Negative SEO attack types: the measured taxonomy
Every negative-SEO guide lists "spam links, scraping, fake reviews." Here is the taxonomy as actually measured across a live campaign: what fires, at what volume, and what stops each class. Every class below is one more form of The Waste — traffic that should never reach a server.
The measured lifecycle — and where each stage dies. Numbers below are all from the same live campaign.
1. Churn-farm link spam
Registrar batches of thousands of disposable domains (.xyz/.icu/.top at $0.67) created in hours, all linking to your money pages with exact-match and poisoned anchors. One wave we tracked: 4,212 domains, one registrar, one day. Anchors included the victim's own brand 2,956 times — designed to make the profile look self-inflicted. The cost lands as a throttle, not a crash: the whole domain is quietly suppressed, and every dollar of legitimate marketing returns less than it should — invisible in any single report.
Stops it: pre-fire fingerprinting (the wave is visible in registration signals days before it fires) + per-property disavow for what lands.
Named variant: “SEO Cartel” and “@seo_cartel in Telegram” waves
If your link tools show anchors reading “@seo_cartel in telegram, seo backlinks, bulk link posting, boost seo ranking”, you are looking at a sold-by-brand farm: bulk inventory publicly priced at $0.30–$1.00 per link, fired from blogspot PBN shells and churn domains. You never bought these links — that is the point. The seller’s brand in the anchor makes the wave look self-inflicted, so the profile reads as a customer, not a victim. In one documented UK case, ten percent of a £6M company’s entire link profile carried that exact anchor — organic traffic down 55% year on year, while the monthly agency reports called it “one to watch”.
Stops it: The Sink sinks the farm at the edge — its links are cancelled before Google ever counts them, and the attack dies in The Tarpit. A disavow file cleans up after the fact; it does nothing about the next wave.
2. Forged-referer floods
Tens of thousands of hits presenting referers like a hacked US charity, baidu mirrors, nitter instances — all one Chrome build. The goal is analytics pollution and crawl-stat contamination, and making your own domain appear in attack graphs. The commercial damage is the poisoning of the victim's own instruments: sessions and engagement inflate, reports read as growth, and budgets get allocated against visits that never had a person behind them.
Stops it: edge referer-signature sinking. WAFs can block; only a sink starves the campaign's telemetry loop.
A one-off scan from outside can’t see this one. A forged-referer flood lives in the requests hitting your site — until your traffic passes through The Sink, there is nothing to observe. That’s the whole point of the edge: once you’re behind it, we see every forged referer arriving and sink it request by request. Before it, any tool claiming to spot the flood from the open web is guessing.
3. Botnet verification loops
Cloud VMs (we measured one provider's VM range at 2,842+ challenges/day — and filed the abuse report) crawling your site to confirm their links fire. Blank UA, headless, rotating residential-proxy exits.
Stops it: ASN/UA challenge rules + The Tarpit — the farm burns budget confirming nothing.
Same honesty here. Bot verification loops are visible only in the traffic itself — a scan from outside has nothing to probe. Behind The Sink it’s inverted: every verification bot has to come to us, and the loops starve when the edge stops answering them.
4. Dangling-DNS hijacks
Idle domains with A records pointing at released VPS IPs. Third parties claim the IP and serve scam redirects on your domain. In one estate sweep: 56 of 2,444 domains actively weaponized, owners unaware. Free check.
Stops it: estate hygiene — hold pages or proper parking, DNS watch, never dangling records.
Check a domain for dangling-DNS hijack — free
Registry state, dangling records and redirect chains — the same read the full check starts with. Anonymous, ~30 seconds.
5. Hacked-source link injection
Legitimate sites compromised to host links to you — your profile fills with spam from real, aged domains. Harder to classify than churn farms.
Stops it: graph attribution (the injection clusters by hoster/time) + surgical disavow + source notification.
The surface check reads the loud version only. Injection from aged, real domains doesn’t wave a flag on an outside scan the way churn farms do — the link-spam check above catches the loud waves; this quieter class is exactly what the signed-in check and The Triage exist for.
6. Scraping, smear, fake reviews
Your content republished to dilute it; fake negative reviews; forum smears. The oldest classes, still the most manual to fight.
Stops it: evidence-led DMCA/takedown, canonical discipline, review-platform disputes.
And the oldest class stays manual. Scraping and smear campaigns spread across the open web — no single check reads them. They are fought with evidence and takedowns, not edge rules.
Check your domain for link-spam attacks — free
Backlink spikes, first-seen velocity and anchor patterns — the same read the full check starts with. Anonymous, ~30 seconds, nothing installed.
Keep reading: what is negative SEO? the pillar · how to fight negative SEO, in order · how to disavow properly · is this link spam? the field guide