The initial assumption โ theirs and ours โ was that the core update had reassessed their content quality. It had not. The actual cause was a backlink spam campaign.
What the Ahrefs audit revealed
Running the referring domains report in Ahrefs for the three months prior to the traffic drop showed 847 new referring domains โ an unusually high number for a B2B services site that had been building links at a rate of approximately 20 new referring domains per month for the prior two years. The new links shared several characteristics: domain names containing strings of random characters, sites hosted on the same IP range, anchor text consisting entirely of commercial keywords unrelated to the client's business, and content that was clearly auto-generated.
This is the signature of a negative SEO attack โ a competitor or actor building toxic links to a site with the intention of triggering a Google penalty. It is rare but real, and it is increasingly difficult to identify without a monthly monitoring discipline.
The remediation sequence
The response followed a specific sequence. First, Ahrefs exported the full referring domain list. Second, the toxic domains were identified using Ahrefs' domain spam score as a starting filter, then manually reviewed for the characteristics above. Third, a disavow file was prepared โ a plain text file listing the domains to be excluded from link equity calculation โ and submitted via Google Search Console.
The disavow submission does not produce an immediate ranking recovery. Google processes disavow files over a period of weeks, and the recovery is typically gradual. In this case, the client's commercial keywords returned to top-5 positions within 8 weeks of the disavow submission.
The monitoring setup that prevents recurrence
After remediation, Ahrefs backlink alerts were configured for the client's domain with a daily email digest for new referring domains. Any spike in new referring domain acquisition now triggers a review. The monthly backlink audit that previously took 30โ45 minutes of manual checking now takes five minutes of alert email review โ with the review only escalating to a full audit when the alert signals unusual activity.
The lesson is not that negative SEO is common โ it is not. The lesson is that a monthly backlink monitoring discipline makes the difference between catching an attack early and discovering it after six weeks of invisible damage. The cost of the monitoring is negligible. The cost of the undetected attack was 8 weeks of suppressed rankings and the associated lost revenue.
Senior Editor ยท Revenue desk
