools like AWK under Linux or a smart text editor, it shouldn't be too difficult to compile a huge disavow.txt list to upload in GSC. Automating this job with a tool may cause some collateral damage though if genuine domain links are caught in the process.

But personally I would ignore it and let Google figure it out. They have a detailed understanding of the nice and ugly parts of the internet. I wouldn't be surprised if Google already ignores the larger part of these domains.

[westcoast]

"How do you know there are 10000+ domains, and these are the reason for the fall in traffic? During the last year the pandemic caused a large shift of traffic between areas on the internet for example."

I have disavowed around 6000 of them so far, using SEMrush's data and Google searches. There are a ton more, and new ones are popping up constantly.

And the content is generally the same format.

I can do a google search and see that Google has NOT "ignored these". It has at least 20,000 pages from these hacked domains (with the direct attack to my site) indexed and searchable and counting.

Also, under Google Search Console, at least HALF of the 1000 displayable "external linking domains" are these attack-domains. So Google not only is not ignoring them, but they have associated them with my site.

I of course cannot prove that the drop in traffic is a direct result, but it sure as heck is a good theory. When my Search Console "external linking domains" is just stuffed full of these negative-SEO attacks, it doesn't give me any confidence whatsoever that Google has any understanding or control of the situation whatsoever.

[westcoast]

Some technical details that don't mention my website:

All commandeered domains are being controlled and directed by: (a domain)


This script then redirects to spam ads, or for specific URLs creates the negative-SEO attacks.

Just a small sample of some of the many thousands of hacked domains under its control:

<snipped specifics>

[edited by: not2easy at 10:29 pm (utc) on Apr 7, 2021]
[edit reason] ToS/Charter [/edit]

[not2easy]

Sorry for the edits here, a visit to the Charter can help: [webmasterworld.com...]
;)

[not2easy]

You should not need to disavow anything BTW, Google at some point will determine what it is and they will disappear. Yes, it is appalling. It's not your fault though and in my experience, they dry up and go away. Most such attacks are not from real URLs.

[aristotle]

This is an old technique long used by big spam operations. Programs and scripts are employed to auto-generate 1000s of spammy pages by randomly mixing content scraped from different sites and then using these pages for various purposes such as ads, selling links, or link-building. Oftentimes a few links to high-authority sites are thrown onto these pages to try to make them look more legitimate.

[NickMNS]

Also, under Google Search Console, at least HALF of the 1000 displayable "external linking domains" are these attack-domains.

This is to be expected, given the volume of links, the true number is likely much greater.

So Google not only is not ignoring them, but they have associated them with my site.

But you cannot make this assertion, Google has stated on many occasion that just because links appear in GSC is no guarantee that they are being valued. Due to the nature of my main website the vast majority of links shown in GSC are "spammy", and it has never impacted me.

However, I was subjected to a similar situation as you describe, where a single source of spam was hot-linking my images on ten of thousands of websites. When I Google'd my domain name, it would return my website and then hundreds of pages of spam sites. All the sites fit a distinct pattern, they all used European Country TLD's with subdomains consisting of four or five random characters they often redirected to the same spam content. I never bothered to disavow the crap, but during the period my rankings fell significantly and a few month after resolving the issue my rankings recovered and then some. To solve the issue I implemented a hotlink blocking script with Cloudflare, I also added a X-Frame header to prevent I-framing.

From what I can tell the spam strategy is to keep creating new domains, Google wont take long to recognize this content as spam, but if new domains are added continuously this makes up for the burnt ones. The problem for you is that by the time you discover the new domains that domain is already discounted by Google, so disavowing will have no affect, and it turns into a game of whack-a-mole, where you've lost before it has even started.

In my case it was easy, I blocked the hotlinking and that killed the content and links, but if the content has been scraped, then you can't really pull the plug on it from your end.

[saladtosser]

JM says bad links are ignored now so you don't need to worry about them........but it doesn't make sense for them to claim to ignore bad links while keeping the disavow tool going.......If something is no longer useful Google are normally the first to sunset it, go figure!

[lammert]

The disavow tool may not be beneficial for you directly, but it may be for Google. Google can use the domains marked to disavow by many webmasters to train their algorithms to recognize bad neighborhoods.

If a large enough number of webmaster mention domain example.com in their disavow list, Google may decide to ignore all outgoing links of example.com, including links to domains of webmaster who didn't use disavow. And characteristics of the example.com site may be used to discover similar sites in the internet and ignore them too.

We think of the disavow tool as something beneficial for us. But in practice, it is beneficial for Google as input to their algorithms.

[rhcerff]

The increase in spammy links and a decline in traffic could be completely unrelated.

I'm assuming you've not received a "security" or "manual" notification?

Have you seen a decline in impressions? Was this sudden? Was this gradual? Which vertical are you in? Trends over the past year have shifted massively, so much so that 60% could simply echo what the world is doing. Throw in some pretty big changes in the Google Algorithm over time... well there could be multiple reasons here.

I'd say that Google is ignoring these links as JM has mentioned in the past.

Correlation doesn't always equal causation.

[dolcevita]

I've always been hesitant to use the disavow tool because I think google will immediately look negatively at the domain for which it submits a disavow file, so even now I'm not sure (I sound like a frivolous conspiracy theorist :)).
And I think in 90% of cases of losing rankings the reason for the drop is link spam.

[westcoast]

After some more exploration, it seems this spam operation is absolutely massive. Google totally hasn't caught onto it yet, and it's continuing to expand in indexed pages and domains. There have got to be tens of thousands of hacked domains involved!

It has caught up a large number of websites and appears to be a cloaking/advertising scam as opposed to a negative SEO campaign (although it could very well have that effect if not caught). Our "google search console" external links section is now filled by spam domains in 800 of the 1000 listed domains. I have identified thousands of domains linking to us from this.

To see if your site has been caught up in it, do a google search for the phrase "See full list on <your site name>" (without the .com or .whatever at the end)

For example, querying "See full list on msn" or "See full list on buzzfeed" will show the extent of the massive spam attack.

Google is still indexing and has made searchable all of that crap and doesn't appear to have any handle on it whatsoever. I have submitted a note to Google's spam address.

[FranticFish]

Some comfort in knowing it's not just you hopefully. With the number of sites they are linking to there will probably be other webmasters filing reports - enough for this to be notable. And it might be that someone with more of a direct line to a Google employee will take this up with them also.

[frank]

It is completely out of control, and there are far, FAR too many to even work out what all these domains are, let alone disavow them all.

Are there any suggestions on what can be done? It is a clear case where we are just being steamrolled by this negative SEO, our rankings are sharply down, and there is no obvious way for us to escape.

I have the same problem, thousands of spam domains are added on a weekly basis. Every week I spend about 1 hour to disavow them all. I hope Google solves the negative SEO attacks problem at some point, because it makes no sense that a botnet that creates thousands of spam domains can manipulate rankings.

Every week it's the same story, they add thousands of links from spam sites. These targeted attacks are unfortunately successful and it looks like I'm not the only one struggling with them. By now my disavow list has several thousands of domains.

[not2easy]

Hi frank and welcome to WebmasterWorld [webmasterworld.com]

Google has just announced how they are addressing the massive amounts of abuse from spammy scraped sites and hacked sites and offering a place to report problem domains.

every day, we discover 40 billion spammy pages

Just posted today, see this thread with a link to report problems: [webmasterworld.com...]

[NickMNS]

It appears that the problem is big, even at the scale of Google 40 Billion/day BIG:
[webmasterworld.com...]

[westcoast]

This specific massive hacked domain spam / doorway continues to grow -- yet another week that this hacked-domain spam attack goes unnoticed by Google.

Worst of all, Google Search Console is still sucking these fake links into our site's link profile. We were at 80,000 external links a couple of weeks ago. It has now ballooned to 126,000 inbound links as of today. That's 46,000 new indexed hacked-domain pages now pointing to our site added in 2 weeks... and clearly Google is algorithmically penalizing us more and more as this continues. Come on Google!

Our rankings and traffic continue their continual drop day after day, week after week as these fake hacked-domain links keep piling up under our GSC. Our SERP positions have been dropping steadily week after week too as watched by semrush.

You can see the scope of the spam yourself through these Google searches:

"See full list on blog" - 548,000 indexed doorway pages
"See full list on goodreads" - 261,000 indexed doorway pages
"See full list on apple" - 980,000 indexed doorway pages
"See full list on msn" - 159,000 indexed doorway pages
"See full list on bbc" - 32,000 indexed doorway pages
"See full list on adobe" - 15,000 indexed doorway pages
"See full list on yahoo" - 30,000 indexed doorway pages
"See full list on pcworld" -27,600 indexed doorway pages
"See full list on buzzfeed" - 73,000 indexed doorway pages
"See full list on cnn" - 17,000 indexed doorway pages
... etc etc etc etc....

[westcoast]

Update: we continue to lose keywords and SERP ranks on a daily basis.

Does anyone have any idea what could cause a main homepage to slip down the rankings slowly and methodically, day after day, week after week?

Our homepage had held an important keyword #1 for 20 years. We have now watched it fall like a stone over the last few weeks... 2...3..5...7...8....9...10... today it stands at 13.

How is this possible without core updates, etc ? What could create such a fast yet controlled descent? What can cause such an obvious weight on a ranking between core updates?

Could it be related to the extreme hacked-domain issue that continues to plague our site as detailed above?

Could it be related to us disavowing as many of those hacked domains as possible? (our disavow is now at 8000 entries)

Should we remove our disavow file? Is google penalizing us for disavowing spam? Or, keep that crap disavowed and hope and pray the next core update restores us to where we rightfully belong?

We are also seeing drops in all sorts of other keywords as it is becoming apparent we are taking a huge, sudden between-core-update authority beating, but our most important keyword has been the most visible and alarming.

I truly feel like our site is caught in between the cracks of Google's algorithms, a victim of either some bug or severe penalties caused by third-party malicious cloaking/spammers.

Thanks for thoughts....

[lammert]

Some questions which may help to identify a reason for your slipping rankings.

Can you give any information about the vertical? I.e. news, eCommerce, directory/portal, informational etc?
Is it a niche where E-A-T or YMYL could be a factor in ranking?
Is the content on one domain or spread over multiple sub-domains based on language or subdivision?
Did you in the last couple of months restructure the site with 301 redirects or no-index portions of the site which had thin content?

[dolcevita]

Could it be related to the extreme hacked-domain issue that continues to plague our site as detailed above?

Could it be related to us disavowing as many of those hacked domains as possible? (our disavow is now at 8000 entries)

Should we remove our disavow file? Is google penalizing us for disavowing spam? Or, keep that crap disavowed and hope and pray the next core update restores us to where we rightfully belong?

You just asked questions that I would like to know the answer to, but no one will be able to give you a credible answer. I am also unsure about the disavow file, but I still think that negative SEO and spam is the main cause of the problem.

And it's unfortunate that your competitor who wants to knock down your positions with little effort and very little money can still post tens of thousands of spam links within a month and Google will knock down positions for the domain and think that you do it yourself.

I have 5-6 weeks ago with a once successful domain (12 years ago), decided to take a total turnaround. I redesigned it, identified 95% of spam links via Ahrefs, Google Search Central and SEO SPyGlass, neutralized them via disavow file, but I still don't see any difference.

Artistic intelligence has certainly advanced, but it will still fall into the trap of spamming with hundreds or thousands of links from evil spirits and will punish the victim, not the culprit because the culprit cannot be found.

[westcoast]

Another week, and the massive spam campaign I first identified weeks and weeks ago continues, and in fact appears to be picking up steam.

Semrush's toxic link checker just picked up another 400 hacked domains with spam links to my site this week, pushing us over the 10,000 hacked/spam domain mark and counting, and our 1000 listed Google Search Console "external linking sites" entries are nearly all hacked domains now. And if past experience is any indicator, semrush only picks up a fraction of the real problem.

Google still doesn't have this issue anywhere near under control.

In fact, I would think that other people would start picking up on this now that semrush is starting to pick up these spam domains en masse.

Amazing that Google still hasn't done a thing about these. These domains remain indexed and searchable in google!

[JesterMagic]

Following

[martinibuster]

Your problem is not negative SEO. It's more likely your content and site promotion.

Make the Connection
Publishers whose content has been on a downward slope and fight negative SEO with limited to zero improvement MUST make the connection that the ineffectiveness of their campaign against the negative SEO is a sign that the problem lies elsewhere.

Don't take this personally but your problem is obviously not negative SEO. That's a red herring.

In literature, a red herring is a hint or clue, usually in a mystery that... may... mislead the reader to the wrong conclusion.

An example would be when a character makes special note of how unusual an event is. The reader may become suspicious and focus on that event becoming distracted from other more critical events.

[literature.fandom.com...]

[FranticFish]

That's a red herring

But the spam pages are indexed.

One of the only Google metrics I can trust these days is index status. Many, many pages on websites these days are not indexed. If a page is indexed it has got over a certain threshold. That may be a very low threshold indeed, but it is still a declaration of acceptance - even if on the most minimal level.

If you can search Google and find spam pages, that says to me that Google is giving them at least some credit on some level.

[martinibuster]

If you can search Google and find spam pages...

I've searched snippets from my sites and have seen scrapers ranking above my sites.

But you are talking about searching Google with quoted snippets and there is a problem in that search that you do not know about.

Google's algo is tuned to returning answers to questions, not webmasters checking their snippets. That's a red herring.

Scraper and "negative seo" sites aren't ranking for actual competitive keywords.

[FranticFish]

Does a page have to be ranking for competitive keywords before it can have ANY impact (whether positive or negative) on another page?

[westcoast]

"Your problem is not negative SEO. It's more likely your content and site promotion."

It's certainly possible, I am open to all possibilities.

The facts:

1. over the past two months over 20,000 backlinks have been created to our site (and some other sites with a lot of content online), from over 10,000 different domains as part of a massive cloaking/hacked-site operation. It doesn't appear to be intended as black-hat SEO, but rather a cloaked advertising scheme whereby they link to sites like mine and skim my content to get google to trust them more.

2. Google has indexed all of these pages. It trusts them to some extent because the pages are both indexed and searchable. Far more legitimate pages on my own site have not been indexed. It has not picked up on the fact that this scam exists. All manner of keyword searches can return pages from this scam. They are likely making a lot of money off of this from all manner of tail-queries.

3. Our google search console "top 1000 external links" section is now almost entirely domains from this hacked-site network. Yet more evidence that Google is giving some sort of legitimacy to all these links. To an external viewer our link profile is utter trash. It is totally dominated by spam websites.

4. It looks incredibly suspicious for a 25 year old site like ours to suddenly get 20,000 backlinks (that are legit enough to be indexed) from 10,000 domains in a 2-3 month period. It is not at all unreasonable for a search engine to demote a site showing such suspicious linking. As an external viewer it LOOKS like a paid linking scheme, and we know that Google has been known to penalize sites involved in such schemes.

5. My site has shown a decrease in rankings across the board at a domain-level, across every single keyword, over the past 2 months. The effect has increased as the number of backlinks have continued to increase.

So, I'm sorry, but the correlation is disturbing at best. Perhaps there are other causes of our prolonged and steady drop, but this massive influx of inbound links to our site is definitely a possible cause. It is a little presumptive to completely dismiss its possible cause or influence.

Google used to pick up spam pages very efficiently and drop them from the index. This huge link scheme outlined in this thread remains a reminder that things have changed. It is my theory that Google has completely become overwhelmed with sophisticated hacked-domain attacks like the one outlined here, and some truly legitimate websites have gotten caught in the crossfire.

Algorithms -- particularly when working in complicated dances with one another -- sometimes result in unintended consequences. Sometimes they create situations that weren't designed for.

[NickMNS]

they link to sites like mine and skim my content

Can you be more specific, what do you mean "skim my content" are they scrapping and displaying your content in addition to linking to your website?

[westcoast]

"Can you be more specific, what do you mean "skim my content" are they scrapping and displaying your content in addition to linking to your website?"

What they are doing is visiting 2-3 sites on a topic, scraping sentences on that topic from those sites, mashing them together in new combinations so they are filled with keywords and key-phrases but are ultimately nonsense or thought-fragments, and then create links back to those 2-3 sites to try to look more legitimate. Each link back has anchor text "See full list on <sitename>". Then they do this millions of times, creating multiple pages targeting different key phrases, and I suppose all linked together in some manner.

Each of these URLs is then cloaked. If a user-browser goes in to that URL on a query that hits some phrase, they are redirected through an intermediary website to full-page ads. I assume the spammer makes a fraction of a penny or something, and with millions of pages indexed in this manner they make enough and run undetected long enough indexed in Google to make money.

I dont think Im allowed to post a link to an example, but you can see it for yourself easily enough:
Google "See full list on buzzfeed"
Then click "view cached copy" on any of the returned results with titles ALL IN CAPS to see the cloaked page Google has indexed and cached. If you instead click on the google-indexed link, you are taken away to ads. Anyway, that appears to be the recipe for successful cloaking on Google nowadays. At least, for 3 months and counting...

[edited by: westcoast at 7:28 pm (utc) on May 24, 2021]