Theories about Fred and Phantom Have Been Discredited
All the theories about “Fred/Phantom” were wrong. This is a fact. Those were not updates at all and they had zero to do with finding “quality” issues with websites. This has been confirmed out of Google. What happened were run of the mill changes to the core algorithm, changes that happen on a near daily basis.
Difference Between Negative SEO, DDOS & Exploit Bots
What you’re describing is not negative SEO. It could be described as a DDOS attack but some or all of it is more likely a standard exploit hunt. That’s a bot testing for vulnerabilities in your server and CMS software as well as a password guessing attack. This is very common and happens to any site with even only a few inbound links. Many of these attacks originate in Eastern Europe and various countries in Asia.
Negative SEO is a practice that originated with the gambling industry in the mid 2000’s. Is your niche as competitive as the gambling niche? If so then it could be negative SEO. If your niche is not as competitive then the likelihood of negative SEO is infinitesimal.
In story writing, a red herring is a clue that appears to explain an event. Usually the clue points to an obvious suspect or reason. In life as in fiction, what is obvious is not always the true reason.
Your situation is a textbook example of latching on to invalid theories that once addressed do not solve the problem. You are likely looking at red herrings, especially with the now discredited Fred/Phantom “symptoms.”
The first invalid theory was the false Fred/Phantom issues which have been shown to be completely wrong. The second invalid theory was the notion that you’re under a negative SEO attack. “Fixing” both issues won’t solve your problems because they’re not the causes.
It’s possible your site is not suffering from those attacks. Check your Google Search Console for crawl errors. If you see those then it is possible that the exploit bots are indeed slowing down Google’s crawl. Rogue bots and Google routinely crawl in the early morning hours because the crawl impact is felt less at those hours.
The rogue bots are not coordinating to slow down your Google crawl, it’s just a coincidence. Crawls are more efficient when a site has less traffic, that’s why bots tend to crawl after midnight in whatever country the server is based.
Highly likely that addressing the false problems will not solve your ranking issue. The problem lies elsewhere. Find the real reason, look to other issues with the site. It could be software/coding technical. It could be you’re already hacked. It could be SEO. Those are the three major causes for a drop in ranking.