Can anyone link to your site using any anchor text they want? Of course
But the absolute biggest mistake I see is from people who are actively link building and tracking where they are located.
They start noticing links they didn’t build and get suspicious.
Ok, here’s the catch…the links they didn’t build are actually the natural ones and the ones they are building the risky ones.
They then *facepalm* disavow everything they didn’t build themselves.
So, regarding negative SEO
The cases I’m familiar with, both parties know and hate each other, major vendetta. Neither are innocent. Why else would someone go through the trouble?
But to dial it back a second, who really is most at risk?
A legitimate well established business with a normal link profile? No, not really.
The sites most at risk have been manipulating links already (usually too much so) so they are already guilty, but someone comes along with a link spam app and sends them a ton more. Harm? Perhaps, certainly could grab Google’s attention faster.
So, aiming for a natural organic link profile is the best defense. If you’re going to build links, be stealthy about it and please don’t use the same keyword anchor text 1,645 times!
I general, I would say the risk is very low for most sites. If you play in heavily spammy areas such as APKs, essay writing, movie/mp3 downloads, porn, drunk driving attorneys etc. you’re entering realms where you expect dirty play.
Please, don’t use disavow because some stupid tool said the link is toxic or DA0 or any other nonsense.
Summary, low almost non-existent risk for vast majority of sites.
Best defense, don’t due dumb* link building yourself.
* obvious link building = vast majority of links don’t contain nofollow, vast majority of links use exact match keyword anchor text (doesn’t happen in real life), vast majority of links are to interior pages, really low brow “article marketing” using the techniques above.
Spam links are NOT the problem, Google doesn’t care about them. Google cares about link manipulation.