A documented negative SEO attack grew from 1,956 to 5,058 spam entries, yet rankings held. The headline link count doesn't add up, and here's why that matters.
When a software company called HomeDock opened its Search Console in January 2026, its backlink profile was filling up with links it hadn't earned. By the time the team finished sorting them, they had counted 1,956 malicious entries pointed at the domain. In March the same post was updated: the count had reached 5,058, and the company estimated the attack had put "roughly 40,000" spam backlinks on its domain in under two months.
That is a frightening number, and it is the one that gets repeated. It is also the least solid figure in an otherwise well-documented case, and the more useful number is a different one: the company reports no manual action from Google and rankings that stayed stable.
What the attack looked like
HomeDock's team broke the January entries into 1,372 IP addresses (70.1%) and 584 spam domains (29.9%), with no individual URLs listed. About 70% of the traffic came from Amazon Web Services addresses spread across at least 15 regions. The domains followed patterns: strings of concatenated dictionary words, more than 100 Blogspot subdomains with random suffixes, and a network of 99 or more domains built from an SEO keyword plus a major city name, registered on cheap top-level domains such as .online, .site, .space and .website.
By March the IP side had grown from 1,372 to 4,175 and the domain side from 584 to 883. The attackers also started going after subdomains the company doesn't fully control, with roughly 12,000 spam links each reported on its status, docs and dashboard subdomains. The linking pages blocked both visitors and Googlebot at times, so a person checking a link by hand could land on a 403 or a timeout. The post describes this as deliberate, a way to make manual auditing slow.
Why the 40,000 figure needs a footnote
The post says each entry in the disavow file represents a source producing 3 to 5 toxic backlinks on average. Apply that to 5,058 entries and the range is roughly 15,000 to 25,000 links, not 40,000. The three subdomain counts of about 12,000 each would add up to around 36,000 on their own, but the post doesn't say whether those links overlap with the main-domain entries or sit on top of them.
None of this suggests the attack was small. It was clearly large and automated. But "40,000 spam backlinks" is the company's own rounded estimate, and by its own stated multiplier the arithmetic points lower. When a number like that starts circulating as a fact, the sourcing is worth checking before it ends up in a pitch deck about how dangerous negative SEO is.
The result is the real data point
HomeDock says its domain was getting close to a million organic impressions with no marketing spend when the attack began, that its legitimate profile included links from universities, newspapers and government sites, and that after the attack tripled in size it still had no manual action and no material loss in visibility. That is self-reported, and the company used the episode to promote its own free disavow tool. Read it as one documented case, not a controlled study.
It still fits what Google says about spam links generally. Google's spam update documentation explains, in its section on link spam updates, that when its systems remove the effects spammy links may have, any ranking benefit those links generated is lost. If a system is built to neutralize the value of spam links rather than penalize the site they point to, a flood of them aimed at a third party has little to work with. An earlier post on this blog covers the same logic for bad-neighborhood links.
Where the premise breaks down
The topic is often framed as AI-generated negative SEO. Nothing in HomeDock's write-up says that. The domains are described as algorithmically generated, which means templated and scripted, and the infrastructure is cloud servers spinning up and down. Automation and AI generation are different claims, and the source supports only the first.
A second limit: this is a spam-link attack, the best-known form of negative SEO. A newer risk this blog has covered is manipulating what AI systems repeat, where no confirmed public case against a named competitor turned up.
What the case suggests doing
HomeDock's own advice is more modest than its headline number. Export your backlinks on a regular schedule, review only the new entries, keep a whitelist of known-good domains, and keep dated notes on when you first saw the attack and what you submitted, in case you ever file a reconsideration request. Disavow files replace the previous upload rather than adding to it, so each new file has to include the earlier entries. The company also warns against over-disavowing, since cutting off legitimate links does more harm than the spam did.
The sensible reading is proportionate. Watch your link profile, keep records, and disavow what is clearly junk. Don't pay for protection against an attack whose damage you can't show.
