$ cat Case Studies & Penalties

These accounts teach how to read incident evidence. A platform statement, company release, technical report and inaccessible historical article support different conclusions. Detailed source, confidence and missing-outcome fields appear in the case records.

BMW: a documented correction and reinclusion

Matt Cutts reported on February 7, 2006 that bmw.de had been reincluded after BMW removed JavaScript-redirecting pages. This is direct participant evidence of a cleanup and index-restoration event. It does not quantify commercial impact or establish a standard recovery duration for other sites. Primary statement.

For a defender, the transferable workflow is to preserve the offending page and redirect behavior, identify the mismatch, correct the behavior and document the subsequent platform response. A modern audit should compare representative user/crawler responses and identify legitimate rendering differences before alleging deceptive cloaking. The incident does not justify the rule that every content difference is abuse.

Overstock: a company statement with a narrow evidentiary scope

An April 25, 2011 company release filed with the SEC said a Google penalty imposed in late February had been lifted. The release supports the company’s statement about that outcome. It does not independently prove every explanation circulated about link acquisition or quantify the ranking/revenue effect. Filed company release.

A defensible case analysis separates the notice or firsthand statement, the suspected policy violation and the measured business outcome. When the latter two are absent, record them as unknown. Recovery examples are evidence that an outcome occurred in a specific context, not a guarantee that the same cleanup will produce the same result elsewhere.

J.C. Penney: historical reporting requiring accessible corroboration

The 2011 record preserves the New York Times paid-link investigation. The audit could not retrieve the article without an access restriction. This edition therefore withdraws unsupported exact link counts, ranking deltas and recovery duration rather than presenting the citation’s appearance as verification. It remains a relevant historical research lead.

PBN manual-action reports: outcome does not reveal detection method

The September 2014 record links contemporaneous industry reporting, which was access-restricted during verification. Even a documented manual action would not establish that a particular shared IP, account or template caused detection. Separate the report of enforcement from an inferred operational mechanism. Do not combine a separate network episode with this wave without a dated source.

GootLoader: reconstructing a delivery chain

The Sophos record describes a compromised-site delivery architecture. Relevant evidence includes the indexed lure, request-dependent content, download chain and endpoint observations. A compromised host and a person who downloads a malicious file are different victims with different remediation needs.

Use the offline indicator demonstration to practice separating a suspicious page, a file signature and a confirmed downstream outcome. Synthetic fixtures show the reasoning process; they are not malware samples and do not reproduce the campaign. The precise responder endpoint remained inaccessible during the audit, and no continuous campaign lifespan or universal ransomware result is asserted.

Site reputation abuse: a policy event is not an individual incident

The publisher record and regional enforcement record track primary policy statements. They do not substitute for named publisher cases with dates and outcomes. Current treatment must incorporate the August 2026 regional change and the host-input criteria described in Parasite SEO.

The API leak: an evidence event, not a penalty

Authenticity of documentation, presence of a field, an analyst’s interpretation and deployed ranking behavior are separate propositions. The API Leak chapter supplies the corrected authenticity citation and scope. This event should not be counted as proof that a manipulation technique succeeds.

Compare three different enforcement records

These records cannot be pooled into a “SEO penalty rate.” They involve different conduct, authorities, remedies and denominators. A complaint supplies allegations; a settlement supplies enforceable obligations without necessarily resolving every contested fact; a sentencing report records a criminal proceeding. A search removal can precede, follow or occur without litigation. Classify the event before counting it.

LendEDU: an incentive conflict that link analysis would miss

The affiliate case analysis links the FTC outcome. To reconstruct this kind of case, retain the advertised comparison method, commercial placement agreement, versioned review page and consumer-facing disclosure together. A crawl that only checks destinations or link attributes can miss a contradiction between a paid ordering rule and a claim of editorial independence. Conversely, payment alone does not establish deception: the represented relationship and reader context matter.

An audit’s conclusion should state the observed contradiction and the supporting documents. If the agreement is unavailable, it should say the underlying ordering arrangement is unknown. The LendEDU record establishes neither a universal affiliate revenue model nor a measured search-system response. Its transferable lesson is the evidence join between commercial incentives and editorial representations.

Google v. Hu: follow the consumer inquiry

The local case analysis separates Google’s announcement from the complaint. For a similar investigation, the unit is a profile and its associated business, not simply a keyword. Join displayed identity, eligibility evidence, reviews and the destination of calls or messages. A lead delivered to another business may require explanation; it does not by itself establish every allegation in this litigation.

Preserve a field-by-field chronology and alternative explanations. A legitimate service-area business can differ from a shopfront. A review burst can follow an ordinary request campaign. A network allegation needs more than shared phrasing or a similar address. Separate direct evidence, a party’s assertion and the analyst’s inference in the record. This prevents a real legal event from becoming a generic detector rule.

William Stanley: a defined criminal outcome

The DOJ release dated January 5, 2016 reports a 37-month sentence imposed the previous day, after a Hobbs Act extortion guilty plea, and $174,888 restitution. That chronology establishes a specific judicial outcome. It does not establish that all hostile reviews, threatening customer complaints or search manipulation satisfy the same offence.

For an incident responder, preserve demands, communications, site changes and the connection between them. Threat evidence and financial demands are different from a visibility graph. Preserve the original messages and chain of custody rather than editing screenshots into a persuasive narrative. The important analytical step is to demonstrate which act the record addresses; general SEO folklore cannot fill missing legal elements.

Domain and content cases: observable harm before causal ranking claims

The Hairpin supplies a named archive-continuity account. Originality.ai’s March 2024 study supplies named public-search observations with substantial method limits. These expand the guide beyond policy announcements while preserving the unknowns. A broken archive can be documented without proving ranking transfer; a missing public result can be documented without proving AI authorship caused a manual action. Record recovery only when a dated source actually observes it.

How to turn a lead into a completed case

1. Identify the entity, platform and precise event period.
2. Preserve the original source and distinguish what the author observed from what they inferred.
3. Map each claimed impact or enforcement outcome to supporting evidence.
4. Record the applicable policy at the event date, then separately explain current policy.
5. State confidence, inaccessible records and alternative explanations; update the record only when corroboration arrives.

Source register

Source URLs and their verification limits are maintained in the case database. The firsthand records above supplement the bibliography. Historical rows marked unresolved are not counted as fully verified cases.