This family gets a fraction of the attention that link attacks get, and it is where nine of the ten documented threats on this site live. Twenty vectors are collected here: attacks on the content you published and who is credited with it, on the server and the code that serve it, on the Google Business Profile that fronts a local business, and on what a searcher sees when they look up your name. Nine carry a documented threat verdict, nine are situational, and only two are largely neutralized. If you have limited time and money to spend defending a site, spend it here.
The reason these work when link attacks mostly do not is that none of them asks a ranking algorithm to punish an innocent party. They split into three mechanisms, and the split is worth holding onto because it predicts both the damage and the remedy.
Compromise of your own infrastructure
The first mechanism is the one where Google does act against your domain, and correctly, since the offending content really is on it. Spam pages and cloaked links written into a compromised CMS, hidden keyword blocks inserted into pages you own, malicious code that triggers a browser interstitial, or a site hammered until the crawler meets timeouts where it expects pages. Google'sspam policies define hacked content as "any content placed on a site without permission, due to vulnerabilities in a site's security," and enforcement follows the content rather than the intent behind it. Hacked-site injection is the most damaging vector in this reference on almost any measure, and malware and blacklisting is the fastest: a Safe Browsing interstitial removes effectively all of a site's traffic within hours, and its fingerprint is unmistakable once you know it, since impressions stay roughly flat while clicks collapse. Nothing about this category is exotic. It is ordinary website security, which is why the prevention guides put security first and link paranoia last.
Abuse of a platform's own processes
The second mechanism makes a legitimate process fire on a false input, and there is no algorithmic immune system in front of it because no ranking algorithm is involved. A forged copyright complaint can remove pages from search results within hours on an unverified assertion, and the tell is a notice at the foot of the results page saying results were removed in response to a complaint received under the US Digital Millennium Copyright Act. A suggested edit can change a business listing's category, hours, phone number or website. A closure report can mark an open business permanently closed, which kills it in the map pack overnight. Coordinated one-star reviews damage conversion immediately, whatever they do or do not do to ranking. Trademark and advertising complaints get accounts suspended first and investigated later.
The scale is not in dispute, because the platform publishes it. In April 2026Google reported blocking or removing over 292 million policy-violating reviews during 2025, blocking 79 million inaccurate or unverified edits, and removing over 13 million fake Business Profiles. Those are not numbers a company publishes about a theoretical problem. The defensive implication is specific and cheap: an unclaimed, unmonitored Business Profile carries nearly all of the remaining risk in this category, because a verified owner now gets told about suggested edits before they take effect, and an owner who is not watching finds out from a customer.
Ownership and attribution of your content
The third mechanism attacks who gets credit for the pages you wrote. Wholesale content scraping, RSS and autoblog pipelines that republish posts minutes after they go live, a copy on a stronger domain outranking the original, a proxied live mirror of your site served from somebody else's domain, and canonical hijacking, where a copy asserts authorship of pages it took. These are marked situational rather than documented threats, and the distinction is worth the words: duplication on its own is not a spam-policy violation and Google's guidance points at the scraper rather than the source, so the common fear that being copied will get you demoted is largely unfounded. What is real is misattribution on a specific set of pages, and it has an exact signature in Search Console. If the URL inspection tool reports a Google-selected canonical that is not your URL, or the page indexing report shows "Duplicate, submitted URL not selected as canonical," you are looking at an attribution problem rather than a ranking problem, and the remedies are different: absolute canonical tags, consistent internal linking, ownership signals, and where appropriate a copyright removal request. A disavow file does nothing here.
Reading these pages
Two vectors in this family are largely neutralized and they are the two that are really link or click-signal attacks wearing a different coat: 302 hijacking, which was solved two decades ago, and CTR manipulation, the theory that bot traffic can make a page look unsatisfying enough to be demoted. Both keep circulating, and both waste money.
The rest reward triage in a specific order, and the symptom usually names the surface:
- Calls fell, sessions did not. Start with the Google Business Profile, its edit history and its review stream — not the backlink profile.
- Clicks collapsed while impressions held. Suspect a malware warning or a delisting rather than a ranking change.
- Whole pages left the index. Check for a security issue, then for a copyright complaint, before touching anything else.
- A copy of a page outranks the original. Check the Google-selected canonical first; the fix is an ownership problem, not a link problem.
If a competitor is behind it, the reporting channels and the legal theories that exist are covered separately, because the honest answer is that some of these attacks have a real remedy, some have a slow one, and a few have none worth the cost of pursuing.