Spotting an unnatural profile

Lesson 41 of 50Module 8 · Measurement, risk and recovery5 min read

By Bill Hartzer · Hartzer Consulting · 25+ years in search, domains and expert witness work

What looks alarming and is not

Most of the profiles I am asked to examine as a possible problem are simply profiles. Before anything else, here are the patterns that frighten people and mean nothing.

A majority of low-quality domains. On a twenty-year profile where no link was ever bought, 69.3% of 22,260 referring domains sit at Trust Flow 0. That is 15,421 domains with no measurable trust. This is the normal state of an established site, not evidence of anything.

Scraper and aggregator links. If you publish anything useful, it gets copied. The copies link back, often with your original anchor text. You did not cause this and you cannot stop it.

Links from countries and languages you have nothing to do with. Content travels. So do scrapers.

A sudden burst of links. A story ran, or someone added a sitewide placement. Check whether referring domains moved with the link count and you will usually find the second explanation.

Links from sites that look terrible. Ugly design and low traffic are not manipulation signals. Plenty of genuinely useful niche sites look like it is still 2006.

Adult, gambling or pharmaceutical domains appearing in the profile. Unless there is a pattern of them, arriving together, with commercial anchors, this is spam link noise that every site accumulates.

What unnatural actually looks like

Manipulation is legible not in any single signal but in the combination. What distinguishes a manipulated profile is coordination: things that should be independent turn out to be related.

• Anchor text concentrated on commercial phrases. The tell is not one exact-match anchor; it is a distribution where the money phrase outweighs the brand and the bare URL. On an unbought profile, the top anchors are brand names, domain names, article titles and phrases like click here, and the top fifteen anchors contain no commercial exact match whatsoever.
• Links concentrated on money pages. Real profiles link overwhelmingly to the homepage and to content. When the deepest commercial pages hold most of the links, somebody chose that.
• Network footprints. Shared hosting, matched registration patterns, identical templates, identical metric shapes, the same small set of sites appearing across several unrelated profiles. On one profile I examined, seven nonsense brandable domains appeared with Citation Flow consistently about 14 points above Trust Flow and near-identical metrics, and the same seven appeared in a different site's link graph at a different tier. That is not coincidence, and module 3 covers the detection method.
• Placement that does not match the page. A paragraph about your product inserted into an article on an unrelated subject, often mid-page, often in a piece years old.
• Uniform link characteristics. Every link followed, every anchor optimized, every placement in-content. Genuine profiles are messy; manufactured ones are tidy.
• Velocity plus footprint together. A burst of links with no news event behind it, from sites that share characteristics. Velocity alone means nothing; velocity with coordination means a lot.

How to run the check

A structured pass takes an afternoon and prevents most of the wrong conclusions.

1. Pull referring domains, not links. Everything below is a domain-level judgment.
2. Look at the anchor distribution first. This is the highest-signal, lowest-effort check available. Take the top thirty anchors by referring domain count and ask what share is commercial. If the answer is that brand, URL and title anchors dominate, most manipulation hypotheses die here.
3. Look at the target distribution. Homepage and content-heavy is normal; commercial-page-heavy is not.
4. Sort the domains by Trust Flow and read the top and the middle. Do not read the bottom. The bottom is scrapers, and it will teach you nothing except how to feel anxious.
5. Take a sample of 30 to 50 domains from the middle band and look at them by hand. Is there a pattern? Do they resemble each other? Do they link to the same other sites?
6. Check for network overlap. If a cluster looks related, examine what else they link to. Networks serve many clients, and the overlap is the proof.
7. Check the timeline. Did the suspicious cluster arrive together? Coordinated arrival is the strongest confirming signal there is.

Notice that a toxicity score appears nowhere in this process. It cannot: it would flag the 69.3% that are fine and miss the coordinated cluster that is not.

Calling it

Three outcomes are possible and the middle one is the most common.

Clean. Messy, full of junk, dominated by low-quality domains, and entirely normal. Anchors are brand-led, targets are homepage-led, no coordinated clusters. Say so plainly. The most valuable thing I do for many clients is tell them their profile is fine, because they arrived convinced it was not and were about to disavow half of it.

Mixed history. The site did something years ago, or an agency did, and there is a visible cluster of manufactured links alongside a much larger normal profile. This is extremely common and usually needs no action at all. Old manufactured links that are no longer counted are not a live problem, and the risk of removing real links while chasing them is higher than the risk of leaving them alone.

Live manipulation. Coordinated clusters, still arriving, with commercial anchors pointed at commercial pages. The fix here is to stop, not to disavow: end the arrangement, stop the supply. Disavow is a separate question with a much narrower answer, and it is the subject of the next lesson.

One professional habit worth adopting. Write down the evidence for your conclusion before you write the conclusion. It is very easy to look at 15,000 Trust Flow 0 domains and reason backwards to a story about toxicity, and writing the evidence first is what stops you.

Reading somebody else's profile

The same method applies when the profile is not yours, and the discipline matters more, because the conclusions get used. I do this work in litigation and in due diligence, where a claim about a link profile can affect a valuation or a case.

Two additions to the process. First, separate what you can observe from what you infer. That a set of domains share a hosting range is an observation. That they constitute a paid network is an inference, and it needs supporting evidence such as the same cluster appearing across unrelated commercial sites. Keep those in separate columns of your notes and in separate paragraphs of anything you publish.

Second, document the date and the source. Link profiles change. A finding from an index export in March does not describe the profile in September, and an opposing analyst with a later export will say so. State the index, the export date and the row counts, and attach the data.

The temptation in adversarial work is to describe a profile in the most dramatic terms the data will bear. Resist it. The analysis that survives is the one that concedes the normal parts of the profile clearly and then shows exactly why the remaining cluster is different.