In practice
Genuine cases are rare. Before concluding you are a target, rule out an algorithm update, a technical change and a lost redirect.
If it is real, document the pattern, monitor referring domains weekly, and use the disavow file with a written rationale.
Why it matters
Most sudden drops blamed on sabotage turn out to be self-inflicted, and chasing the wrong cause costs weeks.
Knowing what a real attack looks like keeps a team from disavowing links that were helping.
Related terms