Manual action landed on a client site - has anyone actually traced one back to a specific seller

Client picked up a partial manual action three weeks ago - unnatural links to site, affecting a section rather than the whole domain. First one I have had to deal with in about four years, which itself tells you something about how rare these have become.

The thing I cannot do is attribute it. The client has bought from at least five different sources over two years, some before I was involved, and the notice does not name anything. There are example URLs but only three of them, and two are from a source I would have called fine.

So the question, and I would like actual cases rather than theory:

Has anybody here had a manual action and been able to establish, with something better than a guess, which seller caused it? Not 'it was probably the cheap ones'. Something like a cluster in the examples, a pattern across multiple sites you own, or a seller whose whole customer base got hit in the same fortnight.

I am asking because the standard advice is to disavow everything you are not certain about, and on this profile that is close to half the links and several thousand pounds. Before I do that I want to know whether attribution is ever actually possible or whether everyone just carpet-bombs and hopes.

Yes, once, and only because I owned four sites and could compare.

2019. Bought from the same broker for three of the four and not the fourth. Three got the notice inside eight days of each other, the fourth never did. That's not proof but it's about as close as you get without someone at the other end telling you.

What I'd add is that the three examples they give you are not a sample of the problem, they're a demonstration that a problem exists. People treat that list as diagnostic and it isn't - it's the shortest list that makes the point. I've seen a notice with examples from one seller where the actual issue was obviously a different seller entirely, because the second one's whole footprint went dark that quarter.

The wider point, and I've been saying this since the 2012 ones: manual actions used to be how they dealt with this and now they're the exception. Most of what people call a penalty is devaluation, which has no notice, no examples and no recovery path. Getting an actual manual action in 2026 means something went far enough to be worth a human's time, which usually means volume, obviousness, or somebody reported you.

Three sites, one broker, eight days. That's the closest thing to evidence in this whole category.

somebody reported you. that's the answer nine times out of ten and nobody wants it

From the selling side, and I'll be as straight as I can be given the obvious conflict.

I have had exactly one customer come back to me with a manual action in five years, and when I looked at what he'd bought from me it was six links on sites that are all still fine and still selling today. He'd also bought about 900 links from a panel that month. I can't prove it wasn't me. I'd bet a fair amount that it wasn't.

What I'd genuinely tell you about attribution: the thing to look for isn't in your own profile, it's in the seller's other customers. If a source has caused it, other sites on that source get hit in the same window, and the people who buy from panels talk to each other more than you'd think. Ask in the buyer groups whether anyone else got a notice in the same fortnight. That's how the 2019 ones got identified and I don't know of a better method since.

The honest position is that manual actions from bought links have become very rare, and the reason is that they don't need them any more. Neutralising a link costs nothing and generates no appeal. A manual action is a choice to spend a person's time on you.

IME the practical route is the opposite of what you're describing - don't try to attribute, try to bracket.

Sort every referring domain by first-seen date. Manual actions follow patterns of acquisition, and if you plot acquisition volume by month you'll usually find one or two months where the line goes vertical. Those months are the campaign that caused it, whoever ran it. You disavow the block, not the seller, and you write the reconsideration around the block.

It's crude and it takes out good links that happened to arrive in a bad month. But it's a defensible story to put in a reconsideration request, which matters more than being right - you're writing for a reviewer who needs to see that you understand what happened and have acted decisively. Vagueness gets rejected more often than over-correction does.

Does the reconsideration actually get read by a person, or is that just what everyone assumes?

I want to push back on the 'very rare' framing, because I think it's true in a way that misleads.

They're rare per site. They are not rare in absolute terms, and they cluster. What I've watched happen repeatedly - 2016, 2019, and again in 2023 - is that a specific network or panel gets identified, and then everybody who bought from it gets a notice over about three weeks. If you're not in one of those windows your odds are close to zero. If you are, your odds are close to one.

So 'rare' is the wrong shape. It's not a low constant risk, it's a low probability of being caught in a sweep that catches everyone at once. Which changes the advice: it's not about how many links you buy, it's about how many other people bought the same links.

byte_broker's method of asking the buyer groups is the right one, and it works precisely because of this. But it also means his 'it's rare, they don't bother any more' reading is the reassuring version, and I don't think the last three years support it.

Two weeks on, and I do not have an attribution. I want to write down what I actually did, because the thread ended on a disagreement I cannot resolve and someone reading this later will want the practical part.

PipelineRat's bracketing was the usable method. Acquisition by month across two years has two obvious spikes, one in April 2024 and one in September 2024. The three example URLs are all in the September spike. I disavowed that block entirely - 214 domains, of which I would guess forty were fine - and left April alone, on the basis that if April were the problem the examples would have found it.

On old_growth_seo and byte_broker: I think they are both right and describing different time horizons. Over a decade, sweeps. Over any given quarter, rare. Neither reading tells my client whether to keep buying, which is what he actually asked me and what I still cannot answer.

Reconsideration went in on the 5th. Will post the outcome whichever way it goes.