Need help figuring out how a competitor is affecting my rankings

Over the last few months we have had some seriously dodgy traffic coming in from Poland, about the time it started our ranking dropped from no.1 position and we did not connect the dots immediately. After we caught on to this we wondered why? It looks to me like they are sending a large amount of traffic from a wide variety of IP addresses, via spam links, and then they must be using Google addresses and sending low-value ranking signals to Google, which is pushing us down the rankings.

Since we figure it out we blocked that traffic via CloudFlare with a 403, but doesn't seem to have made much difference, anyone know if this is what they could actually be doing and how to prevent against this kind of thing?

Would appreciate any comments or helpful ideas please

I've never done CTR manipulation but I've heard folks around the forum saying that if you don't do it right google will catch it and penalize you. I don't remember how they're going to penalize you, but losing rankings seems like a good way, so - if you have been a victim of bad / obvious CTR manipulation - then it's likely that this had caused the penalty...

Either this, or you've simply been affected by 1 of google's recent updates (they've had several in the last 6 months, so it's a likely cause)

I agree with what @tazarbm said, there might be also chances that you are affected by negative SEO, where someone is sending spammy traffic via tools, and the possibility they might have made bad backlinks to your site to hurt your rankings. Have you seen an increase in the number of backlinks?

Since you've already blocked traffic from Poland via CloudFlare, which is good. You can keep monitoring and blocking any new suspicious IP addresses. Also if you find bad backlinks made on your site then you can disavow them using Google’s Disavow Tool to tell Google to ignore harmful backlinks.

Hi guys, thanks for the replies, @tazarbm I am not sure if it qualifies as CTR manipulation because they are not actually going via Google search results, they are masking the source referrers using a t.co (X) URL shortener, so almost certainly these are automated traffic hits clicking on a bunch of really low-value links, maybe that is also classed as CRT manipulation? I allowed some of the traffic through for a short period so I can analyse the behaviour and they are spending a few minutes only on the homepage, variable, and refreshing the page variable times too (1 to 6), no other actions are taken on the page, no clicks to other pages, 100% it is automated.

@primeseohub I am suspecting that we are targeted by Negative SEO, the keyword is a high-value with heavy competition, we have held no.1 spot for a long time and now we see others moving in on the keyword, we constantly check out backlinks and we see dodgy ones in there on a daily/weekly basis (porn and "free links" types), we disavow them weekly.

Sounds like blocking with a 403 is the right approach, but great point on monitoring for new vectors too, I think this is costing them quite a bit of money to run daily, so maybe they are also using other geos to try to hurt us

Understanding how a competitor might be affecting your search engine rankings involves a detailed analysis of their strategies and how they intersect with your own.

funtimehelpers said:

Over the last few months we have had some seriously dodgy traffic coming in from Poland, about the time it started our ranking dropped from no.1 position and we did not connect the dots immediately. After we caught on to this we wondered why? It looks to me like they are sending a large amount of traffic from a wide variety of IP addresses, via spam links, and then they must be using Google addresses and sending low-value ranking signals to Google, which is pushing us down the rankings.

Since we figure it out we blocked that traffic via CloudFlare with a 403, but doesn't seem to have made much difference, anyone know if this is what they could actually be doing and how to prevent against this kind of thing?

Would appreciate any comments or helpful ideas please

Click to expand...

Of course, competitors strategy has chance for affecting our ranking. Especially, while competition with keywords on same product or service.

funtimehelpers said:

@primeseohub I am suspecting that we are targeted by Negative SEO, the keyword is a high-value with heavy competition, we have held no.1 spot for a long time and now we see others moving in on the keyword, we constantly check out backlinks and we see dodgy ones in there on a daily/weekly basis (porn and "free links" types), we disavow them weekly.

Sounds like blocking with a 403 is the right approach, but great point on monitoring for new vectors too, I think this is costing them quite a bit of money to run daily, so maybe they are also using other geos to try to hurt us

Click to expand...

I agree, it does sound like you're being targeted by negative SEO, which is unfortunately common in highly competitive zone. You can take to further protect your site and mitigate the impact:

You can continue using tools like Ahrefs, SEMrush, or Moz to monitor new backlinks and set up alerts for any new, potentially harmful backlinks so you can disavow them. Google Analytics and other analytics tools also can be helpful to track traffic sources. Pay close attention to unusual spikes or drops in traffic and identify their origins.
You can also use server logs to identify patterns of suspicious activity, such as repeated access from specific IP addresses or geographical locations.

These strategies you can better protect your site from negative SEO attacks and maintain your competitive edge.

---

I thought I would follow up with some more facts in case anyone else finds this scenario on their sites:

1. Traffic is coming from 1,000s of different IP addresses, all based in the same geo (Poland in this case)
2. All traffic has the referer hidden by using the t.co (Twitter / X) URL shortener utility
3. Visits to the pages from these bots are varying in length (from 4s up to a few mins), sometimes the bot reloads the page a few times in the same session
4. Sessions are spread across multiple source browser, source device type, source user agent
5. The traffic profile is ramping up from early in the day to a peak around 10pm CET and then winding back down again

In short a lot of effort has been made to make this look like genuine traffic, if the goal was a simple DDoS I feel like there are much less complex ways to make this happen (and they would send more visits), so since the actor has gone to great lengths to make the traffic look like genuine visitors I can only surmise the idea is to trick Google into treating them like genuine users. And based on that, and the fact that they hide the referer, and also adding in that we see many really dodgy links popping up, my running theory is this (thanks to feedback above):

A competitor is building a large network of bad links to our site and validating them with "genuine" traffic being sent to our site from their bot network, with the goal being that Google sees these links as being useful (clicks) and this somehow stops Google from marking these as bad links using their automated detection

Anyone has anything further to share on the above? If it is true there is not much about it on the web