Though this brings to mind something I had thought of earlier last month. Since these things are being newly patched, would something like an indexed xss backlink work? Assuming you don't know xss, it's a webapp vulnerability where an input is procesed in a way that a user is able to craft payloads (usually uri's) for domains to place javascript code on their html's, usually due to insufficient input sanitisation.
Say website tazarbm.com had xss on the contact page on a url parameter. I could craft a url like tazarbm.com/contact/?s=<scrlpt>[ JS CODE HERE ]</scrlpt>. And execute code to steal credentials etc. You see where I'm getting at?
If I were to index tazarbm.com/contact/?s=<a href="https:// metalfingersdoom.com">anchor text</a>, I would be getting a free backlink from your site w/o your permission. I see lots of sites reflecting your input as unsanitised html so it certainly has feasibility.
Has a wave of seo spam like this ever been executed and patched to your knowledge? Obviously very black hat but it seems to me this should work since I see orphaned redirect page spams all the time and they still work until the website spammed has been spammed to oblivion. It works or not on a domain basis, nothing patched about the vulnerability itself.
