A domain that is reachable from many distinct sources (high harmonic centrality) yet none of those sources carry meaningful authority (very deep PageRank tail). This divergence is the classic fingerprint of SEO link farms, comment-spam aggregators, or automated widget-injection networks accumulating cheap inbound links.
The questions every analyst asks before acting on this signal.
A domain that is reachable from many distinct sources (high harmonic centrality) yet none of those sources carry meaningful authority (very deep PageRank tail). This divergence is the classic fingerprint of SEO link farms, comment-spam aggregators, or automated widget-injection networks accumulating cheap inbound links.
Transient indicates the divergence is observed only in the latest period, it can be noise, a one-time scraping spike, or a recent injection. Persistent means the harmonic-head + PR-deep-tail divergence has held for at least persistent_min_count consecutive periods, supporting a systematic link-farming infrastructure pattern.
The label payload's value field carries the latest period's PR rank and the details include log_delta (log10(pr) - log10(harmonic)). A larger log_delta indicates a sharper divergence; the log_delta_strong_threshold (default 1.5) can be used by downstream consumers to categorize 'how strong' independently of the persistence sublabel.
The label starts with a low informational base (severity_base=1, impact=0.1). When other malicious co-signals from the curated whitelist are also matched, a saturating multiplier (tau=1.5, m_max=10) increases the effective impact, keeping the label quiet on its own but escalating quickly when corroborating evidence exists.
Both labels target domains in the deep PageRank tail. Letting them co-fire would cause double counting in amplification. The guard keeps link_farm_suspect strictly for the harmonic-head + PR-deep-tail divergence pattern, while bad_popularity handles the general isolation case.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "link_farm_suspect",
"name": "Emerging Link Farm Pattern",
"group": "popularity_and_backlink",
"subgroup": "popularity_score",
"direction": "malicious",
"evidence": {
"tranco_rank": 482103,
"tranco_rank_band": "100k-1m",
"organic_traffic_band": "low",
"regional_rank_top_country": "US"
}
}9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It represents a domain that receives links from a large number of distinct sources (high harmonic centrality) but whose …
A domain that is referenced by a small number of sources (mid or tail harmonic centrality) but those sources carry stron…
A domain whose harmonic centrality places it in the deep tail (very few distinct sources link to it) while PageRank is a…
It refers to globally recognized, high-traffic domains with verified ownership and a long operational history, such as g…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.