28 . 3 . 17

Wayward Pines 🌲: The Rise of .xyz SPAM In Your Profile


Over the past few years hundreds of bizarrely named and artificially populated domains have been appearing in even the most mundane of backlink profiles. This post will show you examples of the newer .xyz spam tactics on websites you’ve probably used or worked with before, and give you a free disavow file of 7,000 .xyz domains.

.xyz spam has become a problem for legitimate websites across all niches. Even the whitest of white-hat sites are suddenly finding themselves picking out odd looking links from spinner sites that are rife with dangerously optimised anchor texts. With a real-time penguin algorithm scouring the web this can be a traffic-damaging issue – so read on and make sure it’s not your site that’s getting caught in the crossfire.

What are .xyz domains?

On the 2nd of June, 2014 a new generic top level domain was released to the general public – .xyz. An event that went largely unnoticed in the SEO world, since it’s admittedly not as interesting as 2010’s “.xxx” or 2013’s rather faddish “.ninja” gTLD releases.

That said .xyz outsold .com with over 1,000,000 names registered in June 2016. Daniel Negari, founder and CEO of XYZ (the registrar) went as far as saying “We end the alphabet in ‘xyz’ and we should end domain names the same way.”

Rather than replacing .com domains for legitimate uses, .xyz domains became link directories, spinner sites and myriad other black-hat churn n’ burn sites.

Why? Because .xyz domains are cheap and plentiful, a tradition that was kick-started on launch day by Network Solutions actually giving them away for free. Users had their .xyz domains automatically placed into their accounts on an opt-out basis.

Since then, .xyz Domains have been readily snatched up and spun across every template under the sun. They’ve become the weapon of choice for many black-hat site owners looking to do the dirty on a massive scale, as any cursory glance at the forums will show. (The picture below is from Black Hat World).

Blackhat world XYZ givaway
Additionally, the release of a new gTLD creates the opportunity for spammers to buy exact match domains en masse – and spray them out with gay abandon. Examples include,,, and a personal favourite:

Pines!? 🌲🌲🌲

Pines seem to be all the rage at the moment. In fact, spammers are so eager for big hard pines that I came across 40 pines in a day. If you’re doing some link analysis of your own, you may well come across an assortment of spun sites such as these (I really hope IT don’t get the wrong impression):
Pines Collage

.xyz in popular brands

Hardwood aside, the rise of .xyz is becoming prevalent in a very high number of domains of the sites we use every day as consumers, or work on as SEO industry professionals.
Way into the future there may well be enough legitimate .xyz domains that this gTLD is as prevalent as – but right now the average .xyz seems overwhelmingly spammy.

To prove this point I’ve selected 20 sites across different niches and pulled out their .xyz domains using ahrefs. Link data are included at the foot of this post so you can replicate the results for yourself:

Site Root Domain ahrefs Reports    Count of .xyz
Wix SEO ahrefs Report 526
The Whitehouse ahrefs Report 212
IKEA ahrefs Report 140
SAGA ahrefs Report 89
Argos ahrefs Report 84
The AA ahrefs Report 76
ASDA ahrefs Report 69
AVIVA ahrefs Report 65
Next ahrefs Report 40
Ministry of Defence ahrefs Report 38
Wonga ahrefs Report 37
Thomson ahrefs Report 25
Matt Cutt’s Blog ahrefs Report 24
Halfords ahrefs Report 20
Onstride Loans ahrefs Report 17
Pets at Home ahrefs Report 15
Sainsburys ahrefs Report 15
Satsuma Loans   ahrefs Report 14
Kuoni ahrefs Report 10
National Express ahrefs Report 9

Interestingly, even domains that we’d expect to contain no .xyz spam have something. By rights, Matt Cutt’s blog should be cleaner than clean but is still subjected to domains like “” and even “”. It’s highly unlikely that Cutts, former head of web spam at Google (now with the USDS) is going to be soliciting links from churn n’ burn sites.

It could be that the .xyz in the domains tested here are simply victims of negative SEO (I’ll leave you to draw your own conclusions) – but warning here is that these site pop up in unexpected places, and might be in your profile too.

Maybe it’s just a fad?

Everything in black-hat is a fad. Spam tactics are employed until search engines compensate with better algorithms, or there’s no longer a profit.
As you’ll be able to see in the data, I’ve included the “Date First Seen” field, which indicates when a particular domain was first detected by ahrefs. Note that this isn’t likely to be the exact date that the links first went live – but there is an interesting pattern. The graph below summarises the first seen data into months:

XYZ domains - Excel 2017-03-24 12.21.26

Of the 1,525 instances of .xyz found pointing to these 20 nominated websites, 1,442 (96%) popped up between January and July 2016.

If you’ve been keeping an eye on your profile during 2016 you might have caught some of the .xyz lurking in your profile – but they’re still being used today. The spreadsheet available for download also groups specific .xyz domains by profile, including Moz Domain Authority. Unsurprisingly, every .xyz in this sample has a D.A. of 1, which is standard of new sites, but odd here. Even very poor quality sites usually garner a DA of 3ish – could it be that the Moz Authority excludes .xyz?

The ahrefs data shows that some spammers are more prolific than others; “” appeared in the profiles of 14 out of the 20 sites sampled. It was originally registered to an individual in Guangxi, China, and it’s now dead. (An archived snapshot shows it used to be a scraper.)

Are all .xyz domains Bad?

Actaully, no. While there are undoubtedly a vast number of bad examples, there are some genuine .xyz sites out there. The most obvious being Google’s parent company Alphabet which has the the URI And while Wired quoted .xyz registrations at around 3,000 per day in 2015, it seems Google’s adoption of the gTLD has done little to end the .com dominance.

There’s also, the site of Starship Technologies which makes a delivery bot – arguably a safer alternative to amazon’s flying delivery drones.

The best .xyz (in my opinion) is  – which is a site where you can watch every Dragonball episode EVER. 🐉 What’s not to love?

While it’s wrong to tar all .xyz domains with the same fiery brush, it’s important to remember:

  • You won’t find an .xyz domain in any of the big lists like Alexa’s top 500 global sites, Moz’s top 500, or ahrefs’s top 1,000,000 (I checked)
  • There is little to no authority behind an .xyz site in your backlink profile
  • There will be no traffic from .xyz spam in your profile

Therefore there is no real argument for you to risk any sort of penalisation on their behalf.

The fact is that most .xyz domains are trash. It’s rare that I would disavow without manually reviewing first, but just a glance at names like “” tells us what we need to do.

Kill it with fire

Free disavow file  👀 👀

If you think you might have spam issues we can do the digging for you. Below are just 7,000 example .xyz domains from past reviews, saved in UTF8 with the correct disavow file syntax ready to go.

Top up your blacklists people! And stay vigilant against the pines…


Link to 7,000 .xyz disavow file

Link to data spreadsheet

Disclaimer: Data accurate as of March 2017, and used at owners own risk. I encourage readers to actively think about the domains they choose to disavow. twentysix cannot accept any responsibility for disavow files or any interactions these files may have with other websites.

Alex DarwinAlex is our SEO Data Specialist here at twentysix. He mainly works with science and financial tech sector businesses, as well as regularly working with high-street eCommerce brands.

Share This: