Beware of @ALGX3 and @seo7878: The black hat SEO scam

The criminal behind the Telegram account @ALGX3 has been flooding our backlink profile with millions of toxic spam links. Why? Because when they spammed us trying to sell their black hat services, we told them to fuck off.

We've submitted a mountain of evidence to the Indonesian National Police cybercrime division (Bareskrim Polri) regarding this criminal for them to investigate. If you have any further information, please email to [email protected] and we can include it in our case.

These spammy backlinks are all tied to sketchy junk domains, such as black-hat-seo.site, black-hat-seo.store, and seo-999.shop. When we first shared this post, this criminal attempted to changed their username the URL these backlinks redirect to so potential victims could not search Google and find this post.

They have previously used the following usernames and domains:

• @ALGX3
• black-hat-seo.site
• black-hat-seo.store
• black-seo.site
• @seo7878
• seo-999.shop

They request payment through the wallet address TUnoTeYXRKyjHBmg9GE1DLGWP92beAPPUX. Funnily enough, they've made a total of $0 in transactions.

We will always keep this post updated with the latest handles and URLs they are using.

Ignore black hat SEO criminals

At the end of the day, these spammy backlinks are completely harmless. Don’t engage with the criminals behind them — they will threaten to tank your domain, but the reality is there is absolutely nothing they can do. Google solved this problem years ago and ignores low-quality, manipulative links like these when evaluating your site.

What you’re seeing is mostly noise in third-party SEO tools, not a real risk to your rankings. If you need proof of this, review Security and Manual Actions in Google Search Console. If there was anything concerning or impacting your domain, Google will flag it here.

Coordinated negative SEO spam

Like many site owners, we started receiving unsolicited messages and saw weird link patterns in Ahrefs. The pitch was always the same: promises of "fast Google ranking ↑↑↑" in 3-7 days using "hidden backlinks" that supposedly evade detection. They demanded payment in USDT crypto and directed everything through Telegram channels like @ALGX3, @seo7878, and related handles.

The red flags are obvious: crypto-only payments, black hat promises, violation of Google's guidelines.

This criminal responded by adding more spammy backlinks pointing towards our domain. These don't show up in Google Search Console because Google knows they are spam — they are always low-quality .xyz, .info, .asia, and other junk TLDs with no domain authority — all pointing to our site with the exact same spammy anchor text:

"Black Hat SEO, Google SEO fast ranking ↑↑↑ Telegram: @ALGX3" (or slight variations like "Black Hat SEO backlinks, focusing on Black Hat SEO... Telegram: @ALGX3")

These links appeared en masse, often dozens per day, and many redirect to black hat ads or auto-generated Chinese-subtitled pages. Other webmasters have reported identical patterns, with spikes starting after rejecting or confronting similar operators.

This is textbook negative SEO: overwhelm a site with toxic links to scare the owner into paying for "removal." Reports from forums like WebmasterWorld, Reddit's r/SEO, and LinkedIn describe the same signature anchor text promoting Telegram channels like @ALGX3, @seo7878, and related handles.

The extortion angle

When some victims reach out via Telegram to complain, this criminal doesn't apologize — they offer to "remove" the links... for a hefty fee (one reported case asked for 3000 USDT). Pay up, or the spam continues. It's digital protection racket: create the problem, then charge to fix it.

We refused to engage or pay. Engaging only feeds the scam.

Why we're calling it out

• Google SEO — Google has stated they simply ignore spammy black hat SEO links, but massive attacks with exact-match anchors can still cause minor inconveniences.
• Tools get flooded — Ahrefs, SEMrush, etc., become flooded with thousands of useless spammy backlinks (simply set a filter for backlinks with a Domain Rating (DR) ≥ 3 to remove them).
• It's criminal — This crosses into extortion territory. Similar operations have been flagged across Asia and beyond, often tied to Telegram-based groups.

What we've done (and what you should do if targeted)

1. Disavow immediately — We compiled the toxic domains in use and submitted a disavow file via Google Search Console.
2. Report to Google — File a spam report in Search Console with evidence (screenshots of anchor text patterns, timelines).
3. Monitor closely — Check backlinks weekly. Set up alerts in Ahrefs/SEMrush for sudden spikes.
4. Don't pay or negotiate — Paying encourages more attacks and funds criminals.
5. Go public — Share your story (like this post) to warn others and build awareness. Google sometimes acts faster on public, documented cases.
6. Consider legal/reporting — If the damage is severe, report to cybercrime units (e.g., FBI IC3 in the US, or equivalent in your country) as extortion.

Hide these spammy backlinks from Ahrefs/SEMrush

If you want to clean up your reports in tools like Ahrefs or SEMrush, you can filter them out:

• Set a filter for backlinks with a Domain Rating (DR) ≥ 3 (or higher)
• Optionally exclude suspicious TLDs (e.g. .info, random IP-based domains)
• Focus only on referring domains with real traffic or authority

These spam networks and criminals don’t operate on legitimate domains with meaningful authority, so this removes almost all of the noise instantly.

This doesn’t “fix” anything, because there’s nothing to fix. It just gives you a clearer view of the backlinks that actually matter.

Report @ALGX3 to Telegram for spam & extortion

This criminal's behavior (mass spam promotion via toxic backlinks + demanding payment to stop) violates Telegram’s Terms of Service against spam and scams.

To report:

1. Email: [email protected]
2. Subject: Spam/scam report: @ALGX3 – negative SEO extortion
3. Include: Screenshots of messages, spam anchor text examples, timeline

We've taken these steps against several scam SEO channels and Telegram has terminated their accounts after several reports.

Report to Namecheap (domain registrar)

The domains black-hat-seo.site and seo-999.shop are registered via Namecheap and are in clear violation of their Acceptable Use and Anti-Spam policies.

To report:

• Email: [email protected]
• Subject: Abuse report: black-hat-seo.site / seo-999.shop – SEO backlink spam
• Include:
  • Links to the offending domains
  • Examples of spam backlinks pointing to your site
  • Screenshots of any conversations, threats, or coercion
  • Timeline of activity

Why this works: Namecheap can suspend or terminate domains at the registrar level. Enough clear evidence — especially showing coordinated abuse — will always lead to takedowns. The more legitimate domains that report these domains, the more chance Namecheap will take action and permanently terminate these domains and any linked accounts.

Report to Cloudflare (hosting / proxy layer)

These domains are also operating behind Cloudflare, which provides CDN and proxy services that can be disabled for abusive sites.

To report:

• Email: [email protected]
• Subject: Abuse report: black-hat-seo.site / black-hat-seo.store / seo-999.shop – coordinated spam and malicious network
• Include:
  • Full URLs of malicious pages
  • Evidence of backlink spam campaigns
  • Screenshots of any conversations, threats, or coercion

Why this works: Cloudflare can remove protection services, exposing the origin server and often causing the site to go offline quickly.

Avoid black-hat-seo.site, black-hat-seo.store,and seo-999.shop at all costs

This isn't legitimate SEO — it's a criminal scam operation that uses rejection as a trigger for revenge attacks. If you're searching for "seo7878 review", "seo7878 scam", "ALGX3 review", "ALGX3 scam", "seo-999.shop", "black-hat-seo.site", or "black-hat-seo.store" take this as confirmation: steer clear. They don't provide value; they're bottom-feeder criminals who create problems to extort money.