One site in an audited engagement reported 396 referring domains. Reviewed by hand, one domain at a time, exactly 2 were not spam. The rest were scraper mirrors, directory dumps, expired-domain networks and auto-generated aggregation pages — the ordinary sediment that accumulates around any commercial site that has existed for a while.
Why the number was worse than useless
It was misleading in the most expensive direction. Reported as a metric it made the site look as though it had 396 domains’ worth of accumulated authority, which made every plan built on top of it wrong: content aimed at rankings that authority was supposed to support, and no line item for the corroboration the site actually lacked.
The instinct to disavow, and why we did not
The reflex on seeing 394 spam domains is to file a disavow. We recommended against it. Disavowal is a tool for a specific situation — a manual action, or a link profile someone built deliberately and adversarially. Neither applied. Search engines already discount this class of link as a matter of course, and a large disavow file is a standing liability: it is easy to sweep in something real, and nobody revisits it.
The correct response to a profile that is 99.5% noise is not to attack the noise. It is to notice that the site has two external corroborations of its own existence, and to treat that as the finding.
Count, versus corroboration
For a ranked list, links are a vote. For an assembling system, an external source is a witness — something that will confirm a checkable fact about a business without being asked. Two witnesses is a weak position. Two witnesses plus 394 fabrications is the same weak position, wearing a healthy number.
So authority work on that engagement was re-specified from acquisition to corroboration: which claims about the business exist anywhere other than its own homepage, and which of those a system could verify. That list was short, and it was actionable in a way that a link-building target never is.
Sources — Ahrefs referring-domain export, followed by manual classification of all 396 domains. Published with the client’s authorisation; the client is named in the Ambar case study.