I launched this site in late 2025. Over the next several months, 348 different domains linked to it, and not one of them was real.
At first I went looking for the good news, because somewhere in that pile there had to be a directory listing worth keeping, a local mention, or maybe one actual website that found something useful. There wasn’t. Every referring domain was junk.
When I started tracing where the links went, 205 of them ended at the exact same WhatsApp conversation. That wasn’t the strangest part either. The links were nofollow, which meant they were probably not built to improve my rankings or destroy them. They were built to get noticed inside my backlink reports.
What looked like an SEO attack was actually a sales funnel.
Here is what showed up, how I traced it, and what you should do if the same thing starts happening to your site.
What showed up
The pattern started slowly. Two domains appeared in September 2025, then a few more showed up over the winter. In April, something switched on.
| Month | New referring domains |
|---|---|
| Sep 2025 | 2 |
| Dec 2025 | 5 |
| Jan 2026 | 1 |
| Mar 2026 | 3 |
| Apr 2026 | 14 |
| May 2026 | 121 |
| Jun 2026 | 121 |
| Jul 2026 | 81 in 24 days |
By July, I was getting roughly three and a half new spam domains per day, and the pace was still climbing when I pulled the numbers.
The domains were not subtle. Of the 348 domains, 170 ended in .store and another 135 ended in .shop. That means 88 percent of the entire backlink profile came from two cheap, disposable-looking extensions.
The names looked auto-generated: linkseoalliance.shop, rankgrowthmasters.shop, domainrankacademy.shop, and modern-guest-post-consultants-seoexpress.store. It read like somebody gave an SEO thesaurus to a domain-name generator and let it run all night.
One pattern stood out before I even started checking redirects. Of the 170 .store domains, 130 had a Domain Rating of exactly 32. Not around 32. Exactly 32.
The median domain in that group had 387 referring domains and linked out to 337 other domains. That near one-to-one pattern strongly suggests a closed network of sites cross-linking with each other, probably using the same template and deployment process. It did not look organic. It looked manufactured.
The first useful clue
I opened one of the domains. Most advice says not to click suspicious backlinks, which is generally fair advice, but I wanted to know what was actually on the other side.
The site did not really load a page. It redirected me to a WhatsApp contact link. I checked another domain and got the same result. Different domain, same WhatsApp destination, character for character.
Then I checked another. Same thing again.
At that point the question changed. I was no longer asking how much spam I had. I was asking how much of it belonged to the same operation.
Tracing the network
I ran all 348 domains through a script that followed each redirect chain to the end. That included ordinary HTTP redirects, but also meta refreshes and JavaScript redirects. A lot of these doorway sites do not use a normal server-side redirect, so a basic header check would miss what they are doing.
Once every domain had a final destination, I grouped them by where they landed.
| Final destination | Domains | First appeared |
|---|---|---|
| seoexpress.org, then one WhatsApp link | 205 | Apr 17, 2026 |
| skylinkseo.com | 34 | Sep 22, 2025 |
| buyseolink.com | 24 | Dec 20, 2025 |
| seoboost.agency | 15 | May 8, 2026 |
| rankzly.com | 14 | Dec 13, 2025 |
| toprankflow.com | 10 | May 1, 2026 |
| rankva.com | 7 | Sep 19, 2025 |
| list.show | 4 | Mar 22, 2026 |
| backlinksnexa.com | 3 | Jun 22, 2026 |
| No redirect, parked, or directory junk | 24 | Mixed |
| Already dead | 3 | Jul 2026 |
Two hundred and five domains, or 59 percent of every spam domain pointing at my site, went through the same intermediary and ended at the same WhatsApp conversation.
That strongly suggests common control, or at least one shared sales destination. It does not prove that one person personally registered and operated every site, but it does show that more than half the network was feeding the same contact funnel.
The domain extensions also split pretty cleanly. Of the 170 .store domains, 169 belonged to the cluster that ended at that WhatsApp contact. Most of the other operators used .shop.
So the network did not look like one giant random pile. It looked more like several batches, with one operator or sales destination controlling the biggest one.
The template gave them away
This is where it got more interesting. Several of the other operator clusters were running sites with placeholder text still sitting in the live code.
One group had wa.me/1234567890 and t.me/yourtelegram across fifteen domains. Those are not real contact details. They are example values, the kind of thing that ships inside a website template and is supposed to be replaced before launch.
Another group was outputting wa.me/${CONFIG.WHATSAPP_NUMBER} as raw text. A third was doing the same thing with wa.me/${PHONE}.
These were three separate brands with three separate groups of domains, but they all had the same kind of setup mistake. They also used the same WhatsApp and Telegram pairing in roughly the same place.
That does not prove all nine brands are secretly the same company. What it does strongly suggest is that several of them are using versions of the same doorway-site toolkit.
Somebody likely built a reusable system for generating the domains, pages, fake testimonials, links, and contact buttons. Different link sellers then deployed it, sometimes without even opening the configuration file first.
The businesses showing up in my backlink report may not be building these networks from scratch. They may just be customers of whoever sells the kit.
These are not really backlinks
This was the finding that changed how I looked at the whole thing. Every one of the 316 domains that redirected somewhere used a nofollow link.
All of them.
The only dofollow links in the profile came from parked domains and auto-generated directory pages that did not redirect anywhere.
That matters. If the main goal was to improve my rankings, nofollow links would be a poor choice. If the goal was to hurt my rankings, it would also be an odd setup. But if the goal was to get my attention, it makes perfect sense.
These links did not need to pass authority. They only needed to be crawled and appear inside a backlink-monitoring tool.
That means they were not really backlinks in the traditional sense. They were ads, and the ad placement was a row inside my Ahrefs dashboard.
Once you see it that way, the whole funnel becomes pretty simple. Register a cheap domain, generate a page about a target website, and wrap it in a fake testimonial or some vague SEO language. Then place a nofollow link to the target and wait for the website owner to see an unfamiliar referring domain in Ahrefs, Semrush, Moz, or another SEO tool.
When the owner clicks the domain, redirect them to a sales page or WhatsApp conversation offering SEO and link-building services.
The link is the ad. Your backlink report is the ad network. Your curiosity is the click-through.
I do not really like admitting it, but it is clever. They found a way to advertise directly inside a report mostly used by marketers, SEOs, agencies, and business owners already worried about rankings.
Why my site got hit so hard
Three hundred and forty-eight spam domains is a lot for a new site with little traffic and not much authority. I think there are two reasons it happened.
The first is simple. New domains are easy to find. Newly registered and newly indexed websites appear in public feeds, search indexes, certificate logs, and crawling databases. Building lists of them is not difficult.
If you launched a new site recently, there is a good chance it has already appeared in somebody’s automated prospecting system.
The second reason is more specific to my business. I run an SEO company, and my domain includes the word “SEO.” From a link seller’s point of view, that makes me a better prospect than the average business owner.
I already know what a referring domain is, I already monitor backlinks, and I could plausibly buy the exact service they are selling. The spike beginning in April also lines up with the period when the site would have been crawled, indexed, and categorized by more tools.
I cannot prove that is why they targeted it, but it fits the pattern. If you run an SEO, marketing, web design, or development company, you may see more of this than your clients do.
You are not only a website owner. You are the target customer.
Should you disavow these links?
In this situation, no.
I want to be specific about that because “should I disavow these backlinks?” is one of the first questions business owners ask when they open Search Console or an SEO tool and see a pile of junk.
Google has said for years that its systems are generally good at ignoring spammy links. The disavow tool is meant for narrower situations, such as a manual action or a real history of paid, manipulative link building that needs to be cleaned up.
It is not meant to be routine maintenance every time a strange domain appears.
In my case, the argument against disavowing is even stronger. These were unsolicited links, there was no manual action, I had no history of buying them, and every redirecting link I checked was marked nofollow.
There was no evidence that they were helping or hurting the site, so I left them alone.
What I would do instead
Check Search Console
Do not rely only on Ahrefs, Semrush, Moz, or another third-party crawler. Those tools may discover pages Google never indexes or never treats as meaningful.
Search Console gives you a better idea of what Google actually found and associated with your site. The list there is usually much shorter.
Watch your referral traffic
The most practical damage from these domains may be messy analytics. If they start sending visits, they can distort referral reports, engagement numbers, or conversion data.
Filter obvious spam referrals so your reporting stays useful.
Look for a manual action
Do not let an agency scare you with a “toxic backlink” chart alone. Ask whether there is a manual action in Search Console, whether there is evidence of intentional paid link building, and whether rankings or traffic actually changed.
A scary number in an SEO tool is not the same thing as a Google penalty.
Build real links
The ratio looks worse when a site is new. If your site has five legitimate referring domains and 300 spam domains, the profile looks ugly even if the spam is doing nothing.
As you earn real local links, industry mentions, citations, partnerships, and press coverage, the junk becomes less noticeable. The long-term answer is not endless cleanup. It is building something real enough that the spam becomes background noise.
Do not contact the WhatsApp number
There is no useful reason to reply. Best case, you confirm that the funnel worked. Worst case, you give an unknown operator more information about who you are and how actively you monitor your site.
Just leave it alone.
What business owners should take from this
Spam backlinks are going to appear in your reports. That does not automatically mean a competitor is attacking you, it does not automatically mean Google is penalizing you, and it does not automatically mean you need to pay somebody to remove them.
On my site, the volume accelerated sharply during spring and summer 2026. But the links themselves were mostly nofollow doorway links designed to attract attention, not pass authority.
The more useful question is not, “How do I delete every bad-looking backlink?”
It is, “Is there any evidence that Google cares about these links?”
Check Search Console. Look for manual actions. Find out whether the links were intentional, and whether traffic or rankings actually changed. Then make a decision based on evidence, not a red warning label inside an SEO tool.
The thing I would be most skeptical of is an agency that opens with a giant toxic-backlink score and immediately offers a monthly cleanup service. That can turn into a service built around solving a problem the search engine is already ignoring.
Ask them to show you the actual damage. Not the score or the color-coded chart. The damage.
The real business model
At first, I thought somebody had built hundreds of spam links to my new website. That was technically true, but it missed the point.
The links were not the product. My attention was the product.
More than half of the domains led to one WhatsApp conversation. Several other clusters appeared to use the same kind of template system, including placeholder contact details that were never replaced.
The network looked less like an SEO attack and more like a cheap prospecting machine. Create disposable domains, get them discovered by backlink crawlers, wait for marketers and business owners to investigate, then redirect that curiosity into a sales conversation.
Spam backlinks are usually treated like pollution inside an SEO report.
In this case, the report was the advertising platform.