What it detects01
What does 'Backlink From Known SEO Farm Cluster' indicate?
It indicates that the domain receives backlinks from known link-farm or PBN clusters commonly used for SEO manipulation rather than organic editorial linking.
Backlink From Known SEO Farm Cluster
It indicates that the domain receives backlinks from known link-farm or PBN clusters commonly used for SEO manipulation rather than organic editorial linking.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is this considered a malicious signal?
Link farms are intentionally created to manipulate search rankings and traffic. Backlinks from such clusters are strong indicators of artificial promotion and abusive SEO practices.
How analysts use it03
How should SOC analysts interpret this label?
This is a high-confidence malicious-context signal. It should significantly increase risk scoring, especially when combined with low backlink diversity, low backlink quality, redirector behavior, or content, popularity mismatches.
Often paired with:block_domain
Evidence shape
What Backlink From Known SEO Farm Cluster looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "backlink_from_known_farm_cluster",
"name": "Backlink From Known SEO Farm Cluster",
"group": "popularity_and_backlink",
"subgroup": "backlink_quality",
"direction": "malicious",
"evidence": {
"backlink_count": 184,
"referring_domain_count": 6,
"backlink_quality_band": "low",
"known_farm_cluster_share": 0.82
}
}Siblings
Peers in Backlink Quality
3 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
High-Quality Backlink Profile
It indicates that the domain receives backlinks primarily from reputable, authoritative, and thematically relevant sourc…
SafeCore
Low Backlink Source Diversity
It indicates that the domain’s backlinks originate from a small number of repeating or closely related sources rather th…
Malicious
Low-Quality Backlink Profile
It indicates that a significant portion of the domain’s backlinks originate from low-reputation, irrelevant, spam-like, …
Malicious
In the wild
See Backlink From Known SEO Farm Cluster fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.