Case studies: real attacks, measured.
Real attack data from the most competitive SEO vertical on the internet: online gambling. Nowhere else is a ranking worth more — the difference between page one and page two, between rank 3 and rank 9, is measured in tens of thousands of dollars a month per keyword. And precisely because of that, it is the vertical most prone to negative SEO and competitor attacks. If a defence works here, it works anywhere.
Not in a cut-throat niche? You're not exempt. The churn farms spray indiscriminately. While calibrating our checker we ran it on a small local dog-grooming business — about as far from a competitive vertical as it gets. Their profile: 662 referring domains, 98% flagged spam, 63% first seen within the last 90 days. Nobody targeted them; they were simply caught in the same spray as the gambling sites. That's what "collateral damage" looks like in 2026 — and it costs a local business rankings it can't diagnose.
Most "negative SEO" content is opinion. This page is instrumentation. Every figure below is pulled from our edge logs, our telemetry dataset, or independent third-party backlink/keyword indexes against domains we own. Sites are anonymized by sub-vertical; the campaign is very real.
The campaign at a glance
verified hostile referring domains across the estate — the canonical sink list this campaign forced us to build.
forged-referer bot hits across 10 sites in a 30-day census — fake visits impersonating trusted domains (a hacked orthopaedic association, Baidu, Sogou, even our own brands) to pollute analytics and crawl stats.
challenge responses served to a single cloud-hosted botnet probing one property — the farm's verification loop, checking whether its spam links still resolve. We know exactly which provider's VM range it runs from — and we file the abuse report.
fresh domains registered with one registrar in a single day, all linking into the same vertical. A wave, not organic growth.
The reports look fine longest.
Fake traffic and spam links inflate everything above the money. Impressions rise, sessions rise, engagement holds — while enquiries slow and the phone goes quiet. Every number a monthly report can carry stays positive except the two that can't be faked: did someone call, did someone buy.
The mechanism is a throttle, not a crash. A poisoned link profile gets the whole domain quietly suppressed, and every dollar of legitimate marketing returns less than it should — no alert, no red cell, no email. In one documented UK case, a £6M-turnover industrial supplier carried a link seller's brand on ten percent of its anchors: organic down 55% year on year, phone enquiries from fifteen a month to one, costed at £80–180k a year — while the monthly reports described the picture as "one to watch."
And the clock compounds: unwinding what already registered takes six to twelve months measured from when the wave stops — every month it keeps firing adds a month to the cleanup. That is the whole difference between protection and cleanup, and it is why the wall comes before the ambulance.
The farm's links are born in bulk, on junk TLDs
We exported one attacked profile's backlinks from an independent link index (868 sampled referring domains) and scored them. 96% were flagged spam. Their birth dates and TLDs tell you it's manufactured inventory, not editorial links:
Sample from a single attacked domain in the estate, Oct 2026. The September spike is the wave; .shop/.store/.xyz and kin are where nobody builds real sites.
What happened when the sink went live
On 5 October 2026 we turned on edge sinking across the estate: hostile crawlers and forged referers now 301 into The Tarpit instead of touching the sites. Within days the hits followed the redirects — and kept coming:
Read this chart right: hits recorded by the sink itself, first week live — 352,571 and rising daily. Rising numbers here are not attacks getting worse; they're the attack changing target. Before deploy this traffic hammered the real sites' servers and polluted their analytics; now it follows its own links into The Tarpit and spends its budget talking to quicksand. The number that matters to the site owner isn't how much fire the sink absorbs — it's that none of it reaches them.
The backlink wave peaks — then breaks
The attack's signature in the link indexes was a September surge of referring domains across the estate. After the sink went live (and the farm's verification loop started starving), the curve rolled over:
Weekly live-referring-domain counts, three of the six tracked properties (the clearest wave signatures in this index) — all six, including the two still declining, are in the rankings chart below. The September wave is unmistakable; the plateau-and-decline after 10/05 is what a starved campaign looks like. Farm links die off faster than new ones mature.
What the rankings show so far (early, honestly labelled)
Too early for definitive SERP proof — and we say so. Four weeks in, here is the whole picture, including the parts that don't flatter us. One thing that makes this data unusually clean: none of these sites run PPC, ads, affiliate promos, or any direct marketing campaigns — most don't even have social media accounts. Every movement below is 100% organic SEO. No paid noise, no blended attribution, nothing to hide behind — that's a pledge, and we challenge anyone to break it.
Three verticals are climbing — confirmed on two independent indexes. Sports betting leads: 851 → 2,720 ranking keywords Apr→Sep (and 2 → 124 in Google's top 10 on the second index). Pokies and casino are climbing off smaller bases — up 16% and 12.5× respectively. All three carry heavy spam-link waves — and all three started recovering as those links died off (see the rollover chart above).
Esports is flat, and its vendors disagree. One independent rank tracker shows approximately +15% growth in tracked keyword positions since deploy; a second index shows the top-10 count roughly flat (699 → 658). We report both.
Two are still declining. Greyhound racing and thoroughbred racing kept sliding through the window. Not every movement is the campaign or the cure — content age, competition and seasonality move rankings too. We'd rather show you that than cherry-pick.
Chart: organic keyword counts, monthly, one independent index, April → September 2026, six of our own tracked properties. Bullets cross-checked against a second independent index — where the two disagree, we show both. Link-profile recovery is the mechanism; rankings follow it with a lag of weeks to months. This page updates as the data matures.
October update — twelve days after deploy
Added 17 October 2026. Two things are now true at once, and we show both. First: the farm is still spraying — one attacked property gained 671 fresh referring domains in the twelve days since the sink went live (500 → 1,171 in an independent link index; the disavow file already covers the September wave). The campaign didn't stop because we noticed it. Second: the properties keep growing anyway.
The undisavowed-index scoreboard — September 1 → October 16, all seven tracked properties. These numbers come from an index that ignores disavow files; every movement below happened while the sink was the only defence it could see.
| Property | Organic keywords | Google top-3 keywords | Monthly traffic estimate |
|---|---|---|---|
| Sports betting | 47 → 261 (5.6×) | 3 → 40 (13×) | 77 → 1,484 (19×) |
| Esports | 1,051 → 974 (−7%) | 233 → 267 (+15%) | 7,819 → 7,038 (partial month) |
| Casino | 0 → 59 | 0 → 21 | 0 → 508 |
| Pokies | 146 → 210 (+44%) | 35 → 77 (2.2×) | 1,030 → 1,860 (+81%) |
| Thoroughbred racing | 942 → 614 (−35%) | 129 → 97 (−25%) | 1,965 → 2,386 (+21%) |
| Greyhound racing | 212 → 146 (−31%) | 37 → 29 (−22%) | 377 → 1,075 (2.9×) |
| Property seven | 342 → 397 (+16%) | 46 → 77 (+67%) | 856 → 2,292 (2.7×) |
| Estate total | 2,740 → 2,661 | 523 → 608 (+16%) | 14,065 → 18,623 (+32%) |
Same-index snapshots, Sept 1 vs Oct 16 — observational results on the same estate under attack, not a controlled experiment; the gains happened during the window, declines included. Read it whole: traffic up on six of seven (esports is mid-month, on pace), top-3 rankings up on five of seven, and the two racing verticals still trading keyword breadth for traffic — the honest mixed bag, same as last month. Esports' top-3 gain (+15%) lands exactly where its rank tracker said it would. The esports property's domain rating is +5 since deploy (DR 38, same index). Seasonality doesn't explain it: the estate is global, and this window contained headwinds, not lift — the AU NRL/AFL seasons ended in it (a traffic cliff, not a surge), the esports world cup finished months earlier, casino has no autumn cycle, and the estate isn't NFL-dependent. Source: Ahrefs, an independent index that ignores disavow files entirely — it shows the raw link graph we asked Google to discount, which is precisely why we never showed it the file.
*October 1–16, partial month. The esports property's domain rating is +5 since deploy (DR 38 today, same index). Ahrefs ignores disavow files — so anything this index sees moved because the underlying link graph and the sites themselves moved, not because Google was asked to look away. That's the honest view of the estate, and it's the one we publish.
The wave itself is now receding — on all seven tracked properties. Live referring-domain counts in the independent index, two weekly reads after deploy: sports betting 4,880 → 4,640 (−5.0%) · esports 5,335 → 4,886 (−8.4%) · casino 2,115 → 1,994 (−5.7%) · pokies 3,666 → 3,500 (−4.5%) · thoroughbred 2,724 → 2,432 (−10.8%) · greyhound 3,140 → 2,867 (−8.7%) · the seventh 4,242 → 3,846 (−9.3%). Farm links are dying faster than new ones mature — the rollover that started on the three charted properties above is now estate-wide.
How to read the two facts together: the attacker's budget keeps arriving as junk links; the sink keeps the junk from ever reaching the sites; the disavow tells Google to ignore the September wave; and the rankings/traffic lines keep climbing while the spray continues. That is what "protection, not cleanup" looks like in numbers. The next full-month datapoint lands in the November update.
They came for us first
Added 17 October 2026 — eight days after launch. We knew we'd come under serious attention: this product upsets the link-farm business model by definition, and a negative-SEO defence that works is a target the day it exists. So we watched our own name from day one. One wrinkle we didn't expect: seosink.com is an aged name (live sites back to 2013, dropped, re-registered by us) — the farm already had it in their graph before we ever owned it. That's their inventory model: expired domains carry residual trust. We bought a domain already on their list — and got to watch them keep firing at it after we took ownership. The footnote we couldn't have invented: the name's past life was an SEO service — rapid indexing and backlink development. SEO Sink used to be what it sinks.
unique referring domains already pointing at seosink.com — 912 of 913 flagged spam by the independent index. .shop (407), .store (135), .xyz (109) — the same churn-farm TLDs, the same wave shape as the estate attack: built July → August, spiked September (662 domains in one month).
The top anchor (310 pages). The farm's play, verbatim from our own checker: write the victim's name into SEO-service spam anchors to frame them as a paying client of a spam service. They're running the textbook attack on the company that wrote the textbook.
We expect it to get worse by magnitudes — that's what the sink is for. Every one of the 913 went onto the blocklist today; any of their bots or verifiers that follow those links here get The Tarpit, and the disavow file for our own domain is already built. SEO Sink will sink all of them — and this page will keep the score publicly.
The hijacked estate that started all of this
Before the sink existed, we swept our own 2,444-domain estate — registrar APIs, registry checks, live content probes on every single domain. This is what "nobody's watching the parked domains" actually looks like when someone finally looks:
How the 56 got taken — and the other five ways domains get caught
None of these need a password or an exploit — they're state changes in DNS and time, and nobody emails you when one fires. Each flow below is a real way domains get caught; the first is the play that took 56 of ours. Scan the diagrams, read the ones that sound like your setup.
1 · Host migration strands the idle domains — the one that got us
Money sites get migrated carefully; the parked ones keep pointing at the old IP. Cloud IPs are recycled within hours of release — a stranger rents the same address, and your domain serves their content. This exact vector is how 56 of our own domains got caught.
2 · You buy a dropping or expired domain
It arrives carrying the previous owner's nameservers. If their hosting account still answers, your new acquisition serves their content from day one — and you may not look for weeks.
3 · You transfer registrars and forget the nameservers
The domain keeps the old registrar's DNS. Their zone keeps answering — or gets deleted, and the domain drops off the internet entirely. Either way you're not in control of what it serves.
4 · Registrar defaults change underneath you
Default nameservers get repointed at the registrar's own parking and monetization. No email, no diff — their ads, your brand.
5 · Someone “tidies up” DNS
A well-meaning cleanup at the zone or account level strands domains nobody owns up to — records deleted, delegations broken, nobody alerted.
6 · Subdomain delegations rot
A CNAME to a dead third-party service is the same play one level down: the service lapses, the name gets re-registered, and promo.yourbrand.com belongs to someone else.
What they were serving on our brands
Scam-redirect endpoints (admin.getstack.xyz), affiliate tracking links (sireimplement.com/h8why8k36d), self-referencing parking loops, empty vhosts on shared droplets, and one server default page. One hundred percent junk, zero percent ours — monetized by third parties, invisible to us, for months.
The flip that killed it
Every one of the 56 now resolves to infrastructure we control and serves nothing. The same sweep is the Estate Health Report in the product.
Keep reading: how SEO Sink protects your website · how SEO Sink protects your domains · pricing — what protection costs · the monthly reports