What happened: 1,100 spam backlinks in eight days

Between October 5 and October 13, 2026, optimizationtheory.com went from 507 to 1,188 referring domains. Almost every new one was a throwaway site on a cheap TLD, sending a single link.

The flood had been building since August, when the site had about 104 referring domains. By the end of September it had 298. Then it took off: backlinks went from 1,090 to 1,841 in those eight days, and 943 referring domains were first seen in October. New ones were still showing up on the day I wrote this.

At the same time, Search Console impressions fell 45% over 28 days, from 6,051 to 3,305, dropping to about 50 a day on October 9 and 10. It looked like textbook negative SEO. Two of my other sites were hit too, but differently:

• vuss.io got a smaller wave of about 40 casino and gambling domains, yet its average position improved from 11.5 to 5.3 and impressions roughly doubled.
• infographi.ac got almost no spam links, but its ranked keywords in DataForSEO halved from 41 to 21.

The domains themselves were the giveaway. They sat on six cheap TLDs, and their names read like SEO tools: onlinebacklinkgenerator.shop, aibacklinktool.space, bestlinkbuildingstrategies.site, backlinksearch.website, serpcheckeronline.site, dacheckers.online.

On October 13 I submitted disavow files covering 1,164 domains for optimizationtheory.com and 44 for vuss.io. As you'll see, that probably wasn't necessary.

Negative SEO attack or link farm? How to tell

Every linking domain I opened was a copy of the same page. That's the signature of an automated link farm hitting thousands of sites at once, not a competitor targeting you.

I opened four of the spam domains on October 13 and compared them side by side:

What Money Robot backlinks look like

Money Robot Submitter is long-running commercial software that automates link building across web 2.0 blogs, profiles, wikis and bookmarking sites, and reviewers have long called it spam (Tech Business News, Jun 2026). The domains linking to me carried its name, but I couldn't confirm whether Money Robot runs them or a clone borrows the branding. Either way, the pattern is the same: keyword-named domains, a copied landing page, and links to target sites tucked into /dir/ directory pages.

Other site owners have reported the same footprint. In July 2026 a BlackHatWorld member described brand-new sites getting "blasted" by SEO-keyword .shop domains like seoboost.shop and ranktools.shop, with operators who "spin up 50 new domains" faster than anyone can disavow (BlackHatWorld). The agency Hallam documented 28 similar .shop domains across several industries (Hallam).

My readBecause the domain names are SEO keywords, the farm probably seeds its directories with SEO-related sites so the pages look on-topic. That would explain why my SEO consultancy got about 1,100 domains while my infographic site got almost none.

Did the spam backlinks hurt rankings? What the data showed

Probably not. The impression drop started on September 13, weeks before most of the links arrived. That's the same day Google started blocking SEO tools far more aggressively.

Around September 13, Google began blocking rank trackers and scrapers much more effectively. Nozzle said about 80% of its scraping attempts were blocked, and that DataForSEO was hit the same way (SER, Sep 18, 2026). Nozzle also found that from September 20, some results pages served to trackers were falsified: they looked normal but were missing most of the usual sites.

That matters in three ways:

• Tool data broke. infographi.ac's drop from 41 to 21 ranked keywords lines up with DataForSEO losing most of its Google data, not with a real ranking loss. Keyword counts can fall sharply while real traffic holds (Search Engine Land, Sep 24, 2026).
• Search Console lagged. The performance report ran more than 64 hours behind on October 11 (SER, Oct 11, 2026), so my 50-a-day impressions on October 9 and 10 were likely incomplete.
• Bot impressions may have vanished. When Google blocked scrapers in September 2025, about 88% of 320 sites lost Search Console impressions (SER, Sep 22, 2025). An SEO site ranks for exactly the terms rank trackers scrape. HypothesisThe test: if clicks held and the lost impressions sit at deep desktop positions, it's a measurement artifact.

Here's how the link flood lines up against everything else that happened:

The jump from 298 to 1,188 referring domains came after the scraper blocking (Sep 13) and the September spam update (Sep 24) had already started. Blaming the links means ignoring both.

Other false alarms that look like an attack

Two more things hit at the same time and made the situation look worse than it was: fake analytics traffic and a Google spam update.

GA4 ghost traffic from China, Singapore and the Netherlands

A .txt file on vuss.io logged 71 pageviews, and a .txt file can't run the Google Analytics tag. That points to fabricated hits sent straight to GA4's collection endpoint with the site's public Measurement ID (Simplytics, Sep 2026). Google Product Experts have called the China and Singapore traffic "inauthentic, non-human traffic" (Stan Ventures, Dec 2025).

Fix: turn on GA4's hostname "Include" filter, added September 21, 2026 (Search Engine Watch), build exclusion segments, and compare against Cloudflare logs. Visits Cloudflare never saw are ghost hits, and no firewall rule can stop them.

The Google spam updates

Google ran two spam updates during the window: August 18 to 21, and September 24 to October 8. Google said neither targeted link spam. The September one ran about 14 days, far longer than usual (SER), with impact waves on September 25 to 27, September 30 and October 4 to 6. vuss.io's gains started September 30, right on the second wave.

How to check your site for spam backlinks and hacks

Before blaming outside links, rule out problems on your own site. I scanned all three sites from the outside and found no hack, but one open door.

Why the search page matters: spammers link to your site's search URLs with casino terms in the query, hoping Google indexes pages of spam text on your trusted domain. If your search results aren't set to noindex, fix that first. It's a bigger risk than any number of junk referring domains.

An outside scan can't see server files, the database or cloaking aimed only at Google's real crawler IPs. Cover that with URL Inspection's "View crawled page" in Search Console, plus the Security Issues and Manual Actions reports.

Should you disavow spam backlinks? What Google says

Google's guidance has been consistent: most sites never need the disavow tool, and spam links you didn't build are mostly ignored.

Disavowing so-called toxic links is a "billable waste of time."

John Mueller, Google, Bluesky, Dec 17, 2024 (SER)

"There's a lot of hate on the disavow tool here - but it has its place & time, it does have effects." And: "disavowing a handful of links is not going to make your site drop out of search."

John Mueller, Reddit, reported Sep 2, 2026 (SER)

Spam links "would not have any effect, positive nor negative."

John Mueller on comment spam links, Bluesky, Jan 18, 2026 (PPC Land)

Lesson from my case: I disavowed 1,164 domains before checking clicks. That was a reflex, not a diagnosis. The one real risk of disavowing is catching legitimate links in the net, which is the situation where Mueller says the tool "does have effects."

How to disavow backlinks (if you really must)

1. Export your backlinks from Search Console's Links report and your link tool of choice.
2. Filter to the farm's footprint: cheap TLDs, one link per domain, first seen in the spike window.
3. Check the list by hand for any real sites, partners or directories you want to keep.
4. Write a plain .txt disavow file with one entry per line, using domain-level entries.
5. Upload it in Google's Disavow Links tool for the correct property. A new upload replaces the old file, so keep a master copy and add to it.

Disavow file example

# Spam link farm, Money Robot template, Oct 2026
# Reviewed by hand on 2026-10-13
domain:onlinebacklinkgenerator.shop
domain:aibacklinktool.space
domain:bestlinkbuildingstrategies.site
domain:backlinksearch.website
domain:serpcheckeronline.site
domain:dacheckers.online

Mueller has said you can disavow a whole TLD with an entry like domain:.shop "if you're sure that it's what you want to do" (ALM Corp, Mar 2026). Be careful: that removes every link from that TLD, including real ones.

Checklist: what to do when spam backlinks spike

Diagnose before you disavow. Most of the work is confirming what your data actually means.

• Check clicks in Search Console, not just impressions, and compare desktop with mobile.
• Line up the drop's start date with Google updates and known data outages before blaming links.
• Open five or ten of the spam domains. If they share one template, it's a farm, not a targeted attack.
• Don't trust third-party rank or keyword counts from mid-September 2026 onward until tracking stabilizes.
• Make sure your site search results are set to noindex.
• Run URL Inspection on your homepage and key pages, and check Security Issues and Manual Actions.
• Filter GA4 ghost traffic with the hostname Include filter and exclusion segments.
• Only then decide whether a disavow file is worth it, and review it by hand.

Spam backlinks FAQ

Sources and limitations

This is one owner's network over about ten weeks. I opened four of about 1,100 spam domains by hand; the /dir/ pages didn't load, so where the links sit is inferred. The bot-impression explanation is a hypothesis built on the 2025 precedent. Site data came from my own DataForSEO, Search Console and GA4 accounts, pulled October 5 and 13, 2026. All sources below were opened October 13, 2026.

Spam domains named in this article are listed, not linked. © 2026 Optimization Theory. Seeing a spam link flood on your own site? Get in touch.