Negative SEO or Just Noise? How to Read a Spam Backlink Profile Before You Disavow

I have a folder full of “toxic link” PDFs from different Singapore owners. Almost all of them are not negative SEO. Just a red dial and sales email pitches.

Negative SEO does happen — but that’s rarely what the backlink report is actually showing on a Tuesday afternoon.

It’s even more pronounced in the Singapore search market, where diversity in search engines has not yet taken off. Statcounter’s August 2026 cut for Singapore averages Google at 92.61% with Bing at about 3.6%. So all your misreading of the backlink report is likely confined to Google.

Two emails show up on repeat.

• Look at these Google links. We’re under attack.
• Upload a disavow this week or Google will punish the domain.

We work with a tuition centre and an enrichment centre. We looked at the charts for problems and they looked even worse. But we dug into the referring domains that mattered — and it was okay.

Opening the file in Ahrefs to review the toxic score for each link is time-consuming and quite boring, but it pays off after twenty minutes or so. Same instinct as a proper SEO audit: the sheets only present a queue of potential candidates for Disavow, not a definitive list of links.

How we read the sheet

Reading rough traffic stats can wait. What you really need to know is who linked to you, how they linked to you, when they linked to you, whether it’s follow or nofollow, and whether the page is even alive.

Group by the root domain of the linking site and look for patterns within each column — don’t just trust the row count.

Note that Ahrefs counts CMS-generated language copies of the single link you found in a guest post as 100+ backlinks. Look up your GSC links report (hideously slow to open and scour through) and note down the hosts and anchors that both Ahrefs and GSC flag, and that look commercial in nature.

I also notice similar spam in other languages on Singapore tuition and enrichment sites (e.g., English scrapers, Mandarin doorway pages, multilingual education directories, etc.). They may look different but essentially contain the same type of junk.

What keeps showing up

Google-country hosts

Stuff like cse.google.com.br, images.google.co.id, maps.google.com.sg. Old redirect endpoints.

The tuition centre had batches across dozens of country TLDs — not some 2026 super-villain. This has been ScrapeBox/GSA noise from 2010–2015. Google already knows about it all. Disavowing all of the Google-country host domains will take up a couple of hours of your time and then have to be crossed off your list of things to do in case you need to refer back to the file(s) in the future. Just screenshot and note “ignore” for now.

One post, “a hundred links.”

You can look at edustoke.com (a public example) where two guest posts were auto-translated into 25+ languages, and according to Ahrefs, there were on the order of 100 backlinks created. Yet in Google’s eyes it’s still a single host.

Export jumps after a multilingual directory placement? Check for root domain and language code within the URL path before jumping to conclusions and escalating issues to others. Tool count doesn’t equal vote count and Singapore education-related sites are constantly being pitched to for inclusion in directories of such nature for placement of links.

Cheap TLDs that smell like PBNs

Money phrases — exactly matched — in (mostly) exact-match TLDs (e.g. gambling in .bet / .casino). Pointless-sounding combinations of words as domain names (e.g. myfakewebsitedottsxyz). Generic-looking throwaway websites with YOUR MONEY PHRASE buried deep within. Same old WP template and copy-pasted “content” around the gambling theme. And yes, on rare occasions, a link to your interior page from a MONEY ANCHOR within the page’s content.

Open up 10 random doorways — chances are that 9 of them will be full of low-quality spun English copy. Do a domain-level disavow for these types of doorways. I have found that one random niche site in the marketplace that has a single link to you is far more valuable than an old list that has been sold and died of years of lazy link building that is now classed as an attack.

Hacked hosts

This would look like a healthy travel or recipe blog (with possibly a few occasional satka-matka or pharmaceutical pages) and then some sort of money page (most likely with a commercial anchor for your money phrase). The best way to handle this is for the host to file an abuse report. As long as the rest of the site looks clean, then only the offending URL needs to be disavowed. The rest of the site can be ignored.

Scrapers and “SEO tool” pages

Free checker sites, scraped sites, junk in toolbar, etc — fill out referring domains, usually adds little value to your rankings. Mostly ignore. For odd anchors on these sites, like Brand + Naked URL, see above for what to do about those.

Buckets we actually use

• Safe — real publishers, partners, press, sensible .sg blogs. Keep.
• Noise — Google-country blasts, scrapers, language clones of one post. Ignore.
• Review — these could be cheap PBNs, hacked-out links, unusual anchor text. Open one up to review.
• Disavow — confirmed spam + money anchor that cannot be removed from said site.

The toxic mix of so-called “SEO tools” here includes free checker clones (Ahrefs, Semrush), “directory listings,” “toolbar junk” etc. that are known to inflate referring-domain counts. Rarely will they increase rankings, however. All brand and naked-URL anchors here are safe as are the usual suspects. The only anchor type of interest is the commercial phrase.

A small amount of homework for you to differentiate between Safe and Noise in large data sets.

Link spam policies such as Google’s continue to focus on the manipulative schemes and within an export, the ugly red cells are often unfairly painted as negative SEO by an SG agency.

The file that made things worse

A disavow file is you asking Google to ignore certain links. Suggestion. Not a switch. Google’s own note on the tool still starts with clean up what you can first.

10 Jul 2026. File on the desk: 1,957 domains and 60 URLs.

• 470 matched nothing in Ahrefs, GSC or Semrush — ghosts.
• 11 were platform-wide (blogspot.com, wordpress.com, amazonaws.com) — that can wipe harmless blogs on shared infrastructure.
• 7 were edu or gov. Almost never.

Over-broad. Not under-inclusive. Cleaning mattered more than adding.

Agency hands you a thousand lines without matching your export? Make them reconcile. “Toxic above X” isn’t a method.

Sixty seconds on one row

Open the page.

Would anyone read that, or would it be a doorway? Is the branding naked, or would the client wince at seeing that displayed next to their company name? Are there 50+ near-identical hosts for this same week’s text?

A doorway + money + blast gets you a review which you disavow if it doesn’t get removed. A real pub next to a branded logo is safe to link to regardless of the tool’s screams. Pages on Google hosts, or language clones of each other, are noise.

This is actually easier to understand than “disavow everything under DR 20”. DR is popularity — how strong the linking domain looks — not proof anyone earned the link.

The row that usually deserves action

The row that normally triggers action — the commercial anchor on a thin page hosted on a weak host (such as a guest post with a money phrase as the visible text, like “H2 economics tuition Singapore” or “Best SEO agency”).

Note that commercial anchor text (different from a brand mention or simple URL) is what most spam systems are looking for on thin pages.

On the merged audit output, one guest post with a money anchor needed a removal request — and a very tight disavow if they refused. The rest classified as labelling only.

Two panic emails that weren’t negative SEO

Tuition centre links: Google-country style hosts form a wall of noise. All the Review links fit on one screen. No money anchors on the doorway domains. Disavow left alone as no problem found, and noted in the monthly report for reference.

Enrichment centre — a series of multilingual copies of 2 blog posts. Collapsing to root domains quickly made a very manageable list. They’d been quoted a huge “cleanup” fee for this. We simply provided a spreadsheet with our comments on each.

We’re past the first-meeting stage of buying panic link-cleaning in SG. We classify links for you.

Still buying links the old way? Compare a cleaner AI backlinks strategy to another PDF. The Singapore SERP is competitive enough without inventing enemies.

What an actual attack would look like

A handful of recently launched hosts, using similar templates, posting repetitive content with exact-match commercial anchors at the money pages. Not Google pages. Not Google-country subdomains. Twenty or so language folders of essentially one article do not constitute an attack.

Google discounts most obvious junk, but in some cases it may take Manual Actions. Those cases are actually quite rare — and a reckless disavow file can make things worse, so be careful what you upload.

Is a core update happening around the same time as your rankings sliding? Has a GBP category gone missing, or was a page accidentally set to noindex? Has the site recently migrated? In a crowded SERP such as Singapore, multi-branch businesses can blame “toxic links” for Map Pack swings, but more often than not it’s a basic configuration mistake.

Three tools, three stories

Ahrefs, Semrush, GSC. They don’t agree. They won’t.

I don’t need to guess anymore as to why flags get raised. We don’t run in panic mode anymore. I can cross-reference a flagged page against the raw export and decide within seconds whether I care or not. And yes, it’s slower than an auto-disavow plugin — but so much better than nuking a partner link that got misplaced in a spreadsheet called “75”.

Their reporting system would only show a traffic-light screenshot and upsell to a retainer. The data is there to download as a CSV. As I said earlier, export it and bring it to our call.

One question

Show me the rows you’d disavow against the same rows found in your Ahrefs/GSC exports — and which would fail the money-anchor test.

The traffic-light screenshot of your link profile is a nice product to sell. Not an emergency to deal with.

Most of the Singapore SME profiles we log into are noisy rather than under attack. Sort the export and keep your Disavow list small. Spend your time earning quality links rather than frantically adding more to an already long list of poor-quality links. Instead, address the root causes of any issues affecting your traffic chart.

And remember — in a market where Google still dominates some 9 out of 10 searches, we’ll keep our advice grounded. Contact us for a proper evaluation of your spreadsheet before you file with Google.