xccl-ad-shield
A userscript that blocks ad popunders and forced ad redirects on xccl265.xyz (the destination of the xccl.link navigation site) search and torrent-detail pages. Works on both desktop and mobile browsers.
The Problem
- Click any search result on the site and, after a while, ad popunders start appearing.
- Worse — especially on mobile browsers — the entire page sometimes gets redirected to an ad landing page.
Reverse-Engineering Findings (2026-09, evidence in analysis/)
Ad chain
<!-- ADs --> block at the end of the page HTML (hardcoded, on search & detail pages)
├─ //indefinitelytonsil.com/3e/fa/a1/3efaa1….js ─┐ Monetag/PropellerAds-style
└─ //breastfeedingminutepond.com/28/9e/e2/289ee….js ┘ popunder (async, rotating domains)
│
├─ localStorage frequency capping / fingerprinting
├─ injects 1×1 hidden iframes to load further stages
├─ global click / mousedown listeners
├─ programmatic clicks on target=_blank anchors → popunder windows
└─ meta refresh / location redirects
→ kettledroopingcontinuation.com/dnn2hkn8?key=… (smartlink ad landing page)
Domain pool (all rotating)
| Domain |
Role |
indefinitelytonsil.com |
Stage-1 loader (hardcoded in pages) |
breastfeedingminutepond.com |
Stage-1 loader (hardcoded in pages) |
workdeadlinededicate.com / bakestubborn.com / portalfluently.com / mamshirt.com |
Fallback / rotation loaders |
kettledroopingcontinuation.com |
Redirect landing page (smartlink) |
protrafficinspector.com |
Traffic quality checker (anti-adblock / anti-bot) |
The site's legitimate dependencies (allowlisted for zero breakage)
- Third-party scripts in use: only
cdn.jsdelivr.net, www.googletagmanager.com, static.cloudflareinsights.com
- Cloudflare challenge scripts are same-origin (
/cdn-cgi/…)
- Legit off-site links:
magnet: URIs, mypikpak.com / keepshare.org download entries, social shares (QQ Qzone etc. via NativeShare.js, which navigates through location.href)
Script Design: Five Defense Layers
| Layer |
Mechanism |
Counters |
| L1 |
Resource loading block |
Third-party <script> / <iframe> governed by an allowlist — inherently immune to ad-domain rotation |
| L2 |
Navigation API hooks |
window.open / location.href / assign / replace / synthetic clicks / form.submit / string timers / eval / document.write / Service Worker registration / window.opener isolation |
| L3 |
MutationObserver sweep |
Scripts, iframes and meta-refresh tags injected after page load |
| L4 |
Self-learning blacklist |
Every blocked host is persisted (GM storage, falls back to localStorage); the filter gets sharper with use |
| L5 |
Escape hatch |
If the whole page has already been redirected to a known ad host: window.close() + history.back() to bounce back |
False-positive control: genuine user clicks (isTrusted=true) are never blocked, so in-site navigation, magnet links, download entries and social shares all keep working.
Installation
- Install Tampermonkey (Chrome: enable Developer mode in the extensions page)
- Create a new userscript, paste the full contents of
xccl-ad-shield.user.js, save
Mobile recommendations
| Browser |
Script manager |
| Firefox Android / Edge Canary (Android) |
Tampermonkey extension |
| Kiwi / Lemur (Android) |
Tampermonkey extension |
| Via browser (Android) |
Built-in "scripts" setting (no GM API — automatically falls back to localStorage; feature set essentially intact) |
| iOS Safari |
Userscripts / Stay |
I love Via browser, and its Build-in "scripts" manager is awesome, though not very powerful :-)
Verification
- Open any page on the site — a "🛡 净化已启用" badge should appear in the bottom-right corner (fades out after 5s; briefly shows "🛡 已拦截 N" whenever something is blocked)
- On mobile, the badge is the check — no DevTools needed
- No badge = the userscript is not running at all — see Mobile Troubleshooting below
- On desktop, the DevTools console should show:
[xccl净化] ⛔ MO:script → https://indefinitelytonsil.com/…
[xccl净化] ⛔ MO:script → https://breastfeedingminutepond.com/…
[xccl净化] 🛡 v1.1.0 已启用 — www.xccl265.xyz
- Stay on the page for a few minutes: no popunders, no bottom banners, no full-page redirects; magnet links, download entries and shares still work
Mobile Troubleshooting (important)
The site serves identical HTML to mobile and desktop (verified by fetching with a mobile UA) — the ads come from the same scripts. So if the script "does nothing" on a phone, it is almost always because it never ran, or ran too late:
- Check the badge: is "🛡" in the bottom-right corner? If not, the userscript is not executing — a browser/manager problem, not a script-logic problem
- Check the address bar domain: the site runs multiple rotating mirrors (2026-09:
xccl260~268.xyz all live; phones are often routed to a non-265 mirror). Since v1.3.0 the @include regex automatically covers "xccl + digits + any TLD" — no action needed. On older script versions a mirror domain outside @match means the script never runs at all (this is exactly why v1.1.0 and earlier "did nothing" on mobile)
- Browser / manager requirements:
- In-app browsers (WeChat / QQ / Quark / UC): no userscript support at all — use a real browser
- Kiwi / Edge Canary + Tampermonkey: enable Developer mode both on the Chrome extensions page and inside Tampermonkey settings (both are required under MV3)
- Firefox Android + Tampermonkey: best support, recommended
- Via: Settings → Scripts — make sure the script is enabled for the site
- If the script runs after the ad scripts have already executed, the v1.1.0 fallback sweep (immediate sweep at startup + every 1.5s for the first 45s) removes the injected ad nodes
Maintenance
- Mirror domain rotation (
xccl265 → xccl268 → …): the header @include regex /^https?:\/\/[^\/]*xccl\d+\.[a-z]{2,10}(:\d+)?\// automatically covers "xccl + digit number + any TLD", no code change needed; 9 explicit @match entries remain as a fallback for mobile script managers without @include regex support; only a completely different domain (without the xcclNNN pattern) needs a manual @match + NAV_HOSTS entry
- Ad domains rotate: no action needed by default (L1 allowlist + L4 learning cover it automatically); if a new redirect landing page shows up and you want L5 auto-bounce for it, add one
@match for that domain
- Troubleshooting false positives: check
[xccl净化] console logs for the blocked URL; if it belongs to a legit feature, add the domain to SCRIPT_ALLOW / SAFE_NAV
- Reset learned entries: Tampermonkey menu → "🧹 清空学习到的广告黑名单" (clear learned ad blacklist)
Layout
xccl-ad-shield.user.js — the userscriptanalysis/ — reverse-engineering evidence (page HTML snapshots, ad script samples)
