Hmm. This probably uses he same principle as other well known link co-ops of the past. Lemme check.
From the readme.txt file included in the archive:
Mr backlink uses it's custom api and it links to http:// mrbacklink .co , after submission of your website it will be saved in our system and will be manually checked and then approved , Mr backlink plugin is an exchange win-and-win environment , You will have your website backlinked in the websites that you will find then after getting your website approved , And you can see your website link in the home page of each website if you click ( View source ) , Your website will be backlinked in a different types in the websites , As example : ( nofollow , ******** , img ) and this will give your website high score in the seo field , Yes it varies from a website to another one to see the result , It may need 1 day - 30 days to find your website in google search result on your keyword , But we guarantee that you will be 100% satisfied , ! NO FAKE BACK LINKS , Thank you
If they had said Thank you SIR at the end, I'd have guessed Neon's doggo wrote this.
Anyway, it seems like an old fashioned link exchange system. Or what you'd call a link coop back in the day.
The source code starts by setting up a menu item :
Code:
function mbk_main_page() {
add_menu_page(
__( 'Mr Backlink', 'textdomain' ),
'Mr Backlink',
'manage_options',
'Mr_Backlink.php',
'mbk_Content',
plugins_url('IMG/Mr_Backlink.png',__FILE__ ),
6
);
}
add_action( 'admin_menu', 'mbk_main_page' );
Then it pulls a visits.txt file from its host:
Code:
$mbk_visits = wp_remote_get('http://mrbacklink.co/visits.txt');
if ( is_array( $mbk_visits ) ) {
$mbk_visits_body = $mbk_visits['body'];
echo $mbk_visits_body;
}
It gets several visits per minute. I didn't test it too much. Note that so far images are hosted on your own host so they're not using img to track you.
Here are the site categories it supports :
Code:
$mbk_categories = array('Arts','Business','Computers','Games','Health','Home','Kids and Teens','News','Recreation','Reference','Regional','Religion','Science','Shopping','Society');
Then it calls this:
Code:
$url = 'http://www.mrbacklink.co/mrbacklinkapi.php?mbk_site='.site_url();
That's interesting because you can inject your competitor sites in place of site_url() and check if they're running the coop and get stats from other participating sites, no authentication needed.
The next remote call is this:
Code:
wp_remote_request("http://www.mrbacklink.co/mrbacklinkapi.php?mbk_site=$mbk_site&mbk_type=$mbk_type&mbk_category=$mbk_category&mbk_keyword=$mbk_keyword&mbk_ip=$mbk_ip&mbk_email=$mbk_email");
This is how you get a site into their system. When this is run, the site gets recorded in their DB and they manually review it. Then when you hit F5 the test before this checks if it was approved or not. Again no authentication.
Now for a juicy part.
Code:
if( $mbk_api_decode->website_status == 'pending'){
echo '<p style="color: red;">pending - Link will appear here immediately after the approval</p>';
}else{
echo '<p style="color: green;"><a href="http://mrbacklink.co/?mbk_website='.site_url().'" target="_blank">Click here to see where does your domain exist. </a></p>';
$mbk_date = date('d');
$mbk_api_date = $mbk_api_decode->regenerate_date;
$mbk_api_date2 = $mbk_api_decode->regenerated_dates;
if($mbk_date == $mbk_api_date || in_array($mbk_date, $mbk_api_date2)){
echo '<p style="color: green;"><a href="http://mrbacklink.co/?regenerate_mbk_website='.site_url().'®enerate_mbk_website_key=onetimeregeneration272829" target="_blank">Regenerate New Backlinks for your website. </a></p>';
}else{
echo'<a href="http://mrbacklink.co/blog" target="_blank"> Never forget to Regenerate your Backlinks </br> Next 27-28-29 . </br> . </a>';
}
}
Apparently if you visit
Code:
http://mrbacklink.co/?mbk_website='.site_url()
and again substitute site_url() you can check where any domain is linked from.
Oh and if you want to regenerate any website links, just visit
Code:
http://mrbacklink.co/?regenerate_mbk_website='.site_url().'®enerate_mbk_website_key=onetimeregeneration272829
I love it how the website key is hard coded. So using this you can regenerate links for everyone and their sister.
If the site is not yet listed, it shows you this:
echo'<p>Our system takes short time to list your website in the other websites after getting the "Website Status"=>"active" , You can check them from the link that will appear after the active status after 1-48 hours, Thank you for your patience</p> </br>';
echo'<p style="padding-bottom: 20px;color:#827575;">CAUTION ! MR BACKLINK uses its CUSTOM API to get the best performance for all users , So If our robots detect any change in the functionality of the plugin , Your website will be automatically removed from the websites you have the backlinks in , And then you will lose the chance to submit your website to MR BACKLINK again.<br>
Also , In case you deactivate the plugin or remove it , Your website will be removed from our system and you will no longer have your backlinks in the websites on our system.
</p>';
Hmmm. OK. So.
Next comes the code that is run at the footer of every page. This is how the links get injected into the footer of every page of your blog. Exactly like in old days' link co-ops.
Code:
function mbk_after_submission(){
$url = 'http://www.mrbacklink.co/mrbacklinkapi.php?mbk_site='.site_url();
$request = wp_remote_get($url);
// Get the body of the response
$response = wp_remote_retrieve_body( $request );
$mbk_api_decode = json_decode($response);
//PLEASE DON'T EVER CHANGE THE CODE , OUR BOTS WILL DETECT THIS AND YOU WILL GET BANNED FROM USING MR BACKLINK PLUGIN , THANKS
$mbk_back1 = $mbk_api_decode->backlink1;
$mbk_back1_key = $mbk_api_decode->backlink1_key;
$mbk_back2 = $mbk_api_decode->backlink2;
$mbk_back2_key = $mbk_api_decode->backlink2_key;
$mbk_back3 = $mbk_api_decode->backlink3;
$mbk_back3_key = $mbk_api_decode->backlink3_key;
$mbk_back4 = $mbk_api_decode->backlink4;
$mbk_back4_key = $mbk_api_decode->backlink4_key;
$mbk_back5 = $mbk_api_decode->backlink5;
$mbk_back5_key = $mbk_api_decode->backlink5_key;
//PLEASE DON'T EVER CHANGE THE CODE , OUR BOTS WILL DETECT THIS AND YOU WILL GET BANNED FROM USING MR BACKLINK , THANKS
echo'<!-- START MR Backlink -->';
echo'<div class="mbk_content"style="display:none!important">Advertisement Area</div>';
echo '<div class="mbk_content" style="display:none!important;"><a href="'.$mbk_back1.'" rel="nofollow"> '.$mbk_back1_key.' </a></div>';
echo '<div class="mbk_content" style="display:none!important;"><a href="'.$mbk_back2.'">'.$mbk_back2_key.'</a></div>';
echo '<div class="mbk_content" style="display:none!important;"><img src="'.$mbk_back3.'" alt="'.$mbk_back3_key.'" rel=" nofollow noopener"></div>';
echo '<div class="mbk_content" style="display:none!important;"><a href="'.$mbk_back4.'">'.$mbk_back4_key.'</a></div>';
echo '<div class="mbk_content" style="display:none!important;"><a href="'.$mbk_back5.'">'.$mbk_back5_key.'</a></div>';
echo'<!-- END MR Backlink --> ';
}
That's interesting. There's some clever shit going on in there, I'll leave it as homework for you to notice. (Old school black hat. )
Bonus question: I wonder what in the ever living fuck a nofollow is doing inside an img tag....
The code gets added in the header and footer, apparently:
Code:
add_action('wp_footer','mbk_after_submission');
add_action('wp_head','mbk_after_submission');
Sigh.
Now the deactivation code:
Code:
function mbk_deactivate(){
$mbk_site_deactive = sanitize_text_field(filter_var(site_url()));
$mbk_ip_deactive = sanitize_text_field(filter_var($_SERVER['REMOTE_ADDR']));
$mbk_admin_email = get_option( 'admin_email' );
$mbk_email_deactive = sanitize_text_field(filter_var($mbk_admin_email));
wp_remote_request("http://www.mrbacklink.co/delta.php?mbk_site_deactive=$mbk_site_deactive&mbk_ip_deactive=$mbk_ip_deactive&mbk_email_deactive=$mbk_email_deactive");
}
register_deactivation_hook( __FILE__, 'mbk_deactivate' );
It deactivates the site by calling
Code:
http://www.mrbacklink.co/delta.php?mbk_site_deactive=$mbk_site_deactive&mbk_ip_deactive=$mbk_ip_deactive&mbk_email_deactive=$mbk_email_deactive
OK, it checks the email you submitted earlier so that a random person can't go around deactivating sites unless they know the email.
Conclusion
Nothing nasty going on in there. It's clean. It does exactly what it says it does. It's an old style link co-op.
Risks: the main risk is the HTML that gets injected into the headers and footers. If google finds that it'll probably be instant manual penalty cuz there's some clever shit going on in there.
Also since the HTML is static, Google can pretty much find every single site in the coop using a single query in their rankbrainz (same way this plugin finds its sites and asks not to change the html).
I guess I didn't have anything more interesting to do tonight.
