End-to-end outreach workflow
Table of Contents
- Studying scammy and black hat tactics is one of the best ways to understand how platforms actually work.
- If you’re not actively occupying the online spaces relevant to your brand — especially Reddit — someone else will.
- Since the Helpful Content Update, content quality is what burns domains, not links.
- The expired domain redirect tactic and other black hat link building strategies from 2012 are largely back and working again.
- Link building alone can’t save a domain that’s already in decline.
- Link building can’t build a site from scratch — it only works as a final push once the foundation of content and entity signals is already solid.
Lars Lofgren is an enterprise SEO consultant who has made a habit of pulling back the curtain on the darker corners of the internet.
I know him as the guy who helped expose the Forbes Advisor site reputation abuse scandal.
He’s been tracking everything from Highland cow scams on TikTok to coordinated competitor attacks on Reddit that cost one company an estimated 40% of its revenue.
In this podcast, we talk about scams and spam in dark corners of SEO and what it all means for link builders and marketers like you.
Here’s a slightly edited transcript:
Can you tell us about the Highland cow scam?
Lars Lofgren: This is a scam. This one’s a straight-up scam.
Yeah, this one’s an interesting one. So there’s this viral product — there’s a couple versions of it going around. But if you hear the term “weighted Highland cow,” you’re automatically intrigued, right? You’re like, how could I not want this?
This sounds amazing.
And they are indeed amazing. So there’s a few companies making these things, and they go viral, they go out of stock constantly. And the way a lot of these things get sold these days is through these creator ads — legitimate creator ads.
There’s this giant creator ecosystem. These folks are kind of just doing TikTok infomercials, if we’re being honest.
I’m not here to talk shit about them — that’s fine, a lot of people find the content interesting, it’s all above board.
It’s real creators selling real products to real audiences. That ecosystem is real, it exists, it’s a thing.
The problem is, with these products — especially with the price point a little bit higher and them selling out all the time — people can’t find the real products.
There’s demand that is not being met, which is a perfect opportunity for someone to come in and exploit it. And these scammers — I’ve got to hand it to them, it’s actually really creative what they’re doing.
They don’t even need to create AI ads. There’s just an easier way. They find all these legitimate creator videos and just steal them. You don’t need to create an ad from scratch, you don’t need AI — you just copy and paste it.
So they take these legitimate creator videos, steal them, run them on their own accounts, and because it’s a real person it feels very authentic. You’re scrolling through TikTok or Instagram and it stops the scroll.
You’re like, wow, that’s a cool little cow, I want to buy that.
But you don’t realize it’s an ad because it just blends into everything else. And it’s going to a fake website that’s been stood up just to take your money.
I figured this out because I actually went through this — I bought one of these. I was trying to buy a gift for my partner because she saw the ad and sent it to me.
She got duped, I got duped.
Usually I’m paranoid around this stuff and this one got me, which is how I know it’s good. I bought one and it was set up on Shopify, it looked legitimate.
But the first flag was when I went through checkout, clicked purchase, and the order confirmation was completely blank — it had the default Shopify message in it.
I was like, I’ve seen that before.
It’s been like 10 years since I set up a Shopify account, but I remember that template. They’re not even bothering to fill it out. I knew instantly I’d just gotten scammed.
I did get a cow eventually. If everybody wants to see what I actually got, it’s in my blog post — just search “Lars Highland cow.”
Vince Nero: It’s a sad, sad cow. It looks like a dog toy.
Lars Lofgren: Yeah, even that’s a little generous. I’ve definitely bought nicer dog toys for my dog. Every time I show the photo to people they just lose it.
So they’re running all their own paid budget through Facebook and TikTok, but they’re not selling any actual products. Their margin is incredible — they can throw all their money straight into ads, outbid everyone, flood the networks with paid ads.
They’re not paying the creators because they stole the ad.
The cost of the cows is probably like 50 cents. It’s just pure profit, whatever they can get after ad spend.
And it’s a churn-and-burn process. Once I get a clearly fake cow and I’m irate, my first reaction is to go to my credit card company and do a chargeback — which I did, and I got my money back.
And obviously I’m not going to be the only one.
People start leaving reviews.
The Trustpilot scores are atrocious for these sites, and they’re not even trying to manage the reputation because they’ll run these things for about three to five months.
They slow-roll the delivery to buy more time to rack up as many customers as they can, and then the shitty cows start arriving, the chargebacks come in, the reviews pile up, and the brand starts to sink.
If you get too many chargebacks you can burn your merchant accounts — Shopify will eventually figure out what you’re doing.
So you can’t run the same scam on the same batch of accounts for too long. You’ve got to rotate.
That’s exactly what they did. I was in the middle of researching this and they shut down the brand and website I got scammed on, moved everything to a new brand and new website, and they’ve been rotating through a few of these.
I assume they’re just going to keep going until someone figures out something.
Facebook doesn’t give a shit — they just let them run as many as they want.
So be careful what you buy on Instagram, especially if it’s cute and adorable. Definitely do some fact-checking.
How does it help us as marketers to understand the dark side of marketing?
Lars Lofgren: I’ll give you two answers. The first answer is selfish — I just like this stuff.
I find the dark, sketchy areas of humanity interesting. But the real practical answer is that most of my work and career has been on the white hat side of marketing and SEO — trying to do good content, real genuine organic growth, playing above board, doing things the right way.
I think that’s the best long-term approach and I wouldn’t talk anybody out of it.
But within the legitimate side of the industry, there’s a lot of bullshit. Everybody’s having arguments about tactical nonsense that doesn’t mean anything.
I like to get into the opposite side of the spectrum and learn about it — not just because I’m interested, but because if you can unpack how people are really manipulating these different platforms, whether to scam money or build fake brands from scratch, it’s much easier to see what’s actually going on and what tactics are working.
These sketchy brands don’t have any of the normal brand noise.
If you and I had a deep dive discussion about why HubSpot is currently ranking for something, we’d just be guessing — there’s so much noise, it’s so big.
But when you find a sketchy scammy brand that’s only doing two or three things and making a bunch of money, now you can see how the platform actually works. You can see the levers.
So from the Highland cow thing, if I was running an e-commerce business, I’d take away a few things.
One, I’d tap into that creator ecosystem — especially if I’m selling consumer goods, they’re pushing a lot of product. If I don’t have a legitimate TikTok influencer program already running, I should probably go figure that out right now.
I should also get control of my inventory.
If I’m selling a hit consumer product that’s constantly selling out, I have to manage that, because if I run out, someone else is going to steal that sale.
And it’s not just a lost sale — if a scammer captures that demand, I get all these second order effects. People are getting confused, blaming the real Highland cow companies, coming in on their support tickets, leaving reviews on their pages saying “I got scammed” — when they got scammed by a completely different company.
There’s all this confusion that impacts the real brand.
And then I’d also ask: what am I doing to play defense?
I’d probably want a big FAQ on my website that says, hey, these scams exist, be careful, if you got scammed here’s what to do, here’s proof that we’re the real company. How many photos and videos can we put on the site to make that clear?
What about the Codesmith Reddit moderator controversy?
Lars Lofgren: Yeah, it’s a perfect PR case study.
So Codesmith is a coding bootcamp — in my opinion a pretty legitimate one, but that’s for you to decide. They’ve been around forever and have a pretty good reputation in the space.
Not perfect, no one’s perfect, but they’re one of the front runners.
Over the last couple of years, a competitor — I’m not going to name them, but if you want the details just search “Lars Codesmith” — became a moderator of the subreddit for that industry.
A very active community, a subreddit that was blessed by Google and ranking for basically everything. Is that a conflict of interest? I think so. I think it’s a pretty big conflict of interest.
And this person did not just stop there. They went on a multi-year, vindictive campaign against Codesmith. They attacked them relentlessly.
They made loose associations to Codesmith being a sex cult — just completely unhinged stuff. They started doxxing employees.
Endless amounts of horrible stuff, way beyond the pale. And the thing you need to remember about a Reddit moderator is there’s really no recourse. Once someone becomes a Reddit moderator, they’re cemented in that position.
The only ways to get a moderator kicked out are if more senior mods in the subreddit remove them, or if they did something so severe that Reddit’s actual admin employees get involved.
But the threshold for that is basically a full-blown crisis.
So if a moderator is doing something shady, there’s almost nothing you can do about it.
This moderator was attacking Codesmith relentlessly over multiple years, and it was impacting them in a really big way. The estimates I got from the founder and current CEO were roughly a 40% hit on revenue — millions of dollars.
And you could see the impact on the first page of the branded SERP.
Search “Codesmith” and all these Reddit threads would come up with horrible quotes being surfaced. Google was just picking all of it up and not validating any of it.
The other thing that was happening is that Reddit is in this really unique situation right now where it influences not just its own communities, but Google and all the LLMs.
So if you get the Reddit dataset skewed in one direction, you hit Reddit, you hit Google, you hit Perplexity, you hit Gemini, you hit ChatGPT — you hit everything.
It’s like a fulcrum for the internet right now. And the moderator doing all this negative stuff was starting to skew ChatGPT responses pretty negatively when you asked about the brand.
I did a bunch of prompting over a long period of time and every time I’d end up getting this negative response — controversy about Codesmith, all this negative feedback, actual quotes being pulled in from different Reddit threads.
Vince Nero: But it was all coming from this moderator’s comments.
Lars Lofgren: Yeah, or from the same community.
When you’re a moderator you have a bunch of different options.
You can post really negative stuff yourself and no one can do anything about it because you’re a moderator, but you can also do subtle things to skew the narrative.
If someone comes into your community and posts something really negative, you can make sure it gets plenty of attention — start engaging with it, give it that extra push.
You could do something really sketchy like farm fake upvotes yourself, but even just engaging authentically you can amplify it. Everyone does this stuff on LinkedIn and social channels all the time — you like your CEO’s posts to give them a little extra push.
Well, a moderator can do that constantly, and over enough time it builds up.
The other thing you can do is deliberately not promote other stuff.
And if you want to be aggressive about it, if a student who had a positive experience with Codesmith comes in and posts a great review, you can dive into their profile history and say it looks like a new account, it looks suspicious.
Regardless of whether or not it’s a real review, you’ve now seeded that doubt. You’re chipping away at anything genuine.
There are lots of really subtle things you can do to tip the scales in one direction — and unless you start looking at the entire history of it, you’d never piece it together.
No one really did.
This was a multi-year campaign, about two years that I tracked, though he was a moderator for around three years and posts go back even further.
Is Reddit doing anything about this?
Lars Lofgren: No, Reddit mostly doesn’t do shit. You have to keep the different players in the Reddit ecosystem straight.
The vast majority of moderators are not Reddit employees — they’re just unpaid random people.
In the past they were managing communities because they were genuinely interested in that subject matter.
But managing a popular community is a ton of work. Reddit was built under this ethos that moderators can never be compensated, which is good in theory, but it creates perverse incentives.
Some moderators will still live up to the ideal and try to manage their community the right way and fight all the stuff that’s happening — what we call Reddit astroturfing, where you’re trying to get your product plugged when people are asking questions, or if you want to be shady, you’re attacking competitors to create negative sentiment.
That’s rampant, it’s everywhere.
But you also have a big chunk of moderators who are not being paid, probably have full-time jobs, families, other stuff going on. Moderating an active subreddit is a thankless job that, if you’re doing it right, pays you nothing.
They’re going to get tired and miss things.
They might catch some of the big stuff, but a lot will sneak through.
And then on the other end of the spectrum you have moderators who are deliberately doing sketchy things. I’ve found affiliate scams running through Reddit where the moderators were definitely involved.
There are all sorts of stories about people buying off moderators under the radar to let astroturfing posts stay live and keep those accounts active.
There’s a lot of sketchy stuff happening on Reddit, and you’ve got to be really careful about which communities you choose to follow.
Vince Nero: Yeah. I think we’ve also seen Google starting to throttle down the amount of Reddit they’re showing. I feel like I saw that in one of the most recent Google updates — people saying Reddit isn’t showing up as much.
Lars Lofgren: It was down a little bit.
But this has happened a couple of times — visibility drops a little bit and then comes shooting back up.
I haven’t checked it most recently, but as of right now my sense is Reddit is still the king. Reddit is everywhere.
Vince Nero: Which is wild. And it’s another reason why, when you’re thinking about PR, you have to consider reputation management as a big piece of the puzzle when building a brand.
Lars Lofgren: Yeah, and the Codesmith thing isn’t the only one. I’m not going to name the company, but I chatted with the head of marketing at a publicly traded company.
There’s a very, very popular subreddit — if I said it, everybody in this audience would instantly recognize it.
So this isn’t some fringe thing, this is big B2C. But I can’t name the category without giving it away.
They highly suspected one of their primary competitors was doing really shady, aggressive Reddit astroturfing to attack their brand, and they showed me examples. I was like, yeah, I think you’re right.
But unlike the Codesmith case, there was no paper trail. The company potentially doing this was being way more disciplined. They had the reins on the campaign — just chipping away here and there.
If you looked at all of it together you’d instantly think something’s going on, but you’d have to look at all of it. They were covering their tracks well enough that I couldn’t connect any accounts to each other.
I’m pretty certain something’s happening, but I can’t prove it, so I can’t turn it into a story.
They were being clean enough that they’re probably operating through some shady agency somewhere.
So if you’re not keeping up — same as the Highland cow thing, if you let enough air into the room, someone else will breathe it.
On Reddit, if you’re not in there taking up that real estate yourself, even authentically, someone else is going to come in.
And in today’s online marketing ecosystem, you’re basically praying they don’t do sketchy stuff, which is not a great bet. There’s way more shady stuff than good stuff out there.
You have to be really proactive, otherwise someone can start to gain a foothold.
Vince Nero: Yeah, great advice. I’m seeing a lot of this in the PR space in the UK with fake experts popping up too. The industries have a way of self-correcting, but I want to briefly touch on another big one that I think Google did ultimately fix — the site reputation abuse and Forbes Marketplace situation.
Can you tell us about the Forbes Marketplace site reputation abuse?
Lars Lofgren: So this was during the era where Forbes was ranking for everything.
People were regularly complaining about it, and it was starting to break through to non-SEO circles — why is Forbes everywhere? And I think it’s fair to say that regardless of what the intent was when they started, it had turned into basically a content mill.
One of the states of Google at the moment is that if you get flagged as a newspaper, none of the normal SEO rules apply. It’s not just Forbes — it’s every newspaper.
And a lot of black hat SEOs know this.
If you’re trying to exploit and abuse a site, you want to get access to one that’s been flagged as a newspaper and is showing up in Google News, because then you get carte blanche.
Endless amounts of content, duplicate content doesn’t matter, everything gets indexed instantly. It’s amazing if you can find it.
Forbes was getting aggressive with their content, and they were also doing parasite SEO with CNN — running a section of CNN Underscored, which is CNN’s Wirecutter copycat — and they also had a site on USA Today.
I detailed who was doing it and how it was working — ranking for CBD gummies, all sorts of insane stuff on a business site.
It was a perfect example of where the algorithm had given this complete carte blanche to newspapers.
Every site can do wrong, right? You need to be skeptical of every site to some degree, because even if they’re not doing wrong today, if they start winning without putting in any effort, they’re going to become a content mill.
That’s true for everybody. Google kind of blesses you and you stop working for it, and you start assuming your shitty work is what Google wants, so you do more of it. Good intentions can easily slide into content mill territory.
I posted all this stuff about Forbes, it went viral, and did a follow-up post on the CNN Underscored and USA Today stuff that also went viral and became a huge thing in the SEO community.
A few months after that, Google’s spam team decided to crack down. They did manual actions on a bunch of parasite SEO sites — Forbes wasn’t the only one, there’s a whole industry doing this.
Different subfolders got completely nuked. Forbes was able to get their manual action removed and came back.
But has the underlying algorithmic situation changed?
I don’t think so. Parasite SEO is 100% still a thing. Everyone is still doing it.
What are some of the darker SEO and link building tactics you’re seeing?
Lars Lofgren: A lot of the black hat stuff that was popular in 2012 is all back.
My theory: these big tech companies have gotten so big, and all the OG people who built them made enormous amounts of money on stock options and retired.
If you were in their position, you’d go hiking or paddle boarding and spend time with your kids — you’re not going to keep fighting to keep the internet from consuming itself.
So there’s been a big change of the guard across tech.
Now if you work at a big tech company, you’re not really concerned about how good the work is for the most part.
The company is so big that even if you want to do the right thing, what are you going to do?
You’re just trying not to get fired, and there are layoffs every three months anyway.
Everyone’s trying to get through the next round, avoid toxic coworkers, keep their bosses happy.
Everyone is more concerned with how things look on paper than what’s actually happening.
That’s why most big tech apps are just kind of trash now. It’s the enshittification of the internet, and it’s happening across the board.
So when you ask if the Google algorithm is actually moving forward — no.
The people who got it to a really good place left, and the people there now are in a very different environment. Even if they wanted to improve the algorithm, their hands are often tied, their scope is small.
I’m not blaming anyone working on this stuff — I’d probably be in the same situation, just keeping my head down letting my stock vest. But for the first time in my career I’m genuinely not sure the algorithm is going to get better. We’re seeing things that were solved problems just come back.
An easy example: expired domains.
Early in my career this was a big thing.
You go find domains where the registration has lapsed, look for ones with a good link profile, and then redirect that domain to whatever you’re trying to rank. This is blatantly obvious.
I’ll occasionally look at an affiliate site that’s ranking really well today and look through their link profile and find an expired domain redirect — including domains that had an old link from the New York Times about some study that is completely irrelevant to their category, and they’ve just pointed that link to their biggest money page.
That should not work.
But a lot of people are doing exactly that, and there’s a whole specialty built around it.
A lot of that old school stuff is working really well again.
What about paid links?
Lars Lofgren: Everyone defines it differently. Every black hat considers themselves a gray hat, and black hat is just the one step beyond what they’d be willing to do.
When I was building my affiliate company, we were 100% organic SEO — that’s all we did.
And during that period the thing I was always extremely paranoid about was links. I never paid for a link. We built a lot of links — guest posting, outreach — but by hand, through hook or by crook. This was post-Penguin and Panda.
We had rules: never more than one link from each domain, because we knew Google was going after that stuff.
We needed the links, we were playing in a hyper competitive space, but we were never going to pay for them, and everything we did to get links we were hyper vigilant about.
What we weren’t vigilant about was content.
Our core content we made sure was good enough.
But on any site that’s been around for a long time, there’s all this cruft — horrible content that’s been completely neglected, long tail stuff that Google figured out doesn’t matter, hasn’t been updated in 10 years.
The old content pruning playbook was simple: keep content as long as it has traffic or links, forward the rest and move on.
But for a blog that’s been worked on for 15 years, you’ve got a bunch of random links to horrible content, and in the past you’d just leave it — it has links, it has some value, it’s helping the domain.
So we were ultra paranoid about links and not nearly paranoid enough about content.
Then the HCU shift flipped that equation for me.
Now content is what burns domains. If you have that long tail content, if you’ve done too much SEO-focused content even in a white hat, legitimate way, that can sink a domain.
And links — I’m not doing any link building right now, but if I was, I’d be way less paranoid about it. I’m not telling anybody to go pay for a bunch of links — I still wouldn’t do risky stuff — but the ultra-paranoia I used to have around any kind of link building has gone way down.
I’m now crazy paranoid about content on a site. If a site has gotten built out too much and things got really messy over a decade, and Google looks at it and it’s just all trash content, it’s like trying to swim with cinder blocks on your feet. It just doesn’t work.
So you’ve got to delete that stuff.
And in the past you could do a quick content prune of 20-30% of a site and get a nice lift within a few months.
That doesn’t happen anymore.
If you want to change the trajectory of a site now, you’ve got to delete like 90% of the content — obscene levels of cleanup.
And on the same token, you have to look at your brand or entity across all the other channels, because Google’s looking at all of that now.
It plays a much bigger role in how domains are ranked. You can’t just look at the domain — you’ve got to look at the entity, the brand itself, the paper trail for that entity across the entire web. Brand mentions, how that’s all mapped, building that up if it’s weak.
It’s become a much more dynamic game.
And as Google has gone through this shift and pushed the algorithm into a new world, previous loopholes that were closed have opened back up again — which is why a lot of these link building tactics are back.
I definitely don’t recommend people do them, but I know a lot of people doing them very successfully.
Vince Nero: Yeah, I’d add a caveat there. I do think Google is getting better at discounting spammy links rather than penalizing for them. And it’s really hard to pinpoint the impact of one singular link — very rarely is someone going to say “I spent $500 on this one link and saw this one keyword go up.”
You typically get 10 or 100 links and maybe one or two in there are super relevant, in a good spot on the site, getting real engagement.
But it’s hard to distinguish that at scale.
I still think it’s a quality versus quantity game now, which is part of why digital PR is having a renaissance — links from real editorial sites with real traffic are still moving the needle.
I just wouldn’t want people to hear “less paranoid about links” and go buy a thousand of them.
So should people go out and buy thousands of links?
Lars Lofgren: I would never recommend anybody do that. There’s a ton of nuance. Even though you can be way sloppier with links today than in the past, and there are more avenues for link building and less need to be ultra paranoid — that era is over.
But there’s a flip side.
In the previous era, link building really was a cheat code.
If you had a reasonably strong domain somewhat connected to the space you were going after and you went all in on link building, you could win. That’s pretty much all you needed, as long as your content was good enough.
I know people in the affiliate space who built entire companies around massive link building operations — dozens and dozens of people, big operations, all they did was link building. It worked.
Now, while there are more cracks in how you can build links, it’s not the same sledgehammer it used to be.
If things get out of balance — if you’re doing a bunch of link building without building out the entity across all the other marketing and social channels — that link building will not do anything for you.
I had a site — a big site, a decent brand, some people in this audience might even know it — that got hit by the HCU.
The decline took about two years to go from the top to absolutely crushed. And while we were going through that decline, I did an enormous amount of link building trying to save it. Didn’t do a thing.
Absolutely nothing. So once you hit a tipping point on a domain, link building can’t save you. And if you’re building from scratch, you can’t just do link building — you’ve got to do other stuff first.
It’s more that once you’ve built the foundation, once Google already trusts you and you’ve passed all those bars, then you do that last link building push to get to the top.
And you can be sloppier with that last little push than I would have been in the past.
But I’d still be at least somewhat paranoid about it because these things are always moving targets.
Google’s execution is shittier than it’s ever been and I’m not optimistic about them improving everything, but there’s always a chance some amazing mid-level manager somewhere fights through every internal barrier and solves one little corner of the spam problem.
So I’d still be careful. If you’re at an agency with big clients and you’re on the hook if something collapses, play it safer.
If it’s your own business and you want to swing, that’s a different risk profile — just know what game you’re playing.
Check out the BuzzStream Podcast
