LinkHiding SEO spam kit
LinkHiding is a WordPress SEO-spam backdoor with an Ethereum-backed controller address. We have matched it on 3 sites since 28 September.
LinkHiding in numbers
Since 28 September, the first LinkHiding match in our records, counted on 12 October 2026. How we count.
| Sites with LinkHiding code | 3 |
|---|---|
| Sites with a match in the last 30 days | 3 |
| New sites in September | 3 |
| Sites running WordPress (captured since 25 September) | 100% |
The backdoor loads before the page
LinkHiding is our name for a PHP backdoor planted before a WordPress site's normal HTML. The retained copies carried the same code block. It stands down during WP-CLI, cron, AJAX, REST and administrator requests, then attaches its changes to public page hooks.
The code gives its remote server several controls. A /links?site= request can return ordinary link rows, homepage links, a canonical URL for the current path and a path-specific redirect. A separate /active-slugs?site= response lists search-spam paths to maintain. For one of those paths, /page?site=...&path=... can supply the status and HTML for a generated page, replace existing content or append to it.
Link insertion is reserved for Googlebot. The backdoor adds a collapsed More section with the supplied links in the footer and can add a second set on the homepage. Canonical tags, redirects and remotely supplied pages are handled through separate WordPress hooks.
Ethereum is a controller failover
LinkHiding starts with a controller domain embedded in the PHP and stores the active value in a WordPress transient named _dm. It sends short HTTP requests to that controller and tracks failures in _fc. After five failures, it calls an Ethereum mainnet contract with selector 0x3fa4f245, rotating among public RPC services with _ri, and decodes a replacement domain from the result.
The remote data is cached at different speeds: link instructions for 10 minutes, active slugs for an hour and generated pages for two days. Those intervals let the operator change links quickly while keeping whole spam pages available through short outages.
What we see
| Month | New sites |
|---|---|
| September | 3 |
| October so far | 0 |
WordPress runs on 100% of captured sites.
Finding LinkHiding in WordPress
Search loaded PHP, themes, plugins and must-use plugins for the marker v82L4MZsM3tIW0wK, functions that use _dm, _fc and _ri, selector 0x3fa4f245, or requests ending in /links?site=, /active-slugs?site= and /page?site=. Review code that adds footer links only for Googlebot, path-specific canonical tags, redirects, or content on a 404 response.
Remove the injected PHP and replace the affected component with a trusted copy. Clear the _dm, _fc, _ri, link, slug and generated-page transients so cached instructions cannot continue changing output.