Let me tell you my observations on the Belloo engine. I was arguing a couple of pages ago about the problem of automatic crediting. I solved this problem, and to a person who looked like ukgamer (at least he called himself that way) on his test site, I eliminated this problem. After that, he started having problems with viruses (as he said and disappeared). So what I think. The nulled version has no built-in vulnerabilities (virus code). The file connect.php has nothing to do with it. The loophole is organized in a different way. Used "Marijuana". As I understand it, when installing the script, the author receives a notification about a new site, since he specially made it so that the engine "pulls" resources from the parent site and of course the author can see it. After that, the author can access the site (with the help of "Marijuana" which I have already mentioned). I also "covered" this vulnerability. Advice to lovers of nulled versions may be a recommendation to "bite out" from the engine all calls to the parent site. True, after that, fakes will not work for you. License holders do not need to be afraid. But also an interesting observation. One of my clients used nulled for a couple of days, and then bought a license. But the author had already "attacked" his site (gained access) and it took the client a couple of days to find out the relationship with the author. A sign of the author's access to the site (in addition to brakes and glitches) is the appearance of a user without a name, address, age (a dot can be used).
But I didn't come for that (I just read the latest posts and got carried away. I have language sets for Belloo: Russian, German, Spanish and Portuguese. I'm looking for French and Italian.