I launched this site in late 2025. Over the next several months, 348 different domains linked to it, and not one of them was real.
At first I went looking for the good news, because somewhere in that pile there had to be a directory listing worth keeping, a local mention, or maybe one actual website that found something useful. There wasn’t. Every referring domain was junk.
When I started tracing where the links went, 205 of them ended at the exact same WhatsApp conversation. That wasn’t the strangest part either. The links were nofollow, which meant they probably weren’t built to improve my rankings or destroy them. They were built to get noticed inside my backlink reports.
What looked like an SEO attack was actually a sales funnel.
The short version
If you’re a business owner who found this because somebody showed you a scary report about your backlinks, here’s the whole thing in five lines:
- Spam backlinks show up on nearly every website now. Yours probably has some.
- Most of them are nofollow, which means Google isn’t counting them at all.
- They’re usually not a competitor attacking you. They’re advertising, aimed at you.
- You almost certainly don’t need to disavow anything.
- If an agency opens with a “toxic backlink score,” ask them to show you actual damage instead.
The rest of this is how I know that, using my own website as the example.
What showed up
The pattern started slowly. Two domains appeared in September 2025, then a few more showed up over the winter. In April, something switched on.
| Month | New referring domains |
|---|---|
| Sep 2025 | 2 |
| Dec 2025 | 5 |
| Jan 2026 | 1 |
| Mar 2026 | 3 |
| Apr 2026 | 14 |
| May 2026 | 121 |
| Jun 2026 | 121 |
| Jul 2026 | 81 in 24 days |
By July I was getting roughly three and a half new spam domains per day, and the pace was still climbing when I pulled the numbers.
The domains weren’t subtle. Of the 348, 170 ended in .store and another 135 ended in .shop. That’s 88 percent of the entire backlink profile coming from two cheap, disposable extensions.
The names looked auto-generated: linkseoalliance.shop, rankgrowthmasters.shop, domainrankacademy.shop, and modern-guest-post-consultants-seoexpress.store. It read like somebody gave an SEO thesaurus to a domain-name generator and let it run all night.
One pattern stood out before I even started checking redirects. Of the 170 .store domains, 130 had a Domain Rating of exactly 32. Not around 32. Exactly 32.
The median domain in that group had 387 referring domains and linked out to 337 other domains. That near one-to-one pattern strongly suggests a closed network of sites cross-linking with each other, probably using the same template and deployment process. It didn’t look organic. It looked manufactured.
The first useful clue
I opened one of the domains. Most advice says not to click suspicious backlinks, which is generally fair, but I wanted to know what was actually on the other side.
The site didn’t really load a page. It redirected me to a WhatsApp contact link. I checked another domain and got the same result. Different domain, same WhatsApp destination, character for character.
Then I checked another. Same thing again.
At that point the question changed. I was no longer asking how much spam I had. I was asking how much of it belonged to the same operation.
Tracing the network
I ran all 348 domains through a script that followed each redirect chain to the end. That included ordinary HTTP redirects, but also meta refreshes and JavaScript redirects. A lot of these doorway sites don’t use a normal server-side redirect, so a basic header check would miss what they’re doing.
Once every domain had a final destination, I grouped them by where they landed.
| Final destination | Domains | First appeared |
|---|---|---|
| seoexpress.org, then one WhatsApp link | 205 | Apr 17, 2026 |
| skylinkseo.com | 34 | Sep 22, 2025 |
| buyseolink.com | 24 | Dec 20, 2025 |
| seoboost.agency | 15 | May 8, 2026 |
| rankzly.com | 14 | Dec 13, 2025 |
| toprankflow.com | 10 | May 1, 2026 |
| rankva.com | 7 | Sep 19, 2025 |
| list.show | 4 | Mar 22, 2026 |
| backlinksnexa.com | 3 | Jun 22, 2026 |
| No redirect, parked, or directory junk | 24 | Mixed |
| Already dead | 3 | Jul 2026 |
Two hundred and five domains, or 59 percent of every spam domain pointing at my site, went through the same intermediary and ended at the same WhatsApp conversation.
That strongly suggests common control, or at least one shared sales destination. It doesn’t prove that one person personally registered and operated every site, but it does show that more than half the network was feeding the same contact funnel.
The domain extensions also split pretty cleanly. Of the 170 .store domains, 169 belonged to the cluster that ended at that WhatsApp contact. Most of the other operators used .shop.
So the network didn’t look like one giant random pile. It looked more like several batches, with one operator or sales destination controlling the biggest one.
The template gave them away
This is where it got more interesting. Several of the other clusters were running sites with placeholder text still sitting in the live code.
One group had wa.me/1234567890 and t.me/yourtelegram across fifteen domains. Those aren’t real contact details. They’re example values, the kind of thing that ships inside a website template and is supposed to be replaced before launch.
Another group was outputting wa.me/CONFIG.WHATSAPPNUMBERasrawtext.Athirdwasdoingthesamethingwithwa.me/{PHONE}.
Three separate brands, three separate groups of domains, and all of them had the same kind of setup mistake. They also used the same WhatsApp and Telegram pairing in roughly the same place on the page.
That doesn’t prove all nine brands are secretly the same company. What it strongly suggests is that several of them are using versions of the same doorway-site toolkit.
Somebody likely built a reusable system for generating the domains, pages, fake testimonials, links, and contact buttons. Different link sellers then deployed it, sometimes without even opening the configuration file first.
The businesses showing up in my backlink report may not be building these networks from scratch. They may just be customers of whoever sells the kit.
These aren’t really backlinks
This was the finding that changed how I looked at the whole thing. Every one of the 316 domains that redirected somewhere used a nofollow link.
All of them.
If you don’t work in this field, here’s what that means. When one website links to another, Google can treat that link as a small vote of confidence. It’s part of how search engines decide which pages to trust. A nofollow link is a link with a piece of code attached that tells Google not to count it. It’s a mention with the vote removed.
So these domains were linking to me in a way that was guaranteed not to affect my rankings. Not up, not down.
The only dofollow links in my profile, meaning the kind that could theoretically count, came from parked domains and auto-generated directory pages that didn’t redirect anywhere.
That matters. If the goal was to improve my rankings, nofollow links would be a poor choice. If the goal was to hurt my rankings, it would also be an odd setup. But if the goal was to get my attention, it makes perfect sense.
These links didn’t need to pass authority. They only needed to be crawled and to appear inside a backlink-monitoring tool.
Which means they weren’t really backlinks in the traditional sense. They were ads, and the ad placement was a row inside my Ahrefs dashboard.
Once you see it that way, the funnel becomes simple. Register a cheap domain, generate a page about a target website, wrap it in a fake testimonial or some vague SEO language. Place a nofollow link to the target. Wait for the website owner to see an unfamiliar referring domain in Ahrefs, Semrush, Moz, or another tool.
When the owner clicks the domain, redirect them to a sales page or a WhatsApp conversation offering SEO and link-building services.
The link is the ad. Your backlink report is the ad network. Your curiosity is the click-through.
I don’t really like admitting it, but it’s clever. They found a way to advertise directly inside a report that’s mostly read by marketers, agencies, and business owners already worried about their rankings.
Why my site got hit so hard
Three hundred and forty-eight spam domains is a lot for a new site with little traffic and not much authority. I think there are two reasons it happened.
The first is simple. New domains are easy to find. Newly registered and newly indexed websites appear in public feeds, search indexes, certificate logs, and crawling databases. Building lists of them isn’t difficult.
If you launched a site recently, there’s a good chance it has already landed in somebody’s automated prospecting system.
The second reason is specific to my business. I run an SEO company, and my domain has the word “SEO” in it. From a link seller’s point of view, that makes me a better prospect than the average business owner.
I already know what a referring domain is, I already monitor backlinks, and I could plausibly buy the exact service they’re selling. The spike beginning in April also lines up with the period when this site would have been crawled, indexed, and categorized by more tools.
I can’t prove that’s why they targeted it, but it fits. If you run an SEO, marketing, web design, or development company, you may see more of this than your clients do.
You aren’t only a website owner. You’re the target customer.
Should you disavow these links?
In this situation, no.
I want to be specific about that, because “should I disavow these backlinks?” is one of the first questions business owners ask after opening Search Console and seeing a pile of junk.
Google has said for years that its systems are generally good at ignoring spammy links. The disavow tool is meant for narrower situations, such as a manual action or a real history of paid, manipulative link building that needs cleaning up.
It isn’t routine maintenance to be performed every time a strange domain appears.
In my case the argument against disavowing is even stronger. These were unsolicited links, there was no manual action, I had no history of buying links, and every redirecting link I checked was nofollow.
There was no evidence they were helping or hurting the site, so I left them alone.
What I would do instead
Check Search Console. Don’t rely only on Ahrefs, Semrush, or Moz. Those tools crawl pages Google may never index or never treat as meaningful. Search Console shows you what Google actually found and associated with your site, and the list there is usually much shorter.
Watch your referral traffic. The most practical damage from these domains is messy analytics. If they start sending visits, they can distort your referral reports and conversion data. Filter obvious spam referrals so your reporting stays useful.
Look for a manual action. This is the single check that separates a real problem from a scary-looking chart. It takes about thirty seconds inside Search Console.
Build real links. The ratio always looks worse when a site is new. Five legitimate referring domains against 300 spam domains looks ugly even when the spam is doing nothing. As you earn local links, industry mentions, citations, and press coverage, the junk fades into the background. The long-term answer isn’t endless cleanup. It’s building something real enough that the spam stops mattering.
Don’t contact the WhatsApp number. Best case, you confirm the funnel worked. Worst case, you tell an unknown operator exactly who you are and how closely you watch your site.
About that “toxic backlink” report
If somebody has shown you a red score and offered to fix it, this section is the reason I wrote the post.
Here’s the thing worth knowing: Google doesn’t publish a toxicity score. There is no such metric coming from the search engine. Every toxic, spam, or risk score you’ve been shown was invented by a third-party SEO tool, calculated with that company’s own private formula, and it can differ wildly from one tool to the next for the exact same website.
That doesn’t make those tools useless. It makes the number an opinion rather than a verdict, and an opinion is a strange thing to buy a monthly cleanup subscription for.
The pitch usually follows the same shape. Somebody runs a free audit on your site, exports a chart with a big red number, and offers ongoing backlink cleanup or disavow management for a monthly fee. The chart is doing all the persuading, and it’s persuading you about a problem nobody has demonstrated you have.
Four questions to ask before you agree to anything:
- Is there a manual action in my Search Console account?
Have them open the Manual Actions screen and show you. If it says “No issues detected,” there’s no penalty to fix. - Did my traffic or rankings actually drop, and when?
A real problem has a date attached and a visible decline. If nothing dropped, nothing broke. - Did I, or anyone I hired before, ever buy links?
If the answer is genuinely no, the tool most disavow files exist for doesn’t apply to you. - What happens if I do nothing?
Ask for a specific answer. Vague warnings about future risk are a sales technique, not a diagnosis.
There are real situations where cleanup is the right call. If you have a manual action, disavow is part of the fix. If you or a previous agency bought links, that history may need addressing. If you bought an expired domain, you might have inherited somebody else’s mess. Those cases exist and they’re legitimate.
What they have in common is evidence. Someone can point at the manual action, at the invoices, or at the traffic chart and show you the moment something went wrong.
An agency that opens with fear before it understands your business is telling you something about how it sells. That’s worth noticing before you find out how it works.
The real business model
At first I thought somebody had built hundreds of spam links to my new website. That was technically true, but it missed the point.
The links weren’t the product. My attention was the product.
More than half the domains led to one WhatsApp conversation. Several other clusters appeared to run the same kind of template system, including placeholder contact details that were never replaced.
The network looked less like an SEO attack and more like a cheap prospecting machine. Create disposable domains, get them discovered by backlink crawlers, wait for marketers and business owners to investigate, then convert that curiosity into a sales conversation.
Spam backlinks are usually treated like pollution inside an SEO report.
In this case, the report was the advertising platform.
If somebody scared you about your backlinks, send it to me
I’ll look at it for free and tell you in plain English whether it means anything.
Forward me the report, send a screenshot, or give me read access to your Search Console. You’ll get an honest answer, and if the answer is “this is nothing, ignore it,” that’s what I’ll tell you. No call required and nothing to sign.
I do this because most of the time it genuinely is nothing, and I’d rather you hear that from someone who isn’t selling you a cleanup package.
I build and rank local business websites in Omaha and Lincoln, and I write up what I find along the way. I still have the full dataset behind this post, every domain, every redirect chain, and every timestamp, if you’d ever like to see it.