Spam backlinks pointing at you: a runbook
Most junk links get ignored, and that is the point of SpamBrain. Work through these steps in order and stop as soon as one tells you to.
The runbook
- 1
Check for a manual action
Open Search Console and look at Manual actions. If it says none, you are dealing with automated systems, and the urgency drops sharply.
- 2
Size the pile
Call
refdomainssorted by newest and count. Fifty odd domains next to 4,000 ordinary ones is noise. Two thousand new ones in a month is a pattern. - 3
Read the anchors
Call
anchorsand look for casino, pharma or foreign-language terms you never used. Those are the hallmark of a negative-SEO blast. - 4
Date it against traffic
Did clicks move within weeks of the links appearing? Without a match in time, you have a coincidence, not a cause.
- 5
Decide
Use the table below. Most sites end at 'leave it alone and keep a note'.
Decision table
| What you see | Likely meaning | Action |
|---|---|---|
| No manual action, small spike, no traffic change | Automated systems discount it | Log it, recheck next month |
| Manual action citing unnatural links | A human reviewer saw a pattern | Clean up, disavow what you cannot remove, file a reconsideration request |
| Huge spike of casino anchors, traffic drops same week | Possible attack, possibly coincidence | Disavow the domains, keep the evidence, watch two refreshes |
| Spam pointing at an old redirected domain | Redirect passes the attention to you | Check whether the redirect is still worth keeping |
Why Google says to be calm
Penguin 4.0, released in September 2016, started devaluing bad links in real time instead of penalising whole sites. Then SpamBrain's link spam update on 14 December 2022 made that automatic discounting a machine-learning job.
That is why panic disavows are wasteful. Disavowing live, harmless links can also remove value you earned. It happens, quietly.
Google's own help page keeps the tool for cases where you have a manual action or a clear paid-link history. We follow that reading.
How to build a disavow file, if you reach that step
Disavow whole domains, not single URLs, with a line like domain:spam-example.test. Keep a plain text file and a dated copy of every upload.
Skip anything you cannot justify. A link from a small blog you simply do not know is not spam, and a sensible rival of yours may have more of them than you think.
After uploading, expect nothing visible for weeks. Google reprocesses links as it recrawls them, and our own monthly refresh will not mark the file either.
Keep one more rule: never pay anyone to remove links and never pay for 'protection'. Both are classic vendor tricks. Compare competitor backlinks first, so you know what ordinary looks like in your niche.
What to log while you wait
Keep a dated sheet. One row per snapshot: referring-domain count, the five most common anchors, clicks from Search Console for the same week.
Wait three refreshes. Then you will know whether the pile grew, shrank or stayed put. That answer decides more than any opinion on a forum. If it kept growing, repeat the steps and consider sending the evidence to a specialist.
Pair this with the indexing table, since an attack can coincide with unrelated crawl problems.
Pull the evidence in two calls
curl "https://rankbrainmarketing.link/api.php?action=anchors&q=yourdomain.com&per=200&key=sk_live_..."
curl "https://rankbrainmarketing.link/api.php?action=refdomains&q=yourdomain.com&sort=dr&order=asc&per=500&key=sk_live_..."Our index refreshes about monthly. A brand-new attack may not show until the next refresh, so a clean pull today does not prove you are untouched.
Questions we get on spam links
- Should I disavow spam links to a redirected domain?
- Only if a manual action exists or the pattern is huge. Google says it discounts most junk automatically. Check whether the redirect still earns anything useful first; removing the redirect may end the problem faster than any file.
- Can a competitor really hurt me with bad links?
- Rarely. Google has said for years that it designs systems to ignore such links. Attacks are reported, and some come with sudden traffic changes, but timing alone does not prove cause. Document the dates and wait for two refreshes.