There are many ways to build links but this example shows one of the most natural ways to achieve it, through new, original and relevant content that people want to know about. It’s newsy, so it comes with natural traffic decay, but the links gained from it will remain for a long, long time.
On the 5th March Brian Krebs, an ex-Washington Post, independent investigative security journalist, broke the news that thousands of servers had been compromised through a zero-day vulnerability that had been recently made public. (If you have a local Microsoft Exchange server, please read the Microsoft announcement. )
Within 2 weeks, the visibility of the site took an upward turn.
It’s not uncommon for a domain to rise by 300% in visibility so quickly but not on a domain as established as this, outside of a Core Update or a content-injection hack. A list of some of the new and important keyword rankings (I’ve filtered new keywords moving into top 10 ranking positions that have a search volume over 100 per month) is shown below.
There are some high-volume keywords in there. Krebs has just set up a shop-front in some very busy places! The most important thing is that the data you see above is Google’s reaction to the signals it has received from other places.
What are those signals? Well, Google News may have detected that there’s activity in the ‘Microsoft Mail’ keyword. That might have led to a reshuffle of the search results. The keyword hafnium shows the biggest change. On the 1st March it was a metal with a melting point of 2233 degrees C. On the 15th March it was a hacking group with links to China. The SERP was refreshed.
Of course we don’t know what goes on behind the scenes in the search algorithms’ special cases department but one imagines that when certain signal levels are met, a re-evaluation of the index is made to find good candidate URLs based on new keyword attributes. The process probably happens many times, perhaps minute-by-minute, to re-evaluate those candidate URLs. It’s in Google’s interest provide a good result for the searcher, both with relevant organic results and helpful feature integrations.
The SERP detail can be seen in the SISTRIX historical data for the 9th and 10th of March
The SERP for the 9th of March shows a clearly informative SERP about the element Hafnium
On the 10th of March the SERP changed to offer information about the hack and the hacking group..
Just a few days later (16th March) this, above, was live on mobile searches and included the news box.
Let’s go back to Krebs. One of the ranking signals we all know about is the backlink. By analysing links, anyone, not just Google, can evaluate an information source. How was it referenced? Were the references good quality? What topics do the references usually cover? Do the references have known authors or editorial processes? Is there anything strange about the domain that the reference is on? And so on.
Have a look at a few of the 1200 backlinks that have referenced the Krebs article (URL) in the last week. Our crawlers will continue to find more, as Google does, but it’s already fairly easy to work out that the source article is a quality one.
Update 24th March: Over 2000 links have been found to date.
Here are some data points to take note of.
- 813 unique domains 1 have linked to the source. More importantly, there are very few cases of multiple links from a single domain. 1284 links are spread across 812 domains indicating that this is no link-farming exercise.
- If you scan across the domains linking 2, you’ll immediately see reddit.com, computerweekly.com, speigel.de (news media) , lemonde.fr (news media) , tijd.be (news media) , tass.ru (Russian news agency) and more domains with a high Visibility Index.
- The source domains are spread right around the globe. 3
- A vast majority of the links are follow links 4
Finally, these are some of the anchor texts. It doesn’t take a human more than a few minutes to realise that “Brian Krebs” “first reported” “30,000 microsoft customers”, “banks, nonprofits, telecommunications providers, public utilities, police, fire and rescue units, hospitals” “hacked via holes in microsofts email software.”
The story almost writes itself.
I’m sure Brian Krebs is seeing a big surge in traffic, not only through relevant searches, but through the links themselves which are still topical and important.
Over time though, that traffic will wane because that’s the nature of news. Hafnium may become a future news story and the hacks themselves may become stories, but over time, the world will move on and Hafnium will return as a metal first, hacking group second. The Visibility Index is likely to drop.
The lasting advantage will come from the backlink signals that krebsonsecurity.com has received. These links, that Google has in its databases, may be part of the evaluation of new articles, of core updates and of future QDF processes will only play a positive part. Meanwhile, I’m sure that Brian probably doesn’t even realise what has happened to his SEO and continues to have his head down while he continues his investigative work – organic link-building!
