This is the whole catalog: 33 ways one party can try to damage another party's search visibility, from spam link blasts to forged copyright complaints to a single suggested edit that reports an open business as permanently closed. Each one has its own page, and each page opens with a verdict before a word of prose. The verdict is the point of this site. A list of things that might happen to you is a fear inventory, and fear inventories are what the protection industry sells. What a defender needs is the opposite: an ordered judgment about which of these 33 things can actually hurt a site like theirs in 2026, so that attention and money go to the handful that can.
There are three verdicts and they are deliberately blunt. Documented threat means the attack has been observed in the wild, works against ordinary sites today, and is worth defending against on its own merits. Situational means it works under stated conditions and rarely otherwise, and the page names the conditions rather than leaving you to assume you meet them. Largely neutralized means search engines discard or ignore the mechanism, the fear is out of proportion to the risk, and anyone selling you protection from it is selling you something you do not need. Ten vectors here carry the first verdict, sixteen the second, and seven the third.
The third verdict is the one that took the most work and it is the one I would defend hardest. Writing that an attack does not work is commercially inconvenient for a practice that sells negative SEO recovery, which is exactly why it belongs on a reference. It is also more useful to a reader mid-emergency than another warning. If your rankings fell last Tuesday and you have spent a week worrying about a link spike, a page that tells you plainly that link velocity is not a mechanism Google has described, and that the shape of your referring-domain curve proves nothing on its own, has just given you back the week you were about to spend on the wrong problem.
How each verdict was reached
Every profile earns its pill from dated evidence rather than from consensus in the trade press. Where a search engine has published a position, the page quotes it, attributes it, and dates it. Where documented cases exist, they are described with their outcomes and their limitations, including the awkward ones: the 2012 experiment in which an attack against a thin microsite worked, and the 2013 account in which the same class of attack against an established site did nothing at all. Where the evidence is thin, the page says so instead of filling the gap with a plausible-sounding assertion.
Dating matters more here than in almost any other area of search. The answer changed. Between April 2012 and September 2016 the attacks aimed at link algorithms demonstrably worked against some targets, and everything written in that window reads as though they always will. On 23 September 2016, announcing that Penguin had become part of its core ranking system,Google wrote that Penguin "now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site." That single sentence is the hinge for a third of this catalog, because an attacker who cannot cause a demotion is paying to have links discarded. A 2013 fact stated in the present tense is a wrong fact, so every effectiveness claim on this site carries a date and every verdict is reversible if the evidence moves.
What the tally turns out to say
Read the ten documented threats together and a pattern falls out that no individual page can show you. Sorted by what the attacker actually does, they come to three groups:
- Compromise of the victim's own infrastructure. Hacked-site injection, a malware warning and the blacklisting that follows it, and denial of service against the server. Here Google does act against the victim's domain, for the straightforward reason that the spam really is on it.
- Abuse of a platform's own complaint, edit or review process. Listing hijacking through suggested edits, a business reported permanently closed, coordinated fake reviews, DMCA abuse, trademark complaints filed procedurally, and grievance sites built to rank for a brand name. These work by making a legitimate process fire on a false input, and no ranking algorithm stands in front of them.
- A crime against the owner rather than the site. Link ransom, where the links are largely inert and the extortion is the attack.
Not one of the ten is a link-based ranking manipulation. In the other direction, every one of the seven largely neutralized verdicts is a link or click-signal attack. Negative SEO did not stop being real. It stopped being about links, and most of the industry's vocabulary and most of its paid remedies are still pointed at the 2013 threat model.
Using this directory when something is actually happening
If you arrived here because traffic fell, do not start with the vector that sounds like your symptom. Start with the four-way question that decides everything downstream: is this an attack, an algorithm update, a manual action, or ordinary technical decay? The first three checks take about an hour and they close most cases:
- Search Console, manual actions. If it reads "No issues detected," no human reviewer at Google has penalized your site, and an entire branch of remediation — including any reconsideration request — is irrelevant to you.
- Search Console, security issues. This is where hacked content surfaces, and hacked content is in the category that genuinely works.
- The date of the drop, against the record of confirmed updates. A fall that lands on a core update is not sabotage, and the comparison takes minutes.
- The URL inspection tool, for the Google-selected canonical, if whole pages have gone rather than positions.
Most suspected sabotage ends in that triage, and the detection guides work through it in order with the reasoning for each step.
Only after that does a directory of attack vectors earn its keep. When the evidence does point at a third party, the specific page matters enormously, because the remedies are not interchangeable: a disavow file does nothing about a proxied copy of your site, a DMCA notice does nothing about a poisoned local citation, and a reconsideration request without a manual action achieves nothing at all. Two grouping pages sit alongside this one. The family split separates the 13 link-based attacks from the 20 content and platform attacks. The attack surface view regroups the same 33 by what is actually being attacked, which is usually the faster route when you already know which part of your business moved.
One caveat about the pages themselves, and it is a deliberate constraint. Each profile explains a mechanism in the detail a defender needs to recognize it and undo it, and stops there. There are no tool configurations, no service names, no marketplaces and no step-by-step procedures, because the test applied to every paragraph on this site is whether it helps someone run an attack more than it helps someone survive one. If you came looking to buy an attack rather than to survive one, the page on that demand is worth reading instead, and it is written on the facts rather than as a lecture.