Most writing on this subject sorts attacks by technique, because that is how attackers think about them. A defender does not have that luxury. You do not get to choose which technique arrives, and the technique is not what determines your exposure or who has to fix it. What determines both is the attack surface: which part of your business the attack touches, who controls that part, and what evidence that part produces when something goes wrong. So the same 33 vectors are regrouped here into five surfaces, and the regrouping is not cosmetic. It changes which pages you read first and which department has to act.
The five are your backlink profile, your content and who owns it, your server and crawl and code, your brand and its search results, and your Google Business Profile. Sorted this way, the distribution of documented threats is startling, and it is the argument for grouping like this.
Your backlink profile — 13 vectors, one documented threat
The largest group and the emptiest. Thirteen vectors point at what links to you, and the tally across them is one documented threat, seven situational and five largely neutralized — and the one documented threat, link removal extortion, is a crime against the owner rather than a manipulation of a ranking system. Nobody has to grant access for this surface to be attacked, which is why it dominates the fear; but since Penguin moved from demotion to devaluation in September 2016 the mechanism an attacker needs has largely not been there. This surface produces the most alarming-looking evidence in the whole subject, since a backlink index will happily show you a vertical wall of new referring domains, and the vertical wall usually means nothing. The defender's job here is mostly to record and to resist acting.
Your content and who owns it — 7 vectors
Scraping, autoblog theft, a copy outranking the original, forged DMCA takedowns, reverse proxy hijacking, canonical hijacking, and the long-dead 302 hijack. One documented threat, five situational, one largely neutralized. This surface is owned by whoever controls your templates and your publishing pipeline, and it produces its own distinctive evidence in the URL inspection tool and the page indexing report rather than in any backlink product. Its failure mode is misattribution rather than punishment: the risk is not that Google penalizes you for being copied, it is that Google credits the copy.
Your server, crawl and code — 5 vectors, three of them documented threats
Hacked-site injection, malware and blacklisting, injected keyword stuffing, spoofed Googlebot and crawler overload. Proportionally the most dangerous surface on the site, and the one that belongs to whoever administers the hosting rather than to whoever does the marketing. It is also the only surface where an attack against you results in Google acting against your domain, for the straightforward reason that the spam ends up on your domain. Everything on this surface is addressed by ordinary security work — patching, credential hygiene, two-factor authentication, file integrity monitoring, uptime monitoring — none of which is sold as negative SEO protection and all of which does more than anything that is.
Your Google Business Profile — 4 vectors, three of them documented threats
Fake negative reviews, listing hijacking through suggested edits and ownership claims, fraudulent closure reports, and citation poisoning across directories and data aggregators. For a local business this is where the real money is lost, and the loss shows up as fewer calls and fewer direction requests rather than as a ranking chart. It is a separate surface from the website in every way that matters: a different login, a different owner inside the business, a different complaint channel, and a different evidence trail. A site owner who audits links every month and has never looked at the profile's edit history is watching the wrong door.
Your brand and its search results — 4 vectors
Brand mention spam, SERP defamation, CTR manipulation and trademark or platform complaints. Two documented threats, one situational, one largely neutralized. This surface is different from the other four because the damage is not primarily to a ranking at all: it is to what a customer sees on the first page when they search your name, or to an account that gets suspended while the paperwork is argued. It is also the surface that most often needs a lawyer rather than an SEO, and where the honest answer is sometimes that publishing and ranking your own material is a better remedy than trying to remove somebody else's.
Why this grouping is the useful one
Three practical consequences follow from sorting this way. First, the surfaces are not equally dangerous and the tally proves it: eight of the ten documented threats sit on the server, the listing and the brand, while the backlink profile — thirteen vectors, the biggest group, the one that gets all the coverage — yields one, and that one is extortion. Second, each surface has its own evidence. Manual actions and security issues live in Search Console, canonical selection lives in the URL inspection tool, listing edits live in the profile's own history, load and crawler behavior live in server logs, and none of these is visible from the others. Third, each surface has a different owner and a different remedy. The person who can fix a compromised CMS is not the person who can file a review report, and the remedy for a hijacked listing is not related to the remedy for a proxied copy of your pages.
The practical way to use this page is to start from where the damage showed up rather than from what you fear:
- Calls fell but sessions held — start with the listing and its suggested edit history.
- Clicks collapsed while impressions held — start with the server, and with a malware warning.
- Specific pages vanished — start with content ownership and the copyright channel.
- Everything moved on a day a core update was confirmed — start there, because nothing was done to you, and no cleanup will bring the traffic back.
If you would rather see the same 33 vectors sorted by technique instead of by target, the full directory and the two family pages do exactly that.