The pitch landed through someone I knew.
Not a cold email. Not a random LinkedIn message. A referral from a contact I trusted. A local Australian company offering an AI-powered backlink and authority package. Thousands of links, social signals, and domain authority improvements. And a price that didn't seem outrageous.
I already knew what this probably was. I've been in digital marketing for 15 years. I know what a link farm looks like. But the referral gave me just enough pause to take the meeting. And once I took the meeting, I decided I might as well make it useful.
I get approached constantly by companies wanting me to resell their services to my clients. Before I recommend anything, I need to know if it actually works. So I pointed them at a secondary domain I own, webdesignsunshinecoast.net, and said: go.
This is what happened.
The Setup
The domain had been sitting a bit neglected. Rankings had slipped. For my target keyword, "web design sunshine coast," I was sitting at position 16 in September. Not terrible. Second page, but recoverable with legitimate work.
The package was sold to me as AI building real websites with real content, then placing links back to my domain from those sites. Legitimate placements. Quality signals. Not bulk rubbish.
That was the pitch. What was actually delivered was a different story.
One warning sign appeared early. The person I was dealing with had recently bought into the business. Someone else was running the campaigns. I asked a basic question and mentioned Google Search Console.
He didn't know what it was.
That should have been the end of it. Anyone running SEO campaigns who can't navigate Google Search Console isn't running SEO campaigns. They're clicking buttons they don't understand and calling it a service. But I kept going anyway. Deliberately. I wanted to see the full picture.
Month Two: I Told Them to Stop
Two months in, I reviewed the results. Nothing. No ranking movement. No traffic increase. Nothing I could point to and say "that's working."
I told them to stop the campaign.
They didn't, as it turned out.
The thing is, even after calling it off, I stayed curious. I kept my tracking tools running. I wanted to see whether the links that had already been built would do anything over the following months, in either direction. Sometimes these things take time to show up.
Then, if I'm being honest, I got busy and mostly forgot about it. The domain wasn't a priority. I had other things going on. I wasn't logging in to check every week.
Which is exactly why month five came as a surprise.
A Quick History Lesson (Because This Matters)
Before I get to the results, it's worth knowing where this type of strategy comes from.
Back in 2010, mass link building worked. Tools like XRumer could blast thousands of links across forums, blog comments, and directories overnight. I knew people using these tools. Some of us in the industry were experimenting with all of it, back when the rules were still being written. If you had enough links pointing at your domain, Google would often reward you. It was crude, it was spammy, and for a while it worked.
Then in 2012, Google released the Penguin update.
I had a friend at the time running a successful online business. Good product, plenty of orders, solid rankings built largely on aggressive link building. When Penguin rolled out, his rankings disappeared. Not dropped. Disappeared. He went from thousands of orders to almost nothing, overnight. He spent months trying to recover. He never fully did.
That was 2012. Fourteen years ago.
The links I eventually found in my backlink profile from this campaign? They looked like a 2012 black hat replay. Irrelevant directories. Low-quality foreign sites. Spam networks dressed up with a thin layer of AI-generated content to look legitimate. The "AI building real websites with real content" turned out to be AI-generated filler articles on throwaway domains. Not the kind of sites anyone visits. Not the kind of sites Google trusts.
The pitch was better rankings. The mechanism was volume. Those are not the same thing, and in 2026, the gap between them can cost you your domain.
Months Three to Five: The Damage Arrives
Month four, I officially cancelled the engagement.
In month five, they tried to charge my credit card anyway. That's when I logged back in and had a proper look at what had actually happened to the domain over the previous few months while I wasn't watching.
The numbers told a clear story.
Referring domains went from 139 to 394. Total backlinks went from 4,594 to 8,184. On paper, that looks like growth. More links, more authority, better rankings incoming.
My page authority score had dropped from 7 to 2.
There was a warning on the domain: "This domain may have used link farms to increase its rankings. A link from this domain might not be helpful to your site."
And the worst: "Dangerous Backlink — a link from this domain will harm your backlink profile."
The keyword I was targeting dropped from position 16 to position 63. Not a small dip. Not an algorithm update I could wait out. A collapse. Forty-seven positions backwards over five months of paid "SEO work."
More links. Worse rankings. That's not a coincidence. That's exactly what happens when Google identifies manipulative link building.
The one useful thing the company did provide: a full list of every backlink they built. I now have that list. My next job is to submit it as a disavow file through Google Search Console and start the recovery process.
Why Bad Backlinks Hurt More Than No Backlinks
Google has been penalising manipulative link building since the Penguin update in 2012. More than a decade later, it's only gotten better at detecting it.
When you build thousands of backlinks quickly, from low-quality sites, in patterns that don't look natural, Google doesn't reward you. The links get devalued at best. At worst, they actively flag your domain as one that's been gaming the system, and your rankings follow.
Quality beats quantity every single time. One backlink from a relevant, trusted Australian website carries more weight than 5,000 links from random directories and link farm networks. That's not an opinion. It's how Google's algorithm works, and it's been publicly documented for years.
For a plain-language explanation of how Google evaluates link quality, Google's spam policies documentation is worth reading before you trust anyone with your backlink profile.
The Problem for Small Business Owners
Here's the hard part: if you're a small business owner and not a marketer, this is genuinely difficult to spot.
The company I used had a professional website. They had client testimonials. The pitch was coherent. "AI-generated articles on real websites, genuine backlinks, better rankings." That's not an obviously ridiculous claim. It could have been legitimate.
The company was relatively new, so there wasn't a trail of bad reviews to find. Their testimonials suggested the approach had worked for someone, at some point. Maybe it had. Maybe those clients had never looked closely at what happened to their backlink profiles.
The warning signs I picked up on, like not knowing what Google Search Console was, are only obvious if you already know what you're looking at.
So what do you do if you don't?
A lot of SEO comes down to hoping. That's the uncomfortable truth. Even legitimate SEO work involves uncertainty. Rankings take time to move. Results aren't guaranteed. That ambiguity makes it easier for bad operators to hide behind.
A few things that help:
Get more than one quote. Talk to two or three providers before committing. The ones that seem legitimate, and probably more expensive, are worth a conversation. Tell them what you've been offered, describe the package, and ask what they think. A good SEO provider will tell you honestly what they'd do differently and why. If they dismiss the cheaper option with vague language and can't explain the actual difference in approach, that's a yellow flag too.
Ask what the work actually involves. Legitimate SEO is a combination of on-site optimisation, technical fixes, content, and genuine backlink outreach. It's time-intensive. It requires real relationships with real websites. That work isn't going to be cheap. If a package seems very affordable for what's being promised, the question is what's being left out.
Understand that AI hasn't changed this as much as the pitches suggest. AI can help with content production and research. It cannot automate its way to genuine authority. Google is getting better at identifying thin, machine-generated content on throwaway sites. The "AI-powered backlinks" pitch is mostly old tactics with new branding.
What I'm Doing Now
The domain is damaged but not necessarily dead. Recovery looks like this:
Check for a manual penalty first. I've looked at Google Search Console and there's no manual penalty showing (yet). That's a good sign. The ranking drop appears to be algorithmic rather than a direct penalty, which means recovery through a disavow file is more straightforward.
Submit a disavow file. I have the full list of backlinks they built. I'll use Google's Disavow Tool to tell Google to ignore them. This doesn't fix things overnight. It takes weeks to months for Google to process and for rankings to stabilise.
Keep running Google Ads. I've been running Google Ads on the domain throughout this whole exercise. For roughly the same budget I spent on the backlink package, the Google Ads brought in two new clients. The SEO experiment brought in a damaged domain and a blog post.
The maths aren't complicated.
Build the domain properly from here. Consistent content, legitimate local citations, real backlinks from relevant Australian sites. Slow, boring, effective.
The Short Version
If you're being pitched an affordable SEO package right now, take your time. Ask questions. Get a second opinion from someone who can explain exactly what the work involves and why it should move rankings.
And if you've already been paying for SEO for several months, haven't seen any improvement, and have a nagging feeling something isn't right: trust that feeling. A second opinion costs nothing.
Let's talk.
Johannes