Black Hat Link Building (What to Avoid)

You need to recognize black hat tactics so you can avoid buying them, avoid building them by accident, and audit competitors who use them. Each technique below works briefly and then triggers a manual action, an algorithmic demotion, or — in the worst case — a sitewide deindex that takes 8-14 months to recover from if recovery is possible at all.

TL;DR

• Every tactic in this module breaks Google’s Spam Policies (developers.google.com/search/docs/essentials/spam-policies). Penalties range from anchor-level dampening to full site removal. SpamBrain catches most schemes within 60-180 days.
• The economics are upside-down. A $30,000 PBN that runs for 9 months produces less revenue than a $30,000 digital PR campaign that runs for 36 months — and the PR campaign survives core updates.
• You will encounter these as a buyer. Most “DR 70 guest post” and “high-authority backlink package” services are these schemes wearing better marketing copy. Recognize the patterns before you spend.

The mental model

Black hat link building is counterfeit currency. Each scheme tries to pass off manufactured signals as the real thing. Google’s job is to detect the fakes and devalue them. They do that with three layers:

The algorithmic layer is SpamBrain, a deep-learning classifier launched in 2018 and refined through 2024-2026 updates. It sees the entire link graph and identifies footprints — IP overlap, WHOIS overlap, template overlap, link-pattern overlap. It runs continuously, not just during named updates.

The manual layer is the Search Quality Rater team, which spot-checks suspect sites. Human reviewers issue manual actions visible in Google Search Console.

The systemic layer is the Helpful Content signal that now feeds core ranking. It looks at whole-site behavior — unnatural link profile, thin content, low engagement — and applies a sitewide multiplier. This is why a single PBN-fed page can drag down completely innocent pages on the same domain.

Deep dive: the 2026 reality

Private Blog Networks (PBNs)

A network of 20-200 owned domains, often built on expired domains with leftover backlink equity, that exist solely to link to a money site. The owner controls every site so anchor text and timing can be tuned.

Footprints SpamBrain looks for:

• Same registrar across many domains
• WHOIS information matching or rotated through the same proxy
• Hosting on the same C-class IP block or a small set of providers
• WordPress + same theme + same plugin set
• Same Google Analytics or Search Console verification meta tags
• Outbound link patterns concentrating on a small set of money domains
• Identical or templated content across blog posts
• Sudden equity flow to one or two targets

Why it fails: SpamBrain’s graph analysis catches networks within 60-180 days. The penalty is not just on the PBN domains — Google removes the equity flow and often issues a manual action against the receiving site.

Link wheels

A circular topology where Site A links to B, B to C, C to D, D back to A — sometimes through an intermediate “hub” page. The structure was designed to evade simple reciprocal-link detection circa 2010.

Why it fails: SpamBrain treats the closed cluster as a single signal source and discounts it. Detection is trivial via graph clustering algorithms.

Comment and forum spam

Posting links in blog comments, forum threads, profile fields, or guestbooks with commercial anchor text. Often automated via XRumer, GSA SER, or Scrapebox.

Why it fails: Most CMS-generated comment links carry rel="ugc" or rel="nofollow" and are largely ignored. The volume itself is a footprint — sites with thousands of low-quality forum links signal “automated tool was here”. Manual actions for “unnatural links to your site” frequently cite this pattern.

Undisclosed paid links

Buying links without rel="sponsored" disclosure. Includes paid guest posts where money changes hands without the placement being marked, “advertorial” placements without disclosure, and broker-mediated text-link buys.

Why it fails: Google’s spam policies explicitly require disclosure on any paid link. SpamBrain detects placement patterns (text-link networks, broker fingerprints). Manual actions follow. Both the buyer and seller can be penalized — sites caught selling links lose the ability to pass equity at all.

Reciprocal link schemes

“You link to me, I link to you” arrangements at scale. The pattern is detectable with a simple intersection query on the backlink graph.

Why it fails: Google publicly identified excessive reciprocal linking as a spam pattern as far back as the 2012 Penguin update. The signal is still flagged in 2026 — high reciprocal density (above ~30% of your link profile) gets sitewide dampening.

Expired-domain abuse

Buying an expired domain with strong backlink equity, then redirecting it to a money site or rebuilding it as a thin satellite. Variations include 301-stacking (chained redirects to launder equity) and category-shift abuse (a expired pet supply domain redirected to an unrelated finance site).

Why it fails: Google explicitly added “expired domain abuse” as a spam policy in March 2024. The penalty resets the domain’s equity to zero and often produces a manual action.

Web 2.0 spam

Mass-creating accounts on free-blog platforms (Blogger, WordPress.com, Tumblr, Medium, Wix) and publishing thin content with backlinks.

Why it fails: Subdomains on these platforms have near-zero individual authority. The signal is dilution, not amplification. Most platforms also strip outbound links algorithmically — Medium, for example, has nofollowed external links since 2018.

Tiered link building

Stacking layers — Tier 1 links to your site, Tier 2 spam-builds to Tier 1, Tier 3 mass-spam to Tier 2 — to “power up” the top tier without contaminating it directly.

Why it fails: SpamBrain follows the graph. Tier 2 contamination flows up. The strategy was already failing by 2018 and is more visible now.

Negative SEO via link spam against competitors

Pointing low-quality links at a competitor to trigger their penalty. Covered defensively in Module 51.

Why it (mostly) fails: Google has stated since 2014 that they discount obviously toxic incoming links rather than penalize the target. In practice, sites with thin profiles or recent algorithmic instability can still be hurt. Defensive monitoring is real work.

Buying expired Web 2.0 accounts and parasite hosting

Renting subpages on high-authority domains (rare cases of compromised .gov subdomains, abandoned university pages) to publish commercial content. Worked briefly in 2022-2023.

Why it fails: Google issued the March 2024 site reputation abuse policy specifically targeting parasite hosting. Sites caught hosting third-party low-quality content (think coupon pages on news sites) lose ranking for those subdirectories sitewide.

Penalty timelines and recovery

Tactic	Time to penalty	Recovery time	Recovery rate
PBN	60-180 days	8-14 months if remediated	40-60%
Comment spam	Immediate (devalued)	3-6 months after disavow	70%+
Paid links undisclosed	30-90 days	6-12 months	50-70%
Reciprocal at scale	Algorithmic, gradual	3-6 months	60-80%
Expired domain abuse	60-120 days	12-24 months	20-40%
Web 2.0 spam	Algorithmic, gradual	3-6 months	60-80%
Site reputation abuse	30-60 days from policy date	6-12 months	Mixed

Visualizing it

flowchart TD
  A[Black hat tactic deployed] --> B{Detection layer}
  B --> C[SpamBrain ML graph analysis]
  B --> D[Manual review by Search Quality Raters]
  B --> E[Helpful Content sitewide signal]
  C --> F[Algorithmic demotion]
  D --> G[Manual action notice in GSC]
  E --> H[Sitewide multiplier]
  F --> I[Traffic loss 30-90%]
  G --> I
  H --> I
  I --> J[Disavow + remove + 8 to 24 month recovery]
  J --> K[Often partial recovery only]

Bad vs. expert

The bad approach

An affiliate site owner spends $25,000 on a 30-domain PBN. The build pattern:

Step 1: Buy 30 expired domains via SpamZilla, all niche-relevant
Step 2: Host across 6 different providers, 1 IP per provider
Step 3: Install WordPress with 5 different themes
Step 4: Publish 8-12 articles per domain over 60 days
Step 5: Drip 1-2 outbound links per domain to money site

Footprints anyway:

• All 30 domains use the same DNS provider (Cloudflare with same nameserver pattern)
• All purchased on the same SpamZilla tier with similar drop dates
• All Wordpress installs use the same Yoast plugin version pulled from the same install package
• Outbound link templates use 6 anchor variations, all pointing at the same 4 money pages

By month 5, organic traffic is up 180%. By month 9, SpamBrain pattern-detects the cluster and the money site loses 71% of its rankings overnight. Recovery attempt: disavow all 30 PBN domains. Manual action notice in GSC: “Unnatural links to your site.” Recovery 14 months in: 35% of original traffic. The PBN domains themselves are deindexed.

This fails because SpamBrain treats the cluster as a single graph, not 30 individual domains. The cost-per-link looked attractive in month 1 and catastrophic by month 12.

The expert approach

Same $25,000 budget. Spent on a digital PR play instead:

Q1: $8K commission an industry survey from Pollfish (n=1,500)
Q1: $4K design + microsite for the report
Q2: $9K dedicated PR outreach via Pitchbox + Featured.com
Q3-Q4: $4K refresh + amplification

Outcomes after 12 months:

Metric	PBN	Digital PR
Referring domains gained	30 (all toxic)	84 (DR average 52)
Organic traffic month 12	-71%	+43%
Risk of penalty	High	Low
Survives core updates	No	Yes
Continued traffic year 2	Disavowed	Compounds

This works because every link earned is editorial, the data behind the asset has standalone value, and there is no footprint for SpamBrain to detect.

Do this today

1. Open Google Search Console > Security & Manual Actions > Manual actions. If you see “Unnatural links to your site”, read Module 51 immediately. If you do not, this section confirms you are clean today.
2. Run Ahrefs > Site Explorer > Backlinks profile. Apply the spam filter (DR < 5 + Trust Flow < 5 + niche mismatch). Anything above 5% of your profile is investigation territory.
3. Audit your own outbound links. Search your CMS for any rel="dofollow" paid placement that lacks sponsored or nofollow. Update them — selling penalty-bait undisclosed links costs you the ability to pass equity.
4. If you have hired any “link building agency” in the last 12 months, get a full list of every URL they placed. Cross-reference with Ahrefs to verify the link is live, in-content, and on a legitimate site. Investigate any DR < 20, multi-niche, or template-thin placements.
5. Check your competitors’ link profiles in Ahrefs. Patterns to flag: 200+ referring domains acquired in a single month, 80%+ exact-match anchor text, footprint of identical IP class. These signals tell you whether their ranking is durable or about to collapse.
6. Search for any expired-domain redirects in your portfolio. Use Wayback Machine to check what each domain was previously about. Topical mismatch + redirect to your money site equals expired-domain abuse — remove the redirect.
7. If you operate multiple sites, audit cross-linking density. Reciprocal density above 30% is a footprint. Use canonicals or remove the cross-links.
8. Read Google’s Spam Policies page (developers.google.com/search/docs/essentials/spam-policies) end to end once a quarter. The list grows. The March 2024 additions (expired-domain abuse, site reputation abuse, scaled content abuse) are the most-violated current additions.
9. If a vendor offers “guaranteed DR 50+ links at $200 each”, that is the pricing of a network footprint. Walk away.
10. Document your link policy in writing and share with any agency or freelancer who works on your site. Tactics that violate policy are out-of-scope, no exceptions.