When a Link Profile Tips Over

Between August 6 and 11, 2011, five people died in England. Over 200 were injured, more than 3,000 people were arrested, and around 2,800 homes and businesses were attacked. This is not material for a light-hearted marketing image.

Still, it is worth looking at, for a precise reason: the riots are one of the best-documented cases of an escalation cascade, a local trigger, an amplifier layer, a copycat wave, an institutional overreaction, and a cleanup phase. This structure repeats itself in systems that have nothing to do with each other. A link profile that shoots up from around 30 to nearly 500 referring domains within four months follows the same curve.

The trigger is never the cause

On August 4, 2011, a police officer in Tottenham shot and killed 29-year-old Mark Duggan. Two days later, an initially peaceful protest march headed to the police station. What followed is still attributed to this one incident to this day.

The LSE study Reading the Riots came to a different conclusion: the key factors were opportunity, a perceived sense of social injustice, disadvantage, and frustration with local policing. The shooting was the spark, not the fuel. On top of that came a piece of misinformation: the claim that Duggan had fired first persisted for days, until the investigating body admitted it may have misled journalists.

Speed is the real innovation

What set 2011 apart from earlier unrest was not the violence but the pace. BlackBerry Messenger and social networks compressed the time between impulse and mobilization to minutes. From Saturday evening in Tottenham to Monday evening, almost two dozen London boroughs were affected; from Monday onward, Birmingham, Manchester, Nottingham, Liverpool, and Bristol followed.

That exact acceleration has occurred in link spam. The following timeline comes from a real Ahrefs profile, as of August 14, 2026. The domain remains anonymous; that has no bearing on the structure of the pattern.

For five months, nothing happens. The curve sits flat at around 30 domains, the base built up over years. In early May, growth kicks in, and between May 10 and May 20 it jumps almost vertically: around 100 new domains in ten days. What follows is not a decline but a second, steadier growth phase that continues today.

The detailed export confirms the composition: Ahrefs flags 93 percent of the referrals as spam, 73 percent come from just two TLDs (.shop and .store), both endings that can be registered in bulk for cents. 14 domains in the entire profile are genuine trade publications; all of them date from 2018 to 2025.

This is not an organically grown structure. This is a script. And it keeps running while this article is being written.

Those affected are rarely those involved

After the riots, the Financial Times counted around 48,000 local businesses with financial losses. A distribution center in Enfield burned down and took out the warehouse of an independent music distributor in one blow. The insurance industry expected payouts exceeding £200 million.

None of these businesses had anything to do with the trigger.

A disavow applies per property. It does not automatically travel along with a redirect. Anyone redirecting has to carry the entries over into the target's disavow, otherwise the risk has been moved, not removed.

The reaction that solves nothing

During the riots, there was public debate over water cannons and rubber bullets. The Home Secretary rejected water cannons; police leadership had refused their use on the British mainland for years. Courts held special sessions, judicial officials advised harsh sentences, at times departing from existing guidelines. One woman received five months for accepting a pair of stolen shorts, a sentence later reduced on appeal.

Empirically, the hard-line approach reduced riot-related offenses while other offenses increased. The visible reaction was not the same as the effective one.

Second point: 87 percent of the spam referrals are nofollow. Google has treated nofollow as a hint rather than a directive since 2019, but the share significantly shifts the risk assessment. The number that matters here is 66 follow links, not 493. Anyone reading the tool's headline figure as the risk figure overestimates the case by a factor of seven.

What actually worked: documentation

The most effective part of the aftermath was unspectacular. The Metropolitan Police set up Operation Withern, deployed 450 investigators, and published image material. Notably, reports indicate that material from private individuals contributed more to identification than the city's camera system. Many of those involved had not covered their faces and posted photos themselves.

The effort is not in detecting it. It is in the discipline to do it regularly.

Why a single tool is not enough

The finding from the sample profile has a blind spot we should disclose: it comes from a single source. Every provider crawls a different segment of the web, and none of them sees everything. With small profiles, this barely registers. With large ones, it becomes an assessment error.

An example from an ongoing engagement, aggregated across five data sources:

The source distribution of the first 500 links checked shows why aggregation is necessary: 404 links came via DataForSEO, 269 via Semrush, 259 via Ahrefs, 58 via LinkResearchTools, 56 via Sistrix. The total is well above 500 because the sources overlap, but only partially. Anyone working with a single provider is working with a fragment of unknown size.

Three properties make the difference between a list and a managed process:

• State instead of a snapshot. The "already disavowed" class is not a statistic but a memory. Without it, you do not know your baseline and re-write the same 8,358 entries on every run.
• Whitelist as a protective layer. 936 manually approved links are locked against any automation. That is the answer to the problem from the previous chapter: editorial links that a classifier misfiles are gone for good, so they must be explicitly protected before the classifier runs.
• AI-assisted classification with a reasoned score. Every link gets a score and a named primary reason. A classification you cannot explain is worthless in a dispute, whether with the client or with Google.

This way of working is part of our documented methodology and standards. We apply it within our Link Forensics service.

The cleanup phase

After the riots, tens of thousands of people organized cleanup efforts via social networks; the groups became known as "riot wombles," a term the Prime Minister picked up in his speech on August 15. Dozens of volunteers showed up at Clapham Junction with brooms.

What stands out is the order of events. The cleanup did not happen after the causes were clarified, that debate continues to this day. The cleanup happened so the streets were usable again. One is the precondition for the other, not its result.

In SEO practice, this phase is routinely skipped because it doesn't look impressive. A cleaned-up profile does not rank better right away. It stops being a risk, and that is a state, not an event. That is exactly why the cleanup phase needs a strict order, otherwise it does more damage than the spam.

The order we follow

1. Protect first, then evaluate. The whitelist is set before the first classification run, not after. Anyone who evaluates first and corrects afterward has, in doubt, already lost the editorial links.
2. Take stock, don't start over. An existing disavow is imported and maintained as a state. Anything else produces the same work and the same errors on every run.
3. Aggregate across sources. A single provider delivers a fragment of unknown size. Combining sources is not a nicety, it is the precondition for a reliable toxicity rate.
4. Decide at domain level, justify at link level. The domain gets blocked, the individual case gets documented. Only this way does the decision remain auditable afterward.
5. Follow up incrementally. Every subsequent run delivers a delta. You work the delta, not the entire dataset.
6. Carry disavow entries over on redirects. The old domain's disavow keeps applying there, not at the 301's target.

What this order achieves is unspectacular, and exactly for that reason effective: it makes the cleanup repeatable. A cleanup that was never documented has to be started from scratch next time, and on the second pass, the reasoning for why a particular domain was excluded back then is usually gone.

How we generally define review steps, evidence requirements, and documentation is described in our Methodology & Standards.

Where the analogy breaks

Three places where the model does not hold, and this matters, because an image stretched too far produces false conclusions:

First, the motivation. In the riots, social causes, anger, and opportunity became effective at the same time. Link spam has exactly one motive: commercial exploitation. There is no causal inquiry here that leads to a policy recommendation.

Second, the scale of harm. Five deaths are not a ranking position. Any sentence that levels the two is written wrong.

Third, reversibility. A link profile can be fully cleaned up. Destroyed livelihoods and lost lives cannot be. The model is fit for describing cascades, not for weighing their consequences.

What follows from this

1. Monthly backlink delta instead of an annual audit. With more than 100 new spam domains in ten days, an annual cadence is ineffective.
2. Aggregate across multiple sources. A single provider shows a fragment of unknown size. Only combining sources yields a reliable toxicity rate.
3. Whitelist before classification. Editorial links are irreplaceable. They are protected before any automation runs over the profile.
4. Maintain the disavow as a state, not rewrite it as a file. Only this way can you follow up incrementally instead of starting over on every suspicion.
5. Export the profile before any domain redirect. Anyone who connects an old domain without knowing its link profile is deciding blind.
6. Carry disavow entries into the target property on redirects. They do not travel along automatically.
7. Check follow status before assessing risk. The number in the tool's header is not the risk figure.

Frequently Asked Questions