How to Detect Link Farms, PBNs and Manipulative Link Networks

Most backlink audits stop at the dashboard. A tool returns a toxicity score, a few domains get disavowed, and the audit is called done. That misses the point. Link farms, PBNs, and manipulative networks are not individual bad domains. They are coordinated systems, and the only way to find them is to look at the correlations between sites that are pretending to be strangers.

Google has been explicit about what it is looking for. Its spam policies define link spam as creating links primarily to manipulate rankings, and the 2022 Link Spam Update used SpamBrain to detect both sites buying links and sites used to pass outgoing links. If your backlink profile sits inside a network, you are not just at risk from the sellers getting caught. You are at risk from being classified as a buyer.

This is a forensic detection playbook. Not whether to use PBNs. How to find them in a profile you inherited, bought, or built across three agencies.

Start With the Backlink Export, Not the Score

Toxicity scores are compressions. They hide the signals you actually want to see. Pull the full referring-domains export from Ahrefs, Semrush, or Majestic, then merge it against Google Search Console's link report. The gap matters: domains that show up in third-party crawlers but never surface in GSC are often index-suppressed sites Google has already judged, which is a tell about where they came from.

Keep every raw field: referring page URL, first-seen date, anchor text, dofollow/nofollow, link type (text, image, redirect, form), target URL on your site, and the referring domain's organic traffic estimate. The forensic work is pattern matching across those columns, not reading them one row at a time. If a block of 60 referring domains all share a first-seen week, point at the same three money pages, and use three repeating anchors, you have found a cluster before you have run a single WHOIS lookup.

Cross-check against your own acquisition log. Any link your team or vendors did not actively build is a candidate for scrutiny, especially from low-traffic domains. Unsolicited high-authority mentions are usually PR. Unsolicited mid-authority mentions with commercial anchors almost never are.

WHOIS, DNS and Hosting ASN Overlap

Shared infrastructure is where networks fall apart. A natural backlink profile points at hundreds of unrelated hosts across dozens of autonomous systems. A network, by definition, cannot. Resolve each suspicious referring domain to its IP, then look up the owning ASN and nameserver pair. You are not looking for one match. You are looking for correlation across signals that would be innocent in isolation.

The pattern to flag: ten "unrelated" referring domains that share a nameserver pair, sit inside one hosting provider's address space, use the same registrar, and show WHOIS creation dates within a 90-day window. Any one of those is noise. All four together is a network. Operators have known for years that expired domain abuse is a named spam policy, so bulk-registered domains now hide behind privacy services and rotate registrars. The DNS and ASN layer is harder to disguise.

Run the same checks for sites that look clean. False positives are expensive, and shared hosts like large managed WordPress providers will show legitimate overlap. The signal is the combination of shared infrastructure plus the behavioral markers in the next three sections.

Template Reuse and Content Fingerprints

Networks are built at scale, which means they are built from templates. Open five suspected sites in separate tabs and compare their HTML, not their design. Look for identical theme slugs in the stylesheet paths, the same plugin set in page source comments, the same Google Analytics or Tag Manager container ID across supposedly unrelated properties, and identical contact-form endpoints. SearchOS lists identical templates and bulk-purchased expired domains as among the most common PBN footprints for exactly this reason.

Content fingerprints are stronger than visual ones. Pull three paragraphs of body copy from each site and search Google in quotes. Repeated phrasing across "independent" blogs is a template. Author bios that reuse a stock photo across domains are a template. "About" pages written in the same voice with the same section ordering are a template. The sites rarely bother to vary structure because the operator is one person managing fifty properties.

AI-generated bulk content complicates this. The March 2024 spam update introduced scaled content abuse as a dedicated policy, and the networks that survived it generate posts individually with varied prompts. The fingerprints are now less in the prose and more in the publishing cadence: a site that posted three times a week for six months, then nothing, then a burst of twenty posts in a weekend, is operating on a schedule.

Anchor Entropy and the Outbound Link Graph

A natural backlink profile is anchor-heavy on branded phrases and the site's own URL. Rough industry benchmarks put branded anchors in the 35 to 45 percent range and exact-match commercial anchors at under 10 percent. Networks invert that. When ten referring domains all point at your /services/ page with the exact phrase "best commercial roofing contractor," the anchor entropy is low enough that SpamBrain does not need to understand the content to classify the pattern.

Flip the analysis around and look at the outbound link graph of each suspicious referring site. A legitimate blog links to news sources, Wikipedia, suppliers, and competitors in the course of writing. A PBN link page points at a tight cluster of commercial money sites with no editorial logic connecting them. Rank the outbound targets of each suspect by frequency. If the top five destinations are five unrelated SMBs in five unrelated industries, each with a commercial anchor, you are looking at a link seller's inventory.

Google's own documentation treats excessive link exchanges and partner pages built for cross-linking as link spam, and the outbound graph is how reciprocal arrangements show up. Site A links to B, C, and D. B links to A, C, and D. The triangle is visible once the data is in a graph tool.

Velocity, Topical Drift and the Expired Domain Tell

Timeline analysis separates organic growth from a campaign. Plot referring domains by first-seen date. Natural growth is lumpy but roughly continuous. Networks arrive in waves: a hundred new referring domains in a month, then flat. When the 2012 Penguin update targeted link schemes, velocity spikes were the first thing manual reviewers were trained to look for, and the heuristic has only sharpened since.

Expired domain abuse leaves a specific trace. Pull the Wayback Machine for any suspect referring site and look at what it used to be. A domain that spent 2014 to 2021 as a dentist's office in Ohio and now publishes marketing advice is not a reborn blog. It is reclaimed authority. The 2022 webspam report noted that SpamBrain detected 50 times more link spam sites than the previous update, and expired-domain reuse was a major part of that haul.

Topical drift is the related signal. Legitimate publications stay in their lane. Networks drift because the operator is monetizing whatever client is willing to pay. A finance blog that suddenly runs a casino post, then a cosmetic surgery post, then a crypto post is not expanding its editorial scope. For a longer treatment of why these shortcuts eventually catch up to the buyer, our breakdown of how to spot a link scheme covers the escape path.

Build the Cluster Map Before You Disavow

The last step is composition. Everything above produces lists. The audit's value comes from stacking those lists into clusters where the same group of referring domains appears across the shared-ASN list, the template-reuse list, the low-entropy anchor list, and the velocity-spike list. Four overlapping signals on the same twenty domains is a network. One signal on twenty different domains is noise.

Only then do you make the disavow decision. Disavow files are blunt instruments, and uploading a sloppy one can suppress legitimate equity. For links your team actively placed inside identified networks, removal requests come first. For links you did not place, document the cluster evidence, submit the disavow at the domain level rather than the URL level, and keep the file under version control so the next audit builds on this one rather than restarting.

Treat this as a quarterly discipline, not a cleanup event. The reason to detect networks forensically is not to pass a tool's audit. It is to see what Google already sees, before an algorithm update or a competitor's complaint forces the conversation. Our view on risky tactics that kill rankings and our guide to anchor text best practices both reinforce the same conclusion: a link profile you cannot explain, cluster by cluster, is a link profile you do not control. The teams that run clean are the ones who audit like investigators, not like dashboard users.