Case Study: Spotting a Link Network in the Wild

Each property has a plausible reason to exist. An SEO consultant should have a personal brand site. An agency website is standard. A content hub with a colleague is common. Running a subreddit in your niche is legitimate community involvement.

The problem isn't that these properties exist. The problem is the link graph between them. And specifically, the anonymous persona site that ranks the operator in "top experts" lists and recommends their agency in "best of" roundups, all while concealing the connection. (If you want the theory behind why these structures inflate authority, read The Anatomy of a Link Ring. This tutorial is the hands-on companion.)

The 6-step investigation methodology

Here's how you'd investigate this network if you encountered it in the wild. Each step uses free tools and takes minutes, not hours.

Let's walk through each one.

Step 1: WHOIS lookup

Start with the basics. Every domain has registration data, and even behind privacy proxies, that data leaves patterns.

Go to who.is or the ICANN WHOIS lookup and run each suspected domain. You're looking for four things.

Same registrar. If all five domains were registered through the same company (say, Namecheap or GoDaddy), that's a weak signal on its own but relevant when combined with other data points.

Same privacy proxy. Privacy protection is standard these days, but the specific proxy service matters. If every domain uses the same privacy service, like Withheld for Privacy ehf or Contact Privacy Inc., that's worth noting. Different people tend to use different registrars and privacy services. Five domains all using the same combination is a fingerprint.

Same nameservers. This is where it gets interesting. Nameservers tell you who's handling the domain's DNS. If two domains that claim to be run by different people both point to stackdns.example or the same custom nameservers, they're likely on the same hosting account. Someone managing multiple independent properties would typically have varied hosting setups. Identical nameservers suggest one control panel.

Registration date clustering. Check the creation dates. If three "independent" domains were all registered within the same month, that's a pattern. Legitimate multi-brand professionals usually build properties over years, not weeks.

In our hypothetical scenario, let's say Alex's investigation turns up this data.

Four domains. Same registrar. Same privacy proxy. Same nameservers. Two registered in the same month, the rest within a two-year window. That's not proof, but it's a strong opening signal.

Step 2: Hosting fingerprinting

Nameservers already told us a lot in Step 1, but you can dig deeper. Run each domain through a DNS lookup tool like DNSChecker.org or MXToolbox.

Check the A records (IP addresses). If multiple "independent" domains resolve to the same IP address or the same IP range (same /24 subnet), they're hosted on the same server or the same hosting account.

Check MX records (email servers). If the domains use the same email provider with similar configurations, that's another shared infrastructure signal.

Check TXT records. Domains often have verification records for Google Analytics, Search Console, or other services. If two unrelated sites share the same Google site verification code, they're verified by the same Google account.

The hosting fingerprint is one of the hardest things to fake. You can put different privacy on WHOIS data, but if you're managing all your domains from one hosting account, the nameservers and DNS records give it away. Moving each domain to a separate hosting provider is expensive and operationally complex. Most people don't bother.

Step 3: Content overlap analysis

This is where the investigation shifts from technical forensics to editorial analysis. Open each site and read the content. You're looking for three specific patterns.

Topical overlap. Do the sites cover the same subject matter? A personal blog, an agency site, and a "thought leadership" blog all covering SEO is expected if they're run by an SEO professional. But an "independent" niche blog covering the exact same subtopics in the same way, with the same opinions, using similar frameworks? That's less expected.

Cross-referencing. Does the anonymous thought leadership blog reference Alex by name? Does it include Alex in "top experts" lists? Does it recommend Alex's agency in "best agencies" roundups? If the anonymous blog consistently promotes one specific person who happens to own all the other domains, the editorial independence is cosmetic.

Reciprocal promotion. Does Alex's personal blog link to the "independent" thought leadership site? Do they share each other's content? Does the agency site recommend the content hub in its resources section while the content hub recommends the agency in its tools list?

Use Google's site: operator to speed this up. Search site:searchnerds.example "alex" to see how often the anonymous site mentions the subject. Search site:alexseo.example "searchnerds" to check for reverse references. A few mentions could be natural. Consistent, strategic placement of links and name-drops across sites the same person controls is a link scheme.

Step 4: Reciprocal link mapping

Now map the actual links. This is the core of the investigation.

Use the Ahrefs free backlink checker to pull the top backlinks for each domain. You're building a connection graph. For each site, note which of the other suspected properties link to it, and from which pages.

Then map it. You can use a whiteboard, a spreadsheet, or any diagramming tool. Draw a node for each property. Draw an arrow for each link. Label the arrows with the context ("resource page," "top experts list," "partner mention").

What you're looking for.

Closed loops. If A links to B, B links to C, and C links back to A, that's a ring. Each site appears to receive independent backlinks. None of them are independent.

Hub-and-spoke. If one domain (usually the commercial agency site) receives links from all the others but rarely links back, it's a hub receiving manufactured authority from spoke properties.

High reciprocity. In natural link profiles, most sites that link to you don't receive a link back. If every property in a cluster both gives and receives links from every other property, that's manufactured. A reciprocal ratio above 60% between linked sites is a red flag.

In Alex's case, the link map might show the agency site receiving links from all five other properties, the personal brand and the content hub linking to each other, and the anonymous persona site linking to both the agency and personal brand through "recommendation" posts. The subreddits link to everything via sidebar links and pinned posts. Almost every connection is reciprocal. That's not an organic link profile. That's a network.

Step 5: Registration timeline analysis

Timing tells a story. Go back to the WHOIS data from Step 1 and add one more data source: the Wayback Machine.

Check when each domain was first captured by the Wayback Machine. Compare that to the domain's registration date and the dates of its earliest published content. You're looking for discrepancies.

A "thought leadership" blog that positions itself as an established industry voice but was registered eighteen months ago and has no Wayback Machine captures before last year is a recently built property, not an organic presence that grew over time. If that same blog ranks Alex as a "top expert" in its first year of existence, the timeline undermines the editorial credibility.

Also check when the cross-links first appeared. If the anonymous blog didn't start linking to Alex's properties until a few months after its creation, that's consistent with a staged rollout: build the site, populate it with content, then add the strategic links once it has some authority of its own.

The Wayback Machine is particularly useful for catching content changes. If a site originally covered general marketing topics and then pivoted to heavily promoting specific people and agencies, that editorial shift is meaningful. Sites with genuine editorial independence don't suddenly reorganize their content around promoting one person.

Step 6: Social media footprint

The final step ties everything together. Check the social media accounts associated with each property.

Look at each site's social links. Who runs the Twitter/X account for the anonymous blog? Is it a faceless brand account, or can you connect it to Alex through following patterns, shared audiences, or cross-promotional activity?

Check Reddit specifically. If Alex moderates r/ExampleSearchMarketing and that subreddit's sidebar links to Alex's agency and personal site, the community platform is functioning as a link source. If Alex also created r/AlexSEOExample to curate press mentions and interviews, that second subreddit exists primarily as a reputation management tool that links back to the main properties.

Look for username patterns across platforms. People reuse usernames. An anonymous persona that uses a variation of Alex's known usernames or email addresses is a connection point.

Check if the same person appears at conferences or podcasts representing multiple properties without disclosing the relationship between them. Public appearances create records that connect identities.

What to look for at each step

Every step in this investigation produces specific signals. Here's a reference for what separates normal patterns from red flags.

What does Google's policy actually say?

Google's link spam policies are explicit about this pattern. The documentation defines link spam as links "intended to manipulate rankings in Google Search results." It specifically calls out:

• "Excessive link exchanges" between sites
• Links between sites created "with the sole purpose of cross-linking"
• "Using programs or services to create links to your site"
• Building "partner pages exclusively for the sake of cross-linking"

The relevant section for multi-property networks is the prohibition on creating interconnected sites that cross-link to each other significantly. Google doesn't require you to prove intent. The pattern itself, multiple sites controlled by the same entity systematically linking to each other, meets the definition.

The December 2022 link spam update used SpamBrain to target exactly these structures at scale. The May 2024 site reputation abuse update expanded enforcement to sites lending their authority to others. Each update makes the detection more sophisticated.

The gray area exists for legitimate professionals who genuinely operate multiple brands with real audiences. Google's systems look at the totality: is the linking pattern natural, or is it systematically designed to inflate one property's authority? A few cross-references between genuinely independent properties? Fine. A closed network where every property's primary purpose is to link to the others? That's a scheme.

Documenting your findings

If you're running this investigation for competitive analysis, a link audit, or to report a link scheme to Google, document everything systematically.

Screenshots over links. Web pages change. Take screenshots of link placements, "top experts" lists, WHOIS results, and DNS records at the time you find them. The Wayback Machine helps, but it doesn't capture everything.

Build a connection table. For each pair of domains, note: the link direction, the anchor text, the page context, and the date you found it. A spreadsheet with columns for source domain, target domain, link URL, anchor text, context, and date gives you a clean record.

Map the graph visually. Connections that seem ambiguous in a spreadsheet become obvious in a graph. Draw nodes for each property. Draw directional arrows for each link. The circular patterns and hub-and-spoke structures are immediately visible.

Note what you can't prove. WHOIS privacy means you can't always confirm the same person registered two domains. Shared nameservers suggest but don't guarantee shared ownership. Be precise about what the evidence shows and what it implies but doesn't prove.

Report path. If you find a link scheme and want to report it, Google provides a spam report form. Include your documentation. Google also accepts spam reports through Search Console. For competitive analysis, the documentation serves as evidence for your own strategic decisions.

Why this matters for your SEO

Understanding link network investigation isn't just about catching competitors. It has practical applications for your own work.

Vet potential link partners. Before pursuing a guest post or link from a site, check whether that site is part of a network. A link from a network property carries the risk of association. If Google devalues the network, links from its properties lose value or become liabilities.

Audit your own link profile. Run the Ooty SEO Analyzer against your domain and check your referring domains. Are any of them part of networks? Were any links to your site acquired through a previous agency that may have used network tactics? Finding this early lets you disavow before it becomes a problem.

Understand competitor rankings. If a competitor outranks you and their backlink profile shows a cluster of related domains all linking to them, you've found an explanation for their authority that may not survive the next link spam update. Compete on legitimate authority instead of replicating their approach.

Evaluate "industry expert" claims. If someone's reputation is built on "top experts" lists from anonymous sites they control, their expertise is manufactured. Ooty's Meta Tag Analyzer can check structural similarities between the sites making the claims and the sites being promoted. Common metadata patterns reveal common ownership.

The investigation checklist

Here's the condensed version you can work from.

1. List all suspected properties. Include websites, subreddits, social accounts, and any other web presence connected to the subject.
2. Run WHOIS on every domain. Note registrar, privacy proxy, nameservers, creation date.
3. Check DNS records. Look for shared A records, shared nameservers, shared MX records, matching TXT verification strings.
4. Read the content. Look for cross-references, "top experts" lists that include the subject, and reciprocal promotion patterns.
5. Map the links. Pull backlinks for each domain. Draw the connection graph. Calculate reciprocity ratios.
6. Check the timeline. Compare domain registration dates, Wayback Machine first captures, and content publication dates.
7. Trace social connections. Check who moderates relevant subreddits. Check who runs the social accounts. Look for cross-promotional patterns.
8. Document everything. Screenshots, connection tables, visual graphs. Be precise about evidence vs. inference.

The whole process takes about an hour for a small network. The tools are all free. The patterns, once you know what to look for, are surprisingly obvious.

What you'll find

Not every professional with multiple web properties is running a link scheme. Many SEOs legitimately operate an agency, a personal blog, and a niche project. The difference is in the linking pattern and the disclosure.

Legitimate multi-brand professionals typically disclose relationships between their properties. "This is my agency" appears on their personal blog. "Founded by [name]" appears on the agency site. The connection is transparent, and the linking pattern reflects natural cross-referencing rather than systematic authority inflation.

Link networks look different. Anonymous personas promoting the operator. "Independent" roundup posts that consistently feature the same person. Subreddits created as reputation management vehicles. Every property linking to every other property in a closed system. The effort goes into concealing the connections rather than disclosing them.

Apply this methodology to SEO figures whose authority claims seem outsized relative to their verifiable credentials. You may find the investigation is shorter than you expected.