Our Site Was Hit by a Negative SEO Attack: 1,198 Spam Domains and a 98% Drop in Impressions

In September 2026, digitalusmedia.com was hit by what looks like a negative SEO attack: our referring domains jumped from 498 to 1,321 in about a month, almost all of them spam. In the same month, our Google Search impressions fell from 1,393 to 24.

This is the full record of what happened, with the real numbers from Ahrefs and Google Search Console, how we sorted 1,219 linking domains into keep and disavow, and what we still don’t know. We’ll update it with the outcome.

What happened, in numbers

Our site has never had many links. In June 2024, Ahrefs counted 18 referring domains. By August 2026 that had grown to 498, and by September 2026 it was 1,321.

Date	Referring domains (Ahrefs)	Google impressions that month
June 2024	18	no data
August 2026	498	1,393
September 2026	1,321	24
October 2026 (to the 25th)	1,219 live	18

None of these links were built by us, and the growth didn’t come from anything we published: there were no new posts on the site between March 2025 and the migration in October 2026.

Of the 1,219 live referring domains on 25 October 2026, only 3 were genuine sites that had linked to us on their own: cmswire.com, theglobe.net and atspace.com. Everything else came from automated networks.

What the spam links looked like

The anchor texts made the source obvious. These are the patterns we found in the Ahrefs anchors report:

• A fake testimonial advertising an SEO link service, on 560 domains (nofollow).
• “Premium Authority Link Building for digitalusmedia.com…” on 264 domains, all dofollow.
• “High Quality Dofollow Backlinks… PBN Network… Buy Backlinks” on 41 domains, dofollow.
• “Advanced Niche Edit Links for digitalusmedia.com…” on 14 domains, dofollow.
• About 100 more domains with “white-label link building” anchors.

The domains themselves followed a few templates:

• Numbered .xyz domains: 398 of them, in sequences like 11763731.xyz, 11763732.xyz, 11763734.xyz.
• “Backlink checker” and “SEO checker” sites: 237 domain names contain “checker”, such as backlinkcheckertools.shop and allbacklinkchecker.online.
• Link-seller names: 101 domains contain “backlink” (backlinker.shop, 99backlinksbuy.com) and 227 contain “seo”.
• A cluster of six DR 61 domains (hotfri.com, zlutag.com, yelpad.com, gigbic.com, mantaw.com, dotpim.com) that all started linking on 14 and 15 September 2026.

Ahrefs flagged most of them as spam. The dofollow anchors with our domain name in them were the part that worried us most: they read like an advertisement for links pointing to our site, which is exactly what Google’s spam policies describe as link spam.

Was it really an attack?

We don’t know who is behind it or why. There are two likely explanations, and the data fits both:

1. Link sellers using our domain as a showcase. Many of these networks scrape domains and put them in anchor texts to advertise their packages (“Premium Authority Link Building for [your domain]”).
2. A deliberate negative SEO campaign meant to make our link profile look manipulated.

For the site owner, the difference doesn’t matter much. Either way, more than 98% of the domains linking to the site were junk, and a large share of them used dofollow, keyword-rich anchors that look like paid links.

What happened to our Google visibility

Before the spam wave, the site was small but visible. From March to August 2026 it collected 1,300 to 2,200 impressions a month in Google Search, mostly for “authority backlinks”, “authority link building” and technical SEO queries.

Then, in September 2026, impressions fell to 24. October, up to the 25th, had 18. Average position barely moved (71 in August, 74 in September), which means the pages didn’t slowly slide down: they almost stopped being shown at all.

Nothing changed on the site in those months: same pages, same titles, same internal links.

We can’t prove the links caused the drop. Google says it is good at ignoring spam links, and its December 2022 link spam update describes SpamBrain neutralizing them. Other explanations are possible: a manual action, a Google update that happened to land in the same weeks, or an indexing problem. But the timing is hard to ignore, and in our view a site with almost no real authority has nothing to absorb a wave like this.

Rule out other causes first

Before touching the links, go through these checks:

1. Manual Actions report in Search Console. If there’s a manual action for unnatural links, the fix and the reconsideration request are a different process.
2. Security Issues report, to rule out a hacked site creating spam pages.
3. Pages (indexing) report, to see whether pages had dropped out of the index.
4. Google’s Search Status Dashboard, to see whether a spam or core update was rolling out in September.

Our rule of thumb: never start with the disavow file. If the drop has a simpler cause, disavowing links won’t fix it.

How we sorted 1,219 domains

We exported all live referring domains from Ahrefs on 25 October 2026 and split them into three groups:

Decision	Domains	Why
Keep	3	Real sites that linked to us on their own (cmswire.com, theglobe.net, atspace.com)
Leave out, review later	18	Not flagged as spam; auto-generated info and “site stats” pages that are worthless but not clearly part of the attack
Disavow	1,198	Flagged as spam by Ahrefs, or part of the link-seller, PBN and “SEO checker” networks above

We disavowed at the domain level (domain:example.xyz), never individual URLs. These networks publish the same link on many pages and keep adding more, so URL-level entries would be out of date within days.

The first lines of our file look like this:

# Disavow file for digitalusmedia.com
# Generated 2026-10-25 from Ahrefs live referring domains (1,219 total).
# Domain-level entries only.
domain:11763731.xyz
domain:11763732.xyz
domain:11763734.xyz

One detail to get right: Google’s disavow tool does not support Domain properties in Search Console. You have to upload the file to a URL-prefix property (for us, https://digitalusmedia.com/).

What we did at the same time

The spam wave arrived just as we were rebuilding the site. In October 2026 we moved digitalusmedia.com from WordPress to a static site, rewrote the service pages, dropped placeholder testimonials, and redirected every old URL with a 301.

That matters for reading the results honestly: if visibility comes back, we won’t be able to say how much was the disavow and how much was the new site. We’ll report both and say which is which as far as the data allows.

What we learned

• Look at your referring domains every month. We’d have seen this weeks earlier with a simple alert on new referring domains in Ahrefs or a monthly export from the Search Console Links report.
• The anchor texts tell you more than any spam score. “Buy Backlinks” and “PBN Network” next to your domain name need no tool to interpret.
• Small sites are more exposed. With 3 real referring domains, our profile went from “small” to “98% spam” within a few months.
• Keep a written record. Dates, exports and the exact file you uploaded are what you’ll need for a reconsideration request or to judge whether anything worked.

If your own link profile looks like this, it’s one of the things we look at in our link building and link cleanup work: we sort the links, build the disavow file when it’s justified, and focus new effort on a few links worth having.

Update

We’ll add Search Console impressions, the state of the Manual Actions report and the referring-domain count here 6 to 8 weeks after the disavow file is processed.