I cross-referenced the disavow file against the site's pre-drop link profile. Toxic and legitimate links can look similar in a raw export — similar anchor text patterns, similar domain types, similar acquisition timelines — so without a methodical pre/post comparison, good links easily get caught in the sweep. The over-disavowed legit domains were isolated and removed from the file; genuinely harmful domains stayed flagged. A concurrent crawl and indexing audit ran in parallel to rule out compounding technical issues (coverage gaps, canonicalization, crawl budget).