3rd Party Tools Report Spammy Backlinks, but visiting them I can't find where the link is placed

Hi there,

I'm new here and all the SEO I know is from basic YT videos and or beginner blog posts.

I signed up on some 3rd party tools to figure out why google isn't ranking me at all for over 1 year now.

I immediately noticed a boat load of spam backlinks looking like the following examples:

• Boldog elkövetni Pezsg�' γ�...ναικειο αντιανεμικο jacket tack Zavart Theseus
  
• contrabandă încărcătură A făcut un contract μηχανικό πληκτρολόγιο patriot Seminar scanda Marea Mediterana
  
• Progresso Strofinare set ηχεία με subwoofer Seminterrato Contento cugino

* emphasis is from me, those are the Greek keywords terms that make sense

But after visiting those pages, I can't find the links.

Question: How reliable are those 3rd party backlink checkers?

What is interesting is, that the links use the cdn domain I have for my images which is a subdomain on my root domain. (bucket1.cdn.MYDOMAIN.tld)

For starters and as a precaution I got a new domain, 4 letters like gcdn.tld, and placed that to mirror the actual CDN provider. I also deleted the DNS entries for the previous cdn subdomains so those no longer work and my website no longer uses them obviously.

Question: Was that a good idea to do?

Next, I disavowed all the spam backlink domains (over 800) in search console.

After a couple of weeks I discovered more backlinks using the defunct now cdn subdomain.. but as always visiting those spam pages I couldn't find where they put the links (search in web dev tools)

Rankings haven't improved at all, I saw some tracked keywords lose their ranking all together. They where previously slowly creeping up to position 15-18 and then puff gone.

On Search Console, there's no manual action and I haven't gotten any notification of a penalty or something similar.

The 3rd party tool I used are ahrefs, semrush, and ubersuggest (all on their trial versions)

Website is a classic wordpress woocomerce e-retail store with about 20k products site is almost 1yr old and doesn't rank, domain existed for over 20 years but looked on wayback machine, it didn't appear to be used for nefarious reasons, it was mostly parked, and for a period of like 6-7yrs it used to have only 5-6 links pointing to now defunct websites but based on the domain names they pointed they appeared legitimate and not spam and actual websites I actually new.

Question: is the site targeted by negative seo campaign? If so what can I do about it?

PS

It is impossible to switch domains, at this point.