How to Spot Fake Traffic, PBNs, and Link Farms

If you are buying links for a SaaS site, the fastest way to waste budget is to pay for a placement on a site that looks great in a spreadsheet but is actually a fraud. Learning how to spot a PBN, fake traffic, and link farm footprints is the difference between a link that compounds and one that drags your domain down. This guide walks through the exact fingerprints scammers leave, how much weight to give spam scores and toxic-link reports, and a disqualification checklist you can run in about ten minutes.

Key takeaways

• Fake traffic shows up as bot patterns, mismatched geographies, zero branded search, and suspiciously flat engagement. Real audiences are messy and uneven.
• PBNs share fingerprints: thin or spun content, hidden ownership, recycled templates, and link profiles that only point at money sites.
• Link farms give themselves away with site-wide links, wildly off-topic outbound profiles, and tight reciprocal-link clusters.
• Spam scores and toxic-link tools are useful filters, not verdicts. Read them with judgment, not as a kill switch.
• Referring domain diversity beats raw backlink count every time. One natural link from 200 unique domains is worth more than 5,000 links from a handful.

Why this matters more than ever

Google has gotten very good at ignoring or punishing manipulative links. Its spam policies explicitly call out paid link schemes, large-scale coordinated networks, private blog networks, and link farms as violations. The December 2024 and later spam updates widened the net, and the outcomes range from quietly nullifying the links to a full manual action.

The traffic side is just as messy. According to Imperva's 2024 Bad Bot Report, nearly half of all internet traffic (49.6%) came from bots in 2023, with bad bots alone at 32%. That means a site can show "30,000 monthly visitors" and have almost none of it be a real human who might click your link. Your job as a buyer is to tell the difference before money changes hands.

If you want the positive version of this skill (judging a good link), pair this with our guide on backlink quality and how to judge a link before buying. This article is the defensive companion: how to catch the scams that game every metric.

Fake traffic tells: how to read the signals

Traffic numbers are the single most gamed metric in this industry, because traffic is what separates a real publication from a domain that exists only to sell links. Here is what fraud actually looks like in the data.

Bot patterns and impossible spikes

Pull the site into a tool like Ahrefs, Semrush, or Similarweb and look at the traffic trend line over 12 to 24 months. Healthy organic traffic grows in a lumpy, seasonal, gradual way. Fake or bought traffic tends to show:

• A vertical spike that appears from nowhere and then sits flat, like a mesa.
• Traffic that is wildly inconsistent with the number of indexed pages or referring domains.
• Direct traffic that dwarfs organic, which often signals bot or paid pop-under traffic being passed off as visitors.

Backlinko's research and most practitioner playbooks agree on the same tell: real growth has a story you can trace to specific ranking pages. Fake growth has no story.

Mismatched geographies and zero branded search

A site that claims to be a US SaaS blog but pulls 80% of its traffic from countries with no plausible audience fit is a red flag. So is the absence of branded search. Type the site's brand name into the keyword tool. A legitimate publication has people searching for it by name. A PBN almost never does, because no real human knows the brand exists.

Flat or fake engagement

Real readers behave erratically. They bounce, they scroll, they come back. If you can see analytics (or estimate from third-party tools), watch for engagement metrics that are too perfect: identical session durations, bounce rates pinned at suspiciously round numbers, or traffic with no pages-per-session variation. For a full workflow on validating traffic the right way, see how to check site traffic for link building.

The deeper principle here is that organic traffic beats DR and DA when buying links, precisely because authority scores are easier to inflate than a real, human, search-driven audience.

PBN fingerprints: how to spot a PBN

A private blog network is a group of sites, usually built on expired domains, controlled by one operator and used to funnel links to "money" sites. Google's systems flag them through network-level analysis, shared hosting, overlapping footprints, and content-similarity signatures. You can spot most of them by hand. Here are the classic PBN red flags.

Thin, spun, or directionless content

Read three or four articles. PBN content is written for crawlers, not people. Watch for:

• Generic, padded posts that cover unrelated topics (one post on crypto, one on dog food, one on SaaS) with no editorial focus.
• Spun or AI-mass-produced text that says nothing specific and cites nothing.
• No real author, no about page with real people, no bylines you can verify on LinkedIn.

Hidden ownership

Run a WHOIS lookup. Privacy protection alone is normal, but a network of "independent" sites that all use the same registrar, same privacy service, same nameservers, and were registered in the same window is a coordinated footprint. Tools like Ahrefs and a quick reverse-IP check will often reveal multiple "different" publications sitting on the same server.

Duplicate templates and recycled design

PBN operators reuse the same WordPress theme, the same logo placeholder, the same menu structure across sites because building each one from scratch is expensive. If two "unrelated" sites you are evaluating look like twins, you are looking at a network.

Unnatural link patterns

Pull the site's own backlink profile. A real publication earns links from a varied mix of sources. A PBN's outbound links almost all point at a small set of commercial pages with exact-match anchors, and its inbound links often come from other low-quality sites in the same cluster.

PBN signal	What a real site looks like	What a PBN looks like
Content	Focused niche, real authors, specific examples	Mixed unrelated topics, no real authors
Ownership	Transparent, varied hosting	Shared hosting, same nameservers, batch-registered
Design	Distinct, custom	Recycled theme across "different" sites
Outbound links	Diverse, contextual, mostly relevant	Almost all exact-match to money pages
Branded search	Present	Effectively zero

Link farm signals: detection that takes two minutes

Link farms overlap with PBNs but have their own tells. A link farm exists to manufacture link volume, so the math gives it away.

• Site-wide links. If a placement would put your link in the footer, sidebar, or blogroll of every page, walk away. Site-wide links are a textbook link scheme signal Google calls out directly.
• Irrelevant outbound profiles. Open the site's link report and look at who it links out to. A farm links to gambling, payday loans, pharma, and SaaS all from the same domain. Real publishers stay in a lane.
• Reciprocal and link-exchange clusters. If site A links to B, B links to C, and C links back to A in a tidy ring, you have found an exchange network. Google's policies treat excessive link exchanges as manipulation.

This is also why link diversity matters more than raw count: farms inflate total backlinks while contributing almost nothing in unique, trusted referring domains.

Spam score and toxic backlink signals: how much to trust them

Most buyers lean on a single number, usually Moz's Spam Score or a "toxicity" rating from Semrush or another tool. These are genuinely useful for triage, but you have to understand what they are.

Moz's Spam Score is a machine-learning model that estimates the probability a site looks like ones Google has penalized, based on dozens of features. It is a correlation signal, not a Google verdict. A high score (say, 30%+) is a reason to look harder, not an automatic disqualifier, because legitimate sites occasionally trip the model.

Practical rules I use:

• Treat spam/toxicity scores as a first-pass filter, not the decision. Use them to rank which sites get manual review.
• Cross-check a high score against the human signals above. If the score is high AND the content is thin AND the outbound profile is junk, that is three strikes and you walk.
• Never disavow or reject a site on score alone. Google itself has cautioned that most sites do not need the disavow tool, and over-disavowing can hurt you.

The honest summary: tools point you at risk, your eyes confirm it. If you are weighing whether to pay at all, our take on whether buying backlinks is safe covers the risk math in more depth.

Referring domains vs total backlinks: why diversity wins

This is the metric that catches the most fraud, and the one beginners ignore. Referring domains is the count of unique websites linking to a domain. Total backlinks is the raw number of links, including hundreds from the same site.

A natural, healthy profile has a sane ratio. If a site shows 500,000 total backlinks from 300 referring domains, that is not authority. That is a handful of farms or spammy widgets firing thousands of site-wide links. Ahrefs has long argued that referring domains correlate with rankings far better than raw backlink count, because diversity is hard to fake and easy to verify.

When you evaluate a site to buy from, check its own referring-domain trend. A real publisher gains unique linking domains steadily over years. A manufactured site shows a flat line plus one ugly spike of low-quality links.

The disqualification checklist: when to walk away

Run this in order. If a site fails two or more of the hard checks, do not buy, no matter how good the DR looks.

1. Traffic story. Does the organic traffic trend make sense, with traceable ranking pages? No traceable story = fail.
2. Branded search. Does anyone search the brand by name? Zero branded search = strong fail.
3. Geo fit. Does the traffic come from countries that match the claimed audience? Wild mismatch = fail.
4. Content quality. Real authors, focused niche, specific and cited posts? Spun or scattershot = fail.
5. Ownership footprint. WHOIS, hosting, and nameservers look independent? Batch-registered network = fail.
6. Outbound profile. Does the site link out to relevant, reputable places, or to gambling and pharma? Junk neighborhood = fail.
7. Link placement. Is your link contextual and editorial, or site-wide footer/sidebar? Site-wide = fail.
8. Referring-domain diversity. Healthy unique-domain growth, sane ratio to total backlinks? Inflated count = fail.
9. Spam/toxicity score. High score that the manual checks confirm? Confirmed risk = fail.

A faster mental shortcut: if you would be embarrassed to show this placement to your CMO, do not buy it. Avoiding bad placements is one of the most common SaaS link building mistakes teams make once they start spending.

How Saaslinks filters this out for you

Running the full checklist on every prospect is slow, and most buyers do not have the tooling to reverse-engineer hosting footprints at scale. That is the entire reason a vetted link-building marketplace exists.

At Saaslinks, every site in inventory is screened against exactly these signals before it is listed. We require real, traceable organic traffic (not inflated estimates or bot traffic), check for branded search and audience geo fit, and reject sites with PBN fingerprints like shared hosting footprints, recycled templates, and thin content. We disqualify link farms by inspecting outbound profiles and refusing site-wide placements, and we weight referring-domain diversity over raw backlink count. Every placement is an editorial, in-content link, and orders are tracked to indexed under a 30-day indexation guarantee.

In other words, the ten-minute checklist above becomes a background process you do not have to run yourself. You browse pre-vetted inventory and buy with the confidence that the traps have already been screened out.

The takeaway

Scammers can fake a DR score, inflate a traffic estimate, and spin a thousand articles overnight. What they cannot easily fake is a real human audience, a transparent ownership trail, and a diverse, relevant link profile. Run the disqualification checklist, trust your eyes over any single tool, and you will dodge the placements that quietly sink SaaS sites. And if you would rather skip the detective work entirely, start with pre-vetted inventory where the traps are already filtered out.