Define the question before naming an attack

Negative SEO describes attempts to harm another site’s search visibility. A backlink spike alone does not establish such an attempt, identify a person or explain a ranking change. Start with the narrower question: what changed in the evidence we can actually inspect? Record the source of the alert, affected pages and observation dates. Keep deliberate interference, ordinary publication, repeated sitewide links and changed data coverage as different possibilities until there is evidence to distinguish them.

Compare like-for-like evidence

Use the same provider, property scope, filters and counting method for both exports. Count link rows and referring domains separately; many rows can come from very few sites. A provider’s first-seen date records discovery, not necessarily when a link was published. Search Console’s Links report is a sample, not a complete live inventory. Its grouping and deduplication may differ from another provider, so unequal totals do not automatically mean that one source is wrong.

Read the seven-day example

In this fictional exercise, day 0 contains 120 link rows from 40 referring domains. Day 7 contains 840 rows from 42 domains using the same scope. Comparing the saved files attributes the additional 720 rows to two newly observed domains. A manual sample shows repeated directory-style pages, but the remaining rows have not all been visited. A site release occurred in the same period. The worksheet preserves these facts separately; neither the count increase nor the timing identifies an attacker or a cause of lost visibility.

  • Day 0 baseline: Example observation: 120 link rows across 40 domains in the fictional export; Evidence to record: Provider, scope, filters and saved file date; Action if it differs: Keep the original file; align settings before comparing
  • Day 7 increase: Example observation: 840 rows across 42 domains;720 added rows from two domains; Evidence to record: Matched export and sampled source/target pairs; Action if it differs: Inspect representative pages; do not label all rows an attack
  • Discovery date: Example observation: The provider first observed links during the interval; Evidence to record: Provider field definition and any independent publication evidence; Action if it differs: Keep discovery and publication dates separate
  • Site release: Example observation: A template changed in the same period; Evidence to record: Release log, actual page output and affected URLs; Action if it differs: Check for unintended noindex without assuming ranking causality
  • Manual-action status: Example observation: The investigator lacks property access; Evidence to record: Dated report supplied by the verified owner; Action if it differs: Record unknown; do not treat missing access as no action

Choose an action from confirmed findings

Investigate confirmed page defects through the person who controls the affected site. For the example release, inspect whether a changed template introduced noindex and which URLs received it; do not assume the release caused a search decline. Ask the property owner to inspect Search Console’s Manual Actions report. Without access, the status is unknown, not clear. Google describes disavow as an advanced step for substantial problematic links associated with an actual or likely manual action, not an automatic response to an alarming score or spike.

Keep the investigation reproducible

Save the two exports with their provider, scope, filters and observation dates. Record the exact source and target URL pairs you inspected, what the page showed and which rows remain unchecked. Add release notes, verified page defects and the owner’s report status to separate timeline entries. Give each next action an owner and a review date. If remediation is warranted, use the dedicated removal or disavow guidance and retain the previous decisions; this worksheet does not contact publishers or upload a disavow file.

  • Keep the two original exports and their exact scope.
  • Compare referring domains as well as link rows.
  • Record inspected examples separately from unchecked records.
  • Verify site changes and owner-access reports before escalation.
  • Close each finding with evidence; leave unknown causes explicitly open.

Know what the evidence cannot prove

A simultaneous traffic change remains a correlation until competing explanations have been examined. Technical faults, changed demand and search-system changes can require different investigations. A clean Manual Actions report would not prove that every link is beneficial or that no other search issue exists. Record an unresolved cause as unresolved rather than assigning blame. This exercise is not a live audit, an attribution service or a promise of recovery; actual outcomes require the owner’s real site and search evidence.

Fictional manual investigation. Counts and events are invented, not measurements of your site. No attacker, penalty or cause has been established; no report is fetched or submitted.