It seems that during May, shortly before Penguin 2.0 was launched we started experiencing negative SEO on a clients microsite. I've never had to deal with negative SEO before so i'm looking for some advice from people who understand this area well. The microsite currently uses blackhat links and spamming to rank, but it is diversified and was ranking ok. During May someone posted 30,000 blog comments to the same blog using the exact match main keyword. The logical first step to take would be to add this domain to the disavow tool, but i'm unsure if this is a good idea when the site is already using spamming linkbuilding techniques. If you add URLs to the disavow, does it trigger a manual review? Do you guys have any other ideas? I will also begin linkbuilding to diversify the new links.