Your spam referring domains spiked. It isn't an attack, and disavowing will cost you.

A wave of .shop spam referring domains hit UK sites in late August. Here are the four checks that tell you whether to act — and why you shouldn't disavow.

‍

A wave of spam referring domains started landing on UK sites in late August 2026. If you opened Ahrefs or Semrush this week and found a vertical line in your referring domains graph, this is probably what you are looking at.

‍

The reflex is to disavow. Do not. Here is the pattern, the four checks that tell you whether anything real has happened, and why reaching for the disavow tool is the one move that can turn a non-event into an actual problem.

‍

What the current wave looks like

Hallam reported the pattern publicly this week, and the shape is consistent across the sites where it has been described. A sudden surge of .shop and .store domains, appearing across multiple unrelated industries at roughly the same time.

‍

The domain names are formulaic and built from SEO vocabulary — the reported examples include backlinkengine.shop, googleseoauthority.shop and rankseotoolkit.shop. The sites themselves carry fake addresses, fabricated social profiles and invented contact details, which is the tell of an automated network rather than a hand-built one.

‍
That last detail matters more than it first appears. A network sprayed across unrelated sectors is not a campaign against you. You were in a list.

‍

Two different problems get called the same thing

Before diagnosing anything, separate these, because they have different causes and different fixes and they get conflated constantly.

• Referral spam in GA4. Fake sessions arriving from ghost referrers that never touched your site. This is analytics pollution. It distorts your reporting and does nothing to your rankings. Fix it with filters and segments in your analytics setup.
• Spam referring domains in Ahrefs, Semrush or Majestic. Real links, from junk domains, pointing at your site. This is a backlink profile issue — and in almost every case, an imaginary one.

The current wave is the second kind. If your sessions are unaffected and only your backlink tool is lit up, you are looking at links nobody is clicking and Google is very likely ignoring.

‍

Why this is almost certainly not a negative SEO attack

A genuinely targeted attack has a recognisable shape: a flat referring domain count for months, then hundreds or thousands of new domains inside 24 to 72 hours, low authority, often foreign-language, carrying commercially loaded anchor text aimed at a specific page.
‍

Even when that shape appears, the expected outcome has changed. Google's SpamBrain processes the link graph continuously, and the documented behaviour since the 2022 link spam update is to neutralise these links rather than count them against the target. Nobody has to intervene for that to happen.

‍
The practical test for whether you were targeted is whether anyone else was. If the same domains are linking to your competitors and to sites in sectors unrelated to yours, you were not selected. You were included.

‍

The four checks, in order

1. Check for a manual action

Search Console, then Security and Manual Actions, then Manual actions. If it reads "No issues detected", you do not have a link penalty. This is the only definitive statement Google gives you on the subject, and it takes about two minutes.
‍

Everything else in this diagnostic is inference. This one is not, which is why it goes first.

‍

2. Check whether anything actually moved

Take your top twenty pages by organic clicks. Compare clicks and average position for the fortnight before the spike against the fortnight after. If nothing moved, nothing happened, and the referring domain count is a number in a third-party tool rather than a description of your search performance.
‍

Be disciplined about the comparison window here. If a core or spam update landed in the same period, you are measuring two things at once and should say so.

‍

3. Check whether it is broad or targeted

Run two or three competitors through the same backlink tool and look for the same domains on the same dates. Broad distribution is the strongest available evidence that this is a spray rather than an attack.

‍

4. Check your own history honestly

Has the site ever bought links, run a guest post network, or inherited a link profile from an agency that did? If so, that is a different conversation, and the only one in which the disavow tool is genuinely on the table. If not, you are done — the answer is that nothing needs doing.

‍

Why disavowing makes it worse

Google's own position on the disavow tool has hardened. Gary Illyes has said that if it were his decision he would remove it, on the grounds that it damages more sites than it helps. John Mueller's framing is that the disavow file is a tool, not a religion. The published guidance has been consistent for years: it exists for sites with a manual action, not for routine maintenance.
‍

The mechanism of harm is specific, and it is worth understanding rather than taking on trust. Almost nobody builds a disavow file by hand. They build it from a third-party toxicity score, and those scores produce false positives at volume — perfectly good links flagged as risky because of a metric the tool invented. Upload that file and you have instructed Google to discount links that were working for you.
‍

It is also slow to undo. Removing a domain from the file does not restore it; Google has to recrawl each link before the instruction is reversed, which is a matter of months rather than days. And if you use domain-level entries, one wrong line discards every link from that domain, including the one that came from a genuine partner.
‍

You are trading a problem Google has almost certainly already solved for one you have to wait out.

‍

When you should disavow

Two situations, both narrow. You have an active manual action for unnatural links. Or you have specific, evidence-based reason to believe one is coming, because you know about paid link activity on the site and are cleaning it up ahead of a reconsideration request.
‍

A spike in junk domains you did not buy is neither of those things.

‍

What to do this week

• Check manual actions in Search Console. Two minutes, and it settles the question.
• Compare organic clicks and average position for your top pages before and after the spike date. Report on that, not on the referring domain count.
• Write the spike date into your reporting document now, with one line of explanation, so that nobody rediscovers it during the monthly review and escalates.
• If you report to a founder or CMO who watches a backlink graph, get ahead of it this week. Explaining an anomaly before you are asked about it is a different conversation from explaining it afterwards.
• If the junk is also polluting GA4 sessions, fix that separately with analytics filters. Different problem, different tool.
• Do not disavow.

‍

Frequently asked questions

Could a competitor actually damage my rankings with spam links?

It is difficult and increasingly rare, because SpamBrain neutralises rather than penalises. It is not literally impossible, which is why the manual action check exists. Check it, then move on.

Are backlink toxicity scores useful at all?

For triage, yes — they are a reasonable way to sort a large profile and see what is there. As the basis for a disavow decision, no. The score is the tool's opinion, not Google's, and the false positive rate is the whole problem.

Should I contact the sites and ask for link removal?

No. These are automated networks with fabricated contact details. There is nobody to email, and the time is better spent on the pages that earn you links you want.