There is another question here, How to prevent negative SEO?, which gives the same advice found on most other online sources: Just have more good links to outweigh the bad.

That's nice in theory, but doesn't work for small companies with a limited budget up against a large (but unknown) unscrupulous company with deep pockets, they can easily outbuild our positive SEO efforts with spam links.

For the past several months, week by week, we have been fighting a never-ending battle where our rankings and sales drop, we get a list of links and go through them by hand, disavow domains, try and place a few good links, then check rankings again at the end of the week to find that our ranking have fallen, because while we were cleaning up last week's attack, they were executing a new one!

At this point, it's clear that this isn't some angry "Pop" in his garage who read about negative SEO and want to help "Mom". This is a large-scale and sustained attack by someone that views us as a serious threat and can and will outspend us to keep us down.

So when "just build more and better links" won't cut it because the attackers have a bigger budget and because spam links are easier and faster to build than good ones (that's the whole point of spamming!),


What can a small business or individual do to identify those involved in the negative spam?

Update 6/8/16:

We've got about 160 domains disavowed at this point.

Some of it is many domains with the same auto-generated content. The content on each page/domain is different, but it is clearly computer generated (it changes on each refresh) and uses the same template and "money word" anchor text after each paragraph. Example: spysony[DOT][ORG].

I also talked with an attorney. It would cost about $7,000 just to find out who is behind it, because you would have to sue "john doe" to get access to a judge, then you could send subpoenas to hosts, ISPs and other companies to discover who "john doe" is. Assuming the entire chain is under US jurisdiction. You could then continue or dismiss the lawsuit.

But then what? He said this is not the type of case attorneys take on contingency (where the attorney gets a percent of winnings rather then you paying him an hourly rate) because there is no clear body of law and no precedents. So there are legal theories that are theoretically applicable, but untested in court.

Which means just knowing who is behind it isn't enough, you would also need to pay the full cost of litigation out of pocket, hundreds of thousands of dollars, and then you might not even win, or you might win but not get damages or fees back. So I would say that at this point in time, there is no practical legal system answer unless you are rich or a big corporation.

In the meantime, I'm still optimistic that there is some process (that doesn't violate any laws but doesn't involve lawyers) to reverse engineer these attacks and find the source.

Update 6/18:

A few example links were requested. I'm not going to make these links so as not to be linking to spam sites.

There are several types of spam we're seeing, at a rate of about 20 new links per week.

  1. Cheesy blog comments with exact match anchor text pointing to the wrong page.

  2. Forum signature with only exact match anchor text, usually two keywords as links and nothing else, owned by a one post count forum member(name varies), usually making a useless post. Forum topics are usually not related to our niche at all.

  3. Random domains with computer generated (spun) content and exact match keyword links. Appears completely automated and re-randomizes on each page load. A given link will only appear on a given page sometimes. There are hundreds of these domains. These domains are registered to a company calling itself "seoconqueror.org" although no such company exists. "seoconqueror.org" is blocked by whois guard. Here's a few samples:









The rabbit hole:

seoconqueror[DOT]org is a site with no content, registered at enom (namecheap I think?), and protected by whois guard.

seoconqueror[DOT]org resolves to IP, and uses ns2858.hostgator[DOT]com as nameservers

BMG-PTS[DOT]COM has a Twitter and Linked profile, which list its website as conquer-marketing[DOT]com. conquer-marketing[DOT]com is a default wordpress install with no content.

conquer-marketing[DOT]com resolves to ip and uses dns1022-2.nexcess[DOT]net. conquer-marketing[DOT]com is registered with godaddy, but the database contains no contact info (an ICANN violation?) - Nexcess[DOT]net L.L.C. NEXCESS appears to be a legitimate hosting company based out of Michigan

  1. Fake image search. There are tons of these. Examples:








  2. Fake and spammy blogspot, livejournel and other "make a free site" networks. These have all been removed.

  3. What I call "China Spawn". Tons of these, they all look about the same:



  4. Lots of other random junk:



  5. And of course, no NSEO campaign would be complete without a bunch of crap domains 301 redirected at you, and without a bunch of pages which are cloaking. Some cloaked pages I have been able to see the links on with the googlebot user agent. But I think some of these pages actually check the reverse ip to make sure you're googlebot (which only Google is) before showing what they're hiding. You have to be really savvy to know to do that.

These are just a few examples. There are many, many, more and counting. The links seem to be built at a rate of about 5-20 per week, and based on found dates in link reports, this has been going on steadily for years!

  • 1
    After reviewing your question it was believed that your question was duplicate but, actually only the 2nd part of your question was. I've removed the 2nd question (how to prevent negative SEO) as this has been asked before on Pro Webmasters. Granted that there isn't a solution for small businesses, but that could change, as people can always add new answers and we have several ways of old questions getting new attention through quality edits, and if that doesn't work then certainly starting a bounty will. Jun 5, 2016 at 15:33
  • When I used the word "stop" I meant it in the sense of "apprehend the perpetrators" not "prevent the effects of" (which would be a duplicate). My thought was it might be possible to "stop" the attacks permanently by reporting to the FBI, for example, which would stop the original behavior rather than employing and relying solely on counter-measures to mitigate or negate the effects.
    – Nick
    Jun 6, 2016 at 5:25
  • Because the method of tracing depends on where/how they're posting links, it might help if you posted an example. If you're willing to divulge more detail, I'm sure I'm not the only one that would take a glance to see if they can do some internet sleuthing.
    – L Martin
    Jun 9, 2016 at 9:39
  • I've added some sample links above. Sorry for the formating, I couldn't get it to lay out nicely.
    – Nick
    Jun 18, 2016 at 16:01

1 Answer 1


Trying to trace these sorts of attacks are generally out of the abilities of your average small-scale operation as they are frequently done with disposable accounts and through anonymity services. Even when law enforcement gets involved it generally costs tens of thousands or even hundreds of thousands of dollars to investigate, get search warrants for records from ISP's, hosts, registrars, etc, and involves law enforcement agencies all over the world as many of these attacks and the services involved span global jurisdictions. Unfortunately there is not much more that can be done other than what you are already doing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.