What it detects01
What does 'Low Backlink Source Diversity' indicate?
It indicates that the domain’s backlinks originate from a small number of repeating or closely related sources rather than a broad and organic set of independent websites.
Low Backlink Source Diversity
It indicates that the domain’s backlinks originate from a small number of repeating or closely related sources rather than a broad and organic set of independent websites.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is low backlink diversity considered risky?
Low diversity is commonly observed in SEO manipulation, private blog networks (PBNs), link farms, and artificially boosted domains, where backlinks are generated in a controlled or automated manner.
How analysts use it03
How should SOC analysts interpret this label?
This is a contextual malicious-leaning signal. On its own it is not definitive, but when combined with low backlink quality, malicious backlink relationships, or redirector behavior, it significantly strengthens the abuse assessment.
Often paired with:alert_only
Evidence shape
What Low Backlink Source Diversity looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "backlink_diversity_low",
"name": "Low Backlink Source Diversity",
"group": "popularity_and_backlink",
"subgroup": "backlink_quality",
"direction": "malicious",
"evidence": {
"backlink_count": 184,
"referring_domain_count": 6,
"backlink_quality_band": "low",
"known_farm_cluster_share": 0.82
}
}Siblings
Peers in Backlink Quality
3 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Low-Quality Backlink Profile
It indicates that a significant portion of the domain’s backlinks originate from low-reputation, irrelevant, spam-like, …
Malicious
Backlink From Known SEO Farm Cluster
It indicates that the domain receives backlinks from known link-farm or PBN clusters commonly used for SEO manipulation …
MaliciousCore
High-Quality Backlink Profile
It indicates that the domain receives backlinks primarily from reputable, authoritative, and thematically relevant sourc…
SafeCore
In the wild
See Low Backlink Source Diversity fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.