August 12, 2026 · 6 min read
In January 2026, our organic keyword count on Ahrefs dropped to zero, and it stayed there while our website itself stayed exactly as healthy as ever — 100% technical Site Audit score, clean meta tags, working schema markup, correct sitemap. Nothing we had built was broken. Something outside of it was dragging us down, and we decided to document the whole process of finding it, fixing it, and recovering from it, in case it's useful to another local business going through the same thing.
The Symptom: A Technically Perfect Site With Zero Rankings
The confusing part of this kind of problem is that nothing about the site looks wrong. Site Audit tools come back clean. Page speed is fine. There's no manual action or security warning sitting in Google Search Console. And yet organic traffic and keyword rankings sit at zero, because the thing that broke wasn't the site — it was the site's domain authority, poisoned from the outside by links we never asked for.
What We Found: A Mass Spam Campaign, Not a Targeted Attack
Pulling the referring domains report in Ahrefs turned up hundreds of low-quality domains, most with “seoexpress,” “outrank-hq,” or “link-baron” somewhere in the domain name, all pointing back at our site in the same pattern. A quick search confirmed “SEOExpress” is a known spam/extortion scheme (documented in Trustpilot reviews from other site owners): it mass-dumps backlinks from throwaway PBN domains onto thousands of random websites as self-promotion, then sometimes follows up offering to “remove” the links for a fee. It's not something anyone hires — it's something that sweeps across the web indiscriminately.
We confirmed this wasn't personal by checking our only client's site at the time. It had the exact same signature: DR 0, hundreds of referring domains, zero organic keywords, and largely the same list of spam domains. Two unrelated sites hit with the identical pattern is a strong signal it's a mass campaign sweeping random domains, not something targeted at either business specifically.
What We Did About It
- Verified the domain itself wasn't compromised. We checked WHOIS/RDAP records for unauthorized DNS or ownership changes. None — the spam was external, not a breach.
- Made sure Google Search Console was set up correctly. We found an old property registered under the wrong protocol, which meant Google was tracking essentially nothing. Adding the correct property got our real indexing and performance data flowing again.
- Built and submitted a disavow file. We exported every domain Ahrefs flagged as spam, formatted it the way Google's Disavow Links tool requires, and submitted it through Search Console — 335 domains on the first submission.
- Kept reexporting, because the campaign didn't stop. New spam domains kept appearing on the same day we submitted the first batch. We resubmit periodically as new domains show up rather than treating disavow as a one-time fix.
- Audited our Google Business Profile to rule out a second front — confirmed verified, correctly categorized, no duplicate listings, and consistent NAP (name/address/phone) with the site.
A Detail That Trips People Up
After submitting a disavow file, the spam links don't disappear from your Ahrefs (or similar) backlink report — they're still “live” on the spam pages themselves, so the tool keeps showing them. Disavowing only tells Google to ignore those links when it evaluates your site; it doesn't and can't reach out and delete pages you don't control. Seeing the links still listed after disavowing isn't a sign the process failed — it's expected.
Rebuilding With Backlinks That Actually Count
Disavowing bad links stops the bleeding; it doesn't rebuild authority on its own. Alongside the disavow work, we've been establishing real, verifiable citations — Yelp, BBB, Apple Business Connect — with consistent NAP details across every listing, since inconsistent business info across directories dilutes the trust signal these citations are supposed to send. It's slower and less dramatic than a backlink spam dump, but it's the kind of authority that doesn't evaporate the moment a disavow file goes stale.
If This Is Happening to You
- Check your referring domains report for a spike in low-quality domains, especially ones with generic “SEO/rank/link” branding in the domain name.
- Confirm it's not a compromised domain first (WHOIS/DNS changes) before assuming it's external spam.
- If you get an email offering to remove spam backlinks for a payment, that's the extortion half of the scheme — don't pay it. A disavow file handles the SEO side for free.
- Don't panic if disavowed links still show up in your backlink tool — that's normal, not a failed submission.
- Treat it as a one-time cleanup only if the campaign actually stops. If new spam domains keep appearing, keep reexporting and resubmitting.
Getting Started
If your business is dealing with something similar — a site that's technically fine but isn't ranking, or rankings that dropped for no reason you can find — that's exactly the kind of diagnosis we do. Get in touch for a free audit, or read more about our approach to AI-managed SEO.