When somebody says their site is under a negative SEO attack, this is nearly always the family they mean: tens of thousands of junk links appearing in a backlink tool over a weekend, adult or pharmaceutical anchor text pointed at a commercial page, links from a private blog network that was never anything to do with them. Thirteen vectors on this site aim at the backlink profile. Exactly one of them carries a documented threat verdict, seven are situational, and five are largely neutralized. That distribution is the single most useful thing on this page, and it is the opposite of what the trade press implied for most of the last decade.
The reason is architectural rather than a matter of opinion. A link attack requires the search engine to charge the target for links the target did not build. From April 2012, when Penguin first demoted sites on the character of their inbound profile, that was a mechanism an attacker could aim at. Since 23 September 2016 it has not been. Announcing Penguin's move into the core algorithm, Google wrote that it "now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site," and that the data would refresh in real time so changes would be visible "shortly after we recrawl and reindex a page." Devaluation is subtraction, not punishment: the link is removed from the calculation rather than counted against the recipient.
Google restated the same architecture in stronger words on 14 December 2022, announcing theDecember 2022 link spam update, which extended SpamBrain to detect both sites buying links and sites used to pass them: when "our systems nullify spammy links, the link credit that was previously generated is lost." A nullified link confers nothing, which necessarily means it costs nothing. That is the whole argument, and it is why five vectors in this family are marked largely neutralized: blog comment spam, forum profile spam, link farm inclusion, sitewide footer links, and the widely feared link velocity spike, which is not a mechanism any search engine has ever described.
Where these attacks still bite
The honest qualification is the reason seven vectors here are situational rather than neutralized, and it comes from Google itself. In a statement reported on 1 November 2021, John Mueller described the first-line behavior as ignoring spammy links, then added the fallback: "If our systems recognize that they can't isolate and ignore these links across a website, if we see a very strong pattern there, then it can happen that our algorithms say well we really have kind of lost trust with this website." Isolating spam requires something legitimate to be left behind once it is discarded. Four kinds of site fail that test:
- a new site with almost no genuine backlink profile, where discarding the spam leaves too little to score;
- a site already carrying a manual action, where the attack adds to a pattern a human reviewer has already found;
- a site whose own profile is partly manufactured — bought links, a private blog network of its own — so the attacker's links merge with real violations and cannot be isolated;
- a site being judged by an engine other than Google, since Bing has never published the same devaluation posture and has to be checked separately.
That asymmetry was visible in the era when these attacks were at their most dangerous. In June 2012 an agency attacked its own thin exact-match-domain test site with roughly 56,000 links and watched it leave the front page within a day. In 2013 an established firm absorbed a thousand spam links a day for months and reported that rankings were nearly unchanged and traffic still growing. Same era, same class of attack, opposite outcomes. The variable was never the attack; it was whether the target had anything underneath the links.
The one that is a documented threat, and it is not a ranking attack
Link removal extortion carries the only documented threat verdict in this family, and the mechanism is worth stating precisely: the links themselves are largely harmless, and the harm is the demand that follows them. Somebody builds the spam, then emails offering to remove it for a fee, often with a deadline and a threat of more. It is the one link-based vector that regularly becomes a police matter rather than an SEO problem, and paying is the worst available option because it identifies you as a target who pays. The rest of this family shades from situational to spent: paid link framing, PBN links, redirect hijacking, pharma and adult link attacks, anchor text poisoning, and weaponized spam reports all have narrow conditions under which they achieve something, and those conditions are stated on each page rather than implied.
What this means for what you should do
Mostly, less than you think, and this is where the money gets wasted. Google's owndisavow links documentation says the company "works very hard to make sure that actions on third-party sites do not negatively affect a website," that "in most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool," and that it should be used only when you have a considerable number of spammy links and those links have caused, or are likely to cause, a manual action. Both conditions, not either. A disavow file filed on suspicion is at best inert; used carelessly it can remove links that were helping you, which is why the same page calls it an advanced feature that can harm a site's performance if used incorrectly.
So the practical order for anything in this family runs like this:
- Confirm there is no manual action, and no security issue.
- Confirm the drop does not land on a confirmed algorithm update.
- Export the referring domains with dates, so a contemporaneous record exists if this ever becomes a legal matter — link monitoring earns its place here and nowhere else.
- Then, in most cases, do nothing to the links at all, and go looking for the real cause on another attack surface.
One shape in this family deserves separating out, because it is the one that produces the most alarming number in a backlink tool for the least actual risk. A single link placed in the template of a large junk site becomes a sitewide link, repeated on every page it has, and a tool that counts links rather than domains will report tens of thousands of new backlinks overnight. Behind that number is one editorial decision on one site, and search engines have compressed it to roughly that for over a decade.
If a proposal you have been sent treats a link spike as an emergency, prices a cleanup against the number of referring domains, and never once asks whether Search Console shows a manual action, you are being sold the 2013 threat model. The attacks that work now are almost all in the other family.