A userscript that blocks ad popunders and forced ad redirects on xccl265.xyz (the destination of the xccl.link navigation site) search and torrent-detail pages. Works on both desktop and mobile browsers.
analysis/)<!-- ADs --> block at the end of the page HTML (hardcoded, on search & detail pages)
├─ //indefinitelytonsil.com/3e/fa/a1/3efaa1….js ─┐ Monetag/PropellerAds-style
└─ //breastfeedingminutepond.com/28/9e/e2/289ee….js ┘ popunder (async, rotating domains)
│
├─ localStorage frequency capping / fingerprinting
├─ injects 1×1 hidden iframes to load further stages
├─ global click / mousedown listeners
├─ programmatic clicks on target=_blank anchors → popunder windows
└─ meta refresh / location redirects
→ kettledroopingcontinuation.com/dnn2hkn8?key=… (smartlink ad landing page)
| Domain | Role |
|---|---|
indefinitelytonsil.com |
Stage-1 loader (hardcoded in pages) |
breastfeedingminutepond.com |
Stage-1 loader (hardcoded in pages) |
workdeadlinededicate.com / bakestubborn.com / portalfluently.com / mamshirt.com |
Fallback / rotation loaders |
kettledroopingcontinuation.com |
Redirect landing page (smartlink) |
protrafficinspector.com |
Traffic quality checker (anti-adblock / anti-bot) |
cdn.jsdelivr.net, www.googletagmanager.com, static.cloudflareinsights.com/cdn-cgi/…)magnet: URIs, mypikpak.com / keepshare.org download entries, social shares (QQ Qzone etc. via NativeShare.js, which navigates through location.href)| Layer | Mechanism | Counters |
|---|---|---|
| L1 | Resource loading block | Third-party <script> / <iframe> governed by an allowlist — inherently immune to ad-domain rotation |
| L2 | Navigation API hooks | window.open / location.href / assign / replace / synthetic clicks / form.submit / string timers / eval / document.write / Service Worker registration / window.opener isolation |
| L3 | MutationObserver sweep | Scripts, iframes and meta-refresh tags injected after page load |
| L4 | Self-learning blacklist | Every blocked host is persisted (GM storage, falls back to localStorage); the filter gets sharper with use |
| L5 | Escape hatch | If the whole page has already been redirected to a known ad host: window.close() + history.back() to bounce back |
False-positive control: genuine user clicks (isTrusted=true) are never blocked, so in-site navigation, magnet links, download entries and social shares all keep working.
xccl-ad-shield.user.js, save| Browser | Script manager |
|---|---|
| Firefox Android / Edge Canary (Android) | Tampermonkey extension |
| Kiwi / Lemur (Android) | Tampermonkey extension |
| Via browser (Android) | Built-in "scripts" setting (no GM API — automatically falls back to localStorage; feature set essentially intact) |
| iOS Safari | Userscripts / Stay |
I love Via browser, and its Build-in "scripts" manager is awesome, though not very powerful :-)
[xccl净化] ⛔ MO:script → https://indefinitelytonsil.com/…
[xccl净化] ⛔ MO:script → https://breastfeedingminutepond.com/…
[xccl净化] 🛡 v1.1.0 已启用 — www.xccl265.xyz
The site serves identical HTML to mobile and desktop (verified by fetching with a mobile UA) — the ads come from the same scripts. So if the script "does nothing" on a phone, it is almost always because it never ran, or ran too late:
xccl260~268.xyz all live; phones are often routed to a non-265 mirror). Since v1.3.0 the @include regex automatically covers "xccl + digits + any TLD" — no action needed. On older script versions a mirror domain outside @match means the script never runs at all (this is exactly why v1.1.0 and earlier "did nothing" on mobile)xccl265 → xccl268 → …): the header @include regex /^https?:\/\/[^\/]*xccl\d+\.[a-z]{2,10}(:\d+)?\// automatically covers "xccl + digit number + any TLD", no code change needed; 9 explicit @match entries remain as a fallback for mobile script managers without @include regex support; only a completely different domain (without the xcclNNN pattern) needs a manual @match + NAV_HOSTS entry@match for that domain[xccl净化] console logs for the blocked URL; if it belongs to a legit feature, add the domain to SCRIPT_ALLOW / SAFE_NAVxccl-ad-shield.user.js — the userscriptanalysis/ — reverse-engineering evidence (page HTML snapshots, ad script samples)