Ahrefs emails me when a site gains or loses backlinks. Most weeks it is noise. In May the numbers on nomadsamor.com, our RV travel site, started climbing in a way that had nothing to do with anything we published, and by the end of August the site had picked up 559 referring domains.
I went through all of them. 540 are spam. I have never bought a backlink, for that site or any other.
What the spam actually looks like
The bulk of it is one network, and it is not subtle. A sample of the domain names:
advanced-link-building-group-seoexpress.store link-baron-luxury-anchor-text-partners.store keyword-rank-backlink-pro-and-keyword-rank-depot.store proven-consortium-for-ranking-signal-and-keyword-rank.store seoexpress-verified-high-da-consultants.store
There are hundreds of these. They are machine-generated names assembled from a bag of SEO nouns, registered in bulk on cheap TLDs, filled with scraped text, and pointed at whatever list of domains the operator is working through. My sites are on the list. So is everyone else's.
Underneath that there is a second layer with a sense of humor about itself:
you-found-the-hidden-link.xyz what-happens-next.xyz this-is-not-what-you-think-it-is-at-all.us selfie-battles-are-for-amateurs-tim--kalin-from-seodomains-here.com
Those are expired-domain marketplaces advertising to other SEOs. The links to my site are incidental. They scrape a page, republish it, and the outbound links come along for the ride.
Then the usual tail: scraper directories with a hundred million outbound links, a few gambling and crypto sites, an escort directory, and a domain that appears to be about Bitcoin mixing.
None of this was aimed at me. It is a blast. The same network hit all six of my sites within weeks of each other, and the per-site disavow lists came out at 540, 529, 500, 487, 485 and 243 domains.
The part where I tell you it probably does not matter
If you search for what to do about this, most of what you will find is written by people who sell disavow services, and it is written to frighten you. The honest answer is duller.
Google has said for years that it ignores unsolicited spam links. SpamBrain handles it at their end. The whole point of a link-based ranking system that anyone can write links into is that it has to hold up against people writing links into it. If a competitor could sink your rankings by pointing 500 garbage domains at you, that would be a much bigger story than my travel blog.
So the correct expectation is that this is doing nothing to me. My rankings on those sites are held back by thin pages, almost no internal linking, and a blog competing with its own documentation for the same queries. Those are my fault and they are fixable. The spam is neither.
One number did move. Ahrefs' Domain Rating for knowledgeerp.com fell from 32 to 21 in August. It is tempting to read that as damage. It is not: DR is Ahrefs' metric, not Google's, and the most likely explanation is that Ahrefs devalued a batch of those spam domains inside its own index, so the links stopped counting toward my score. Nothing happened at Google. DR is not a ranking factor and chasing it is a good way to waste a month.
So why did I disavow
Because it costs an afternoon and the downside is bounded.
The case for doing it is not "this will fix my rankings." It is that I own six sites with a shared brand, the profile is now overwhelmingly junk by volume, and if a manual review ever happens I would rather the record show I looked at all 559 domains and made a call on each one. The disavow file is a document about my intent as much as a technical instruction.
The case against is that a careless disavow does real damage. The file tells Google to discount those domains, and Google does not argue with you. Disavow a legitimate link by accident and you have thrown away something you earned.
That risk is the actual work.
The classification problem
Ahrefs has an is_spam column. It is good. It is not sufficient.
On nomadsamor it flagged 539 of the 559 domains. Nine more were obviously link-selling by name and it had missed them: addurl.in, backlinkup.co, openbacklink.com, seotira.com, rankongoogle.agency. I catch those with a keyword and TLD heuristic.
It also goes wrong in the other direction, which is worse. is_spam flagged za.com, a domain with a DR of 90 and 465,000 monthly organic visits. It flagged itxoft.com at DR 81. Those are real sites and disavowing them would be a self-inflicted wound.
So neither method is trustworthy alone, and the rule I settled on is that they are combined and never subtracted. A domain gets disavowed if is_spam flags it or the heuristic flags it. On top of that sits a hand-maintained whitelist of domains that are never disavowed no matter what either method says: my own sites, and the dozen or so real third parties that keep getting caught.
The whitelist is the part worth being careful about. On the RV site it includes youtube.com, which Ahrefs correctly did not flag but a keyword rule easily could have. That is our own channel linking to our own site, the single most legitimate link in the entire profile, and an automated pass that swept it into the file would have been actively harmful while looking like a clean run.
Whatever you automate here, the whitelist survives it.
The mechanics, which are worse than they should be
A few things I had to learn by hitting them:
There is no API. Not in Ahrefs, not in the Search Console API, nowhere. You upload a text file by hand at search.google.com/search-console/disavow-links and that is the only way.
The upload replaces the entire list. It is not a delta. If you upload a file with ten new domains in it, you have just disavowed ten domains and un-disavowed everything else. Always upload the complete file.
The tool does not accept Domain properties. If your property is sc-domain:example.com you will not find it in the dropdown. You need a URL-prefix property, and the disavow applies to that prefix, so a file uploaded against https://www.example.com/ does not cover shop.example.com.
And a smaller one: Ahrefs' referring-domains endpoint caps at 250 rows per call regardless of the limit you ask for. The documented workaround of pulling 300 ascending and 300 descending leaves a silent hole in the middle for any site with more than 500 domains. On nomadsamor that hole was 59 domains I would never have seen. Sort, page it properly, and count what comes back.
What I would tell someone in the same position
Check whether you actually have this problem before you spend a day on it. Pull your referring domains and look at them. If the answer is thirty domains and you recognize most of them, close the tab.
If it is five hundred domains and they all end in .shop, you have the same blast I have. Write the file, keep a whitelist you maintain by hand, upload it, and then go fix your internal linking, because that is the thing that is actually costing you traffic.
The disavow is insurance. It is cheap, it is worth having, and it is not the fix.
This is the second time I have gone looking for an expensive problem and found a boring one. The first was when I measured where my AI budget actually goes and got it wrong four separate ways.