xccl-ad-shield
English | 简体中文
A userscript that blocks ad popunders and forced ad redirects on xccl265.xyz (the destination of the xccl.link navigation site) search and torrent-detail pages. Works on both desktop and mobile browsers.
The Problem
- Click any search result on the site and, after a while, ad popunders start appearing.
- Worse — especially on mobile browsers — the entire page sometimes gets redirected to an ad landing page.
Reverse-Engineering Findings (2026-09, evidence in analysis/)
Ad chain
<!-- ADs --> block at the end of the page HTML (hardcoded, on search & detail pages)
├─ //indefinitelytonsil.com/3e/fa/a1/3efaa1….js ─┐ Monetag/PropellerAds-style
└─ //breastfeedingminutepond.com/28/9e/e2/289ee….js ┘ popunder (async, rotating domains)
│
├─ localStorage frequency capping / fingerprinting
├─ injects 1×1 hidden iframes to load further stages
├─ global click / mousedown listeners
├─ programmatic clicks on target=_blank anchors → popunder windows
└─ meta refresh / location redirects
→ kettledroopingcontinuation.com/dnn2hkn8?key=… (smartlink ad landing page)
Domain pool (all rotating)
| Domain |
Role |
indefinitelytonsil.com |
Stage-1 loader (hardcoded in pages) |
breastfeedingminutepond.com |
Stage-1 loader (hardcoded in pages) |
workdeadlinededicate.com / bakestubborn.com / portalfluently.com / mamshirt.com |
Fallback / rotation loaders |
kettledroopingcontinuation.com |
Redirect landing page (smartlink) |
protrafficinspector.com |
Traffic quality checker (anti-adblock / anti-bot) |
The site's legitimate dependencies (allowlisted for zero breakage)
- Third-party scripts in use: only
cdn.jsdelivr.net, www.googletagmanager.com, static.cloudflareinsights.com
- Cloudflare challenge scripts are same-origin (
/cdn-cgi/…)
- Legit off-site links:
magnet: URIs, mypikpak.com / keepshare.org download entries, social shares (QQ Qzone etc. via NativeShare.js, which navigates through location.href)
Script Design: Five Defense Layers
| Layer |
Mechanism |
Counters |
| L1 |
Resource loading block |
Third-party <script> / <iframe> governed by an allowlist — inherently immune to ad-domain rotation |
| L2 |
Navigation API hooks |
window.open / location.href / assign / replace / synthetic clicks / form.submit / string timers / eval / document.write / Service Worker registration / window.opener isolation. Since v2.0.0 also a Navigation API master gate: if the ad script executes before this userscript (Via injects late), it can save original function references and bypass every JS hook above (the observed "full-page redirect while scrolling down" took exactly that path) — but any in-page navigation fires the navigate event (scroll-triggered jumps, native anchor clicks, form submits), and preventDefault cuts it off |
| L3 |
MutationObserver sweep |
Scripts, iframes and meta-refresh tags injected after page load; plus a periodic geometric sweep that removes ad banner containers stuck at the viewport bottom (Monetag banners are created with opacity:0 and fade in once the creative loads — when the fetch is blocked the container stays invisible yet still overlays the bottom pager with a high z-index; removed since v1.4.0). Since v1.5.0 a pager unmasking pass makes zero assumptions about the blocker's shape: at every tappable point of the pager, elementFromPoint must return the pager itself — anything else stacked on top is peeled off layer by layer (runs on scroll-settle, periodic patrol, and the first tap that lands on a covered pager). Since v1.6.0 a bottom-zone purge removes "fence-shaped" leftover ad slots (a row of tiny rectangles — too small for width rules, possibly pointer-events:none so hit-testing can't see them either) using four independent signatures: intersecting the pager rect, off-site ad-domain anchors, failed off-site images, and no-src iframes in the band around the pager; long-press (or triple-tap) the pager for an on-page diagnostic dump. Since v1.8.0 ad anchors are also removed page-wide in real time by the MutationObserver, including same-origin redirect trampoline links (/go?u=https%3A%2F%2Fad… — passes a plain origin check). v1.9.0 fixed the root cause of "fence only disappears when you scroll to the very bottom": a document-bottom fence doesn't meet the viewport-bottom-pinned geometry until fully scrolled, and narrow fences slipped past the width gate — bottom-pinned strips now have no width/z-index/opacity gates, a new "textless fence container" signature (results/pager/footer all carry text; a strip of small boxes carries none) removes fences the moment they're visible, fixed/absolute containers are checked by the MO at insertion, and genuine clicks landing on invisible anchors (own or ancestral opacity < 0.15, shrunken below 8px, or off-viewport) are prevented |
| L4 |
Self-learning blacklist |
Every blocked host is persisted (GM storage, falls back to localStorage); the filter gets sharper with use |
| L5 |
Escape hatch |
If the whole page has already been redirected to a known ad host: window.close() + history.back() to bounce back |
False-positive control: genuine user clicks still work for in-site navigation, magnet links, download entries and social shares (SAFE_NAV allowlist). The one exception, since v1.7.0: clicks on off-site ad links are prevented — ads lay a row of tiny anchor rectangles near the pager, and a genuine click on one triggers native browser navigation that no JS hook can intercept. Since v2.3.0 an event firewall counters the obfuscated inline script that registers a touchstart/touchend/click triple on document and pops smartlink tabs through saved original function references (immune to every JS hook): the firewall swallows trusted touch/click events at the window capture layer (earlier than any document listener, capture or bubble) so the ad trigger never hears them, while re-dispatching a marked click clone to the element layer — site functionality and link default navigation are unaffected (verified by on-device A/B: injected page had zero document-level events, element layer intact; the non-injected page popped a tab the same minute).
Installation
- Install Tampermonkey (Chrome: enable Developer mode in the extensions page)
- Create a new userscript, paste the full contents of
xccl-ad-shield.user.js, save
Mobile recommendations
| Browser |
Script manager |
| Firefox Android / Edge Canary (Android) |
Tampermonkey extension |
| Kiwi / Lemur (Android) |
Tampermonkey extension |
| Via browser (Android) |
Built-in "scripts" setting (no GM API — automatically falls back to localStorage; feature set essentially intact) |
| iOS Safari |
Userscripts / Stay |
Verification
- Open any page on the site — a "🛡 净化已启用" badge should appear in the bottom-right corner (fades out after 5s; briefly shows "🛡 已拦截 N" whenever something is blocked)
- On mobile, the badge is the check — no DevTools needed
- No badge = the userscript is not running at all — see Mobile Troubleshooting below
- On desktop, the DevTools console should show:
[xccl净化] ⛔ MO:script → https://indefinitelytonsil.com/…
[xccl净化] ⛔ MO:script → https://breastfeedingminutepond.com/…
[xccl净化] 🛡 v1.1.0 已启用 — www.xccl265.xyz
- Stay on the page for a few minutes: no popunders, no bottom banners, no full-page redirects; magnet links, download entries and shares still work
- Go to page 2 of search results and scroll to the very bottom: the Previous/Next pager must be fully visible and tappable (v1.4.0 removed the transparent banner container; v1.5.0 peels off any element stacked on the pager via
elementFromPoint; v1.6.0 also purges fence-shaped tiny ad-slot leftovers). If anything remains: long-press (or triple-tap) the pager area — a diagnostic dialog lists every element covering the pager; screenshot it for feedback
Mobile Troubleshooting (important)
The site serves identical HTML to mobile and desktop (verified by fetching with a mobile UA) — the ads come from the same scripts. So if the script "does nothing" on a phone, it is almost always because it never ran, or ran too late:
- Check the badge: is "🛡" in the bottom-right corner? If not, the userscript is not executing — a browser/manager problem, not a script-logic problem
- Check the address bar domain: the site runs multiple rotating mirrors (2026-09:
xccl260~268.xyz all live; phones are often routed to a non-265 mirror). Since v1.3.0 the @include regex automatically covers "xccl + digits + any TLD" — no action needed. On older script versions a mirror domain outside @match means the script never runs at all (this is exactly why v1.1.0 and earlier "did nothing" on mobile)
- Browser / manager requirements:
- In-app browsers (WeChat / QQ / Quark / UC): no userscript support at all — use a real browser
- Kiwi / Edge Canary + Tampermonkey: enable Developer mode both on the Chrome extensions page and inside Tampermonkey settings (both are required under MV3)
- Firefox Android + Tampermonkey: best support, recommended
- Via: Settings → Scripts — make sure the script is enabled for the site
- If the script runs after the ad scripts have already executed, the fallback sweep removes the injected ad nodes (immediate sweep at startup + full sweep every 1.5s for the first 45s; afterwards a low-frequency patrol every 3s keeps pulling late/re-mounted Monetag banner containers)
Maintenance
- Mirror domain rotation (
xccl265 → xccl268 → …): the header @include regex /^https?:\/\/[^\/]*xccl\d+\.[a-z]{2,10}(:\d+)?\// automatically covers "xccl + digit number + any TLD", no code change needed; 9 explicit @match entries remain as a fallback for mobile script managers without @include regex support; only a completely different domain (without the xcclNNN pattern) needs a manual @match + NAV_HOSTS entry
- Ad domains rotate: no action needed by default (L1 allowlist + L4 learning cover it automatically); if a new redirect landing page shows up and you want L5 auto-bounce for it, add one
@match for that domain
- Troubleshooting false positives: check
[xccl净化] console logs for the blocked URL; if it belongs to a legit feature, add the domain to SCRIPT_ALLOW / SAFE_NAV
- Reset learned entries: Tampermonkey menu → "🧹 清空学习到的广告黑名单" (clear learned ad blacklist)
Layout
xccl-ad-shield.user.js — the userscriptanalysis/ — reverse-engineering evidence (page HTML snapshots, ad script samples)
