If you monitor backlinks in SEMrush, Ahrefs, or another SEO platform, you may have noticed something unusual beginning in September 2026: backlink counts suddenly increasing at rates that do not make sense based on normal link acquisition.
I recently saw exactly that across a seven-site client portfolio.
Several websites with historically stable backlink profiles suddenly showed increases of 50%, 100%, 200%, or more. In some cases, thousands of new backlinks appeared within a matter of weeks.
At first glance, that might sound like good news.
It wasn't.
After investigating the underlying data across the entire portfolio, I found strong evidence that a substantial portion of the September 2026 backlink growth was being driven by a large-scale automated backlink-spam campaign affecting websites across multiple industries.
The investigation also provided an important lesson for SEO professionals and website owners: a sudden increase in backlinks does not necessarily mean your authority has improved, and a sudden increase in toxic backlinks does not necessarily mean you should reach for Google's Disavow Links tool.
The First Sign Something Was Wrong
I first noticed the issue while preparing September 2026 monthly SEO reports.
Backlink totals had increased dramatically across nearly every website in the client portfolio at approximately the same time.
That immediately raised a question:
Were these websites suddenly earning dramatically more links, or was something else happening?
The websites represented different brands, geographic markets, and areas of business. There was no marketing, PR, or content campaign that could reasonably explain simultaneous backlink growth across all of them.
I was also seeing unusually large backlink increases across many unrelated SEO projects outside this particular portfolio.
That made a site-specific explanation even less likely.
Rather than treating the increases as an SEO success, I began investigating the underlying referring domains.
How I Investigated the September Backlink Surge
I analyzed two different SEMrush datasets for each website:
Backlink Analytics referring-domain data
SEMrush Backlink Audit data
For each site, I examined:
Referring domains
First-seen dates
Authority Scores
Toxic Scores
Top-level domains
Source URLs
Source-page titles
Anchor text
Target URLs
Follow versus nofollow status
I then compared the referring domains across all seven websites.
That cross-site comparison turned out to be one of the most important parts of the investigation.
Every established website eventually accumulates strange or low-quality backlinks. A handful of junk links is not remarkable.
But when hundreds of the exact same domains begin linking to several unrelated websites within a few days of one another, the likelihood that those links were acquired naturally becomes extremely small.
What the Data Revealed
Across the seven websites, the referring-domain exports contained nearly 11,000 site/domain observations.
Approximately 85% had first appeared since September 1, 2026.
The quality of those newly discovered domains was remarkably poor.
Approximately 97% of the recent domains had a SEMrush Authority Score of 2 or lower.
Thousands appeared during a very narrow September and October period.
There was also a heavy concentration of .shop and .store domains.
Many of the domain names used repetitive combinations of terms such as backlink, SEO, rank, authority, link, checker, search, and growth.
The naming patterns frequently resembled:
backlinkchecker...
seorank...
domainauthority...
linkbuilding...
rankchecker...
A low Authority Score does not make a domain spam.
A .shop domain does not make a domain spam.
Having the word "SEO" in a domain does not make a domain spam.
But when those characteristics appear together across thousands of recently discovered referring domains, combined with highly repetitive linking pages and synchronized timing, the pattern becomes difficult to explain as legitimate link acquisition.
The Same Domains Were Linking to Multiple Websites
The strongest evidence came from comparing the seven websites against each other.
Among the recently discovered referring domains, more than 2,800 unique domains appeared on at least two websites in the portfolio.
More than 1,800 appeared on at least three.
Hundreds appeared on four or more.
And a smaller group of exact domains appeared across all seven websites.
The first-seen dates frequently differed by only a few days.
This matters because these were separate company websites.
There was no legitimate reason for hundreds of obscure backlink, SEO, ranking, and domain-checker websites to suddenly discover multiple unrelated businesses during the same week.
The evidence strongly suggests that the sites were being swept into the same broader automated backlink-spam ecosystem.
That does not prove that every domain is controlled by one organization or individual. The data cannot establish that.
But it does demonstrate recurring campaign behavior across the portfolio.
The Linking Pages Were Clearly Mass Generated
The source pages themselves provided even stronger evidence.
Hundreds of referring domains used nearly identical URL structures, page titles, anchor-text formulas, promotional language, and SEO terminology.
One website received hundreds of links from pages built around the same directory path and a nearly identical message about improving SEO authority and Google rankings.
Another website received hundreds of links using a different, but equally repetitive, template.
The domains changed.
The target company changed.
But the page structures and language remained essentially the same.
Some pages openly advertised concepts such as premium backlinks, SEO authority links, high-DA links, PBN links, first-page rankings, and link-building services.
These were not natural editorial citations.
They were mass-produced linking pages.
The Timing Was Remarkably Concentrated
The dates provided another clue.
Across the portfolio, the largest bursts of newly discovered referring domains occurred during a narrow period in early October, immediately following the initial September surge.
The largest days included:
| Date | New Site/Domain Observations |
|---|---|
| October 7 | 992 |
| October 8 | 974 |
| October 9 | 955 |
| October 10 | 919 |
| October 11 | 873 |
| October 12 | 862 |
| October 13 | 790 |
The Toxic Backlink Audit data was even more concentrated.
Approximately 67% of the toxic-domain observations were first detected between October 5 and October 9.
That kind of synchronized discovery across multiple unrelated websites is difficult to reconcile with normal organic link growth.
I Also Checked Google's September 2026 Ranking Update
Because several sites were also experiencing changes in rankings and search visibility during this period, I checked Google's official Search Status Dashboard to determine whether an algorithm update might be contributing to what we were seeing.
Google was in fact rolling out a major ranking update during part of this period: the September 2026 spam update.
Google says the update began on September 24, 2026, applied globally and to all languages, and completed on October 8. Google Search Status
That timing is interesting because it overlaps closely with the period when the backlink activity accelerated.
However, there is an important distinction.
There is no evidence that Google's spam update caused these backlinks to be created.
The suspicious backlink activity was already underway before Google's September 24 rollout began. Hallam, for example, had published its investigation into the same broad pattern on August 28, nearly a month earlier. Hallam specifically reported sudden increases in .shop and .store referring domains across multiple industries and said the repetitive patterns strongly pointed toward automated link farms or PBN-style sites being created at scale. Hallam
So three things were happening in roughly the same period:
A widespread external wave of automated backlink creation.
Google's September 2026 spam update.
Normal changes in rankings, impressions, clicks, and organic traffic.
Those timelines overlap, but overlapping timing does not establish causation.
It is possible that Google's spam systems were becoming better at identifying or neutralizing some of this activity during the same period. But without evidence from Google, I would not claim that the backlink surge and Google's update were directly connected.
This Appears to Be a Broader 2026 SEO Spam Event
The activity does not appear limited to this client portfolio.
Hallam began documenting a similar phenomenon in August 2026.
Their investigation found a sudden spike in .shop and .store referring domains across multiple industries, along with highly repetitive domain names using SEO, link, and ranking terminology. They identified examples including domains such as backlinkengine.shop, rankgrowthagency.shop, rankseoprovider.shop, and seogrowthengine.shop. Hallam
I also found independent evidence from an investigation using Ahrefs rather than SEMrush.
SEO consultant Sunny Patel reported that 633 of 763 referring domains, or 83%, were flagged as spam by Ahrefs. He also identified spun content, repeated exact-match anchors, and links explicitly advertising PBN and backlink services. Sunny Patel
That is important because it makes a SEMrush-only reporting issue considerably less likely.
Different backlink databases were detecting similar activity.
Why Would Someone Create Thousands of Spam Backlinks?
We cannot know the motive with certainty.
Based on the evidence, however, I do not believe the portfolio I investigated was the victim of a specifically targeted negative SEO campaign.
The activity was simply too widespread.
The same types of domains and linking patterns were appearing across numerous unrelated websites and industries.
A more plausible explanation is commercial.
Operators may be creating enormous automated link networks to sell backlink packages, promote questionable SEO services, populate PBN-style networks, generate leads for link-building services, test automated link-generation systems, or build web properties that can later be monetized.
Some of the source pages themselves openly advertise backlink and SEO services, which strengthens that interpretation.
There may be other motives.
But when links are distributed indiscriminately across large numbers of unrelated websites, being swept into a mass automated campaign is more plausible than being specifically targeted.
Website owners should also be cautious if someone subsequently approaches them offering to sell backlinks, remove questionable links, or "repair" a backlink profile.
Should You Disavow These Links?
In most cases, probably not.
This is where website owners need to be particularly careful.
A third-party SEO platform labeling a link "toxic" does not mean Google has penalized your website because of that link.
Google says that most sites do not need to use the Disavow Links tool. Its guidance recommends considering disavowal when there is a considerable number of spammy, artificial, or low-quality links and those links have caused, or are likely to cause, a manual action. Google also warns that incorrect use of the tool can negatively affect search performance. Google Help
Hallam reached a similar conclusion regarding this particular backlink phenomenon, recommending that site owners generally monitor rather than immediately disavow because Google's spam systems are designed to devalue spam-link networks. Hallam
In the seven-site portfolio I investigated, I found no evidence of a manual action or widespread organic search deterioration corresponding with the spam-link increase.
In fact, several of the websites improved in average Google ranking position during the same period.
That does not mean the spam backlinks caused those improvements.
Correlation is not causation.
Sunny Patel's independent case study found something similar. Rankings and impressions improved during the period in which his spam backlink blast occurred, but he correctly noted that the data could not establish whether those links helped, hurt, or had no effect. Sunny Patel
The more reasonable interpretation is that the spam-link activity and legitimate SEO performance were occurring independently.
What to Do If Your Backlinks Suddenly Explode
If you see a September 2026-style spike in your own backlink profile, I would not begin with a disavow file.
Begin with an investigation.
1. Look at Referring Domains, Not Just Backlinks
One referring domain can generate hundreds or thousands of links.
Raw backlink totals can therefore become extremely misleading.
Referring domains generally provide a much better starting point.
2. Sort Referring Domains by First-Seen Date
This can quickly reveal whether apparent growth occurred gradually or arrived in a concentrated burst.
Look for clusters by day, week, and month.
3. Evaluate Domain Quality
Look for concentrations of very low Authority Scores, repetitive domain names, unusual TLD patterns, SEO-related naming, and recently discovered domains.
None of those characteristics should be treated as proof of spam individually.
Look for the collective pattern.
4. Inspect the Actual Linking Pages
This is often where automation becomes obvious.
Compare URL structures, page titles, anchor text, page copy, and linking patterns.
If dozens or hundreds of unrelated domains use essentially the same page template, that is a significant signal.
5. Compare Multiple Websites if You Manage a Portfolio
This was one of the most revealing parts of my investigation.
Finding the exact same questionable referring domains linking to several unrelated websites within a few days of one another provides much stronger evidence than analyzing any single website in isolation.
6. Check Google Search Console
Pay attention to actual search performance.
Look for manual actions, ranking declines, changes in impressions, changes in clicks, and unusual indexing behavior.
The existence of ugly backlinks alone does not prove that Google is penalizing your website.
7. Check Google's Ranking Update History
If rankings changed around the same time as your backlink profile, check Google's official Search Status Dashboard.
In this case, Google's September 2026 spam update overlapped with part of the backlink surge. Knowing that helps separate algorithm-related volatility from the external backlink activity rather than assuming that every change has one cause. Google Search Status
Raw Backlink Counts Are Becoming a Less Useful SEO KPI
There is also a broader reporting lesson here.
SEO reports have traditionally included metrics like:
Backlinks: 1,200 → 2,400
That number once provided useful context.
But when automated systems can generate thousands of meaningless backlinks across hundreds of domains in a matter of days, raw backlink volume becomes increasingly difficult to interpret.
I am placing more emphasis on metrics such as:
Quality referring domains
Google Search Console impressions
Organic clicks
Ranking trends
Organic traffic
Technical SEO health
Authority metrics
Brand visibility
AI search visibility
AI citations and mentions
The better question is no longer:
"How many backlinks did we gain?"
It is:
"Did we gain meaningful third-party signals that improve the authority, visibility, and discoverability of the brand?"
Those are very different questions.
The Bottom Line
The September 2026 backlink surge I investigated was real.
But it was not evidence that thousands of websites had suddenly decided to recommend our client's businesses.
A substantial portion of the growth was automated noise.
Across a seven-site portfolio, I found thousands of newly discovered low-authority referring domains, highly repetitive SEO and backlink-related domain names, large concentrations of .shop and .store domains, mass-generated linking pages, repeated anchor-text formulas, extremely concentrated discovery dates, and extensive reuse of the same referring domains across unrelated websites.
I also reviewed Google's ranking-update history. Google's September 2026 spam update ran from September 24 through October 8, overlapping with part of the period in which the backlink activity accelerated. But the automated backlink phenomenon clearly predates that rollout, so there is currently no basis for concluding that Google's update caused the backlink surge. Google Search Status
Taken together, the evidence strongly supports a broader automated backlink-spam phenomenon affecting websites across multiple industries.
For most website owners, the appropriate response is not panic.
And it is not automatically disavowing every questionable backlink.
The better response is to understand what changed, investigate the underlying data, monitor actual organic search performance, watch Google Search Console, and continue building legitimate authority.
Spam backlink counts may be getting noisier. Good SEO signals still matter.
About O2 SEO
O2 SEO helps businesses investigate technical SEO problems, understand changes in organic search performance, and adapt their strategies for both traditional search engines and AI-powered search.
If your backlink profile suddenly increased in September 2026 and you're unsure whether you're seeing legitimate link growth, automated spam, or something more serious, O2 SEO can analyze the underlying data and determine what actually requires action.
