LinkCradle SEO spam kit
LinkCradle is an SEO-spam loader that extracts a remote link block and places it in a hidden container on the page. We have matched it on 205 sites since 8 October.
LinkCradle in numbers
Since 8 October, the first LinkCradle match in our records, counted on 12 November 2026. How we count.
| Sites with LinkCradle code | 205 |
|---|---|
| New sites in November so far | 37 |
| Sites captured since 25 September | 149 |
| Sites running WordPress (captured since 25 September) | 96% |
A remote response fills an off-screen container
LinkCradle's inline script creates a div with a generated ID beginning llc- and positions it far outside the viewport. A narrow width and overflow:hidden keep its contents out of the visible page. The script adds the container to the body, waiting for DOMContentLoaded when needed.
It then fetches hxxps://ferma[.]seo-solutions[.]eu[.]cc/get.php with host, page URI, content-type and bot parameters. The request uses cache:'no-store'.
The reply is read as text. LinkCradle extracts the content between <link> and </link>, removes every ### delimiter and assigns the result to the container's innerHTML.
Sites in our captures
Our first LinkCradle match was on 8 October. Among successful captures since 25 September, 143 of 149 LinkCradle sites ran WordPress.
Checking a page for hidden links
Compare the saved HTML with the rendered document and inspect requests made after the page loads. Look for:
- an
llc-container positioned off-screen withoverflow:hidden - a request to
ferma[.]seo-solutions[.]eu[.]cc/get.php - a parser extracting text between
<link>and</link> ###replacement followed by an assignment toinnerHTML
Remove the injected script from the template, theme, plugin or stored page that serves it. Restore changed files from trusted copies, review administrator and hosting access, rotate credentials and clear site and CDN caches. Check the logged-out page source and rendered document again.