"How I Beat a 16-Click Anti-Bot Ad Trap"

🎯 I Got Tired of Closing Popups. So I Reverse-Engineered the Entire Ad Stack.

We’ve all been there.
You open a streaming site.

You click play.

💥 A new tab appears.

You close it. Click again.

💥 Another popup.

Some sites are so aggressive that watching a single episode feels like defusing a bomb through 16 consecutive popups while trying not to accidentally download malware from 2007.

Most people tolerate it.
I couldn’t.

As a developer, the moment software starts fighting the user this aggressively, it stops being an inconvenience and becomes a challenge.
So I decided to break it.

---

🧪 Phase 1 — The “This Should Work” Delusion

My first thought was simple:
Override window.open.

window.open = () => null;

Done. Right?
Nope.
The site completely ignored it.
That’s when I realized this wasn’t normal popup logic anymore.
This was engineered hostility.

👻 Phase 2 — Chasing Invisible Click Traps

I opened DevTools and started tracing the DOM during every interaction.
Something strange kept happening.
Inside the video player container, the final

kept rapidly changing after every click.
Then it clicked.
The site was dynamically generating transparent overlay layers directly above the player.
The actual video button wasn’t receiving my clicks.
The invisible overlay was.
Every physical mouse interaction got hijacked by a temporary fullscreen layer designed to trigger an ad redirect using a trusted human click.
The sequence looked something like this:

````md id="7w0thx"

mermaid
flowchart LR
    A["🖱️ Physical Click"] --> B["🎭 Transparent Overlay Layer"]
    B --> C["🚨 Popup / Redirect Triggered"]
    C --> D["🗑️ Overlay Destroyed"]
    D --> E["⚡ New Overlay Injected"]
    E --> B

plaintext

Ridiculously clever.
Because technically I initiated the click, the browser trusted the action.
So I escalated.

⚔️ Phase 3 — Fighting Back With a Chrome Extension

javascript
I built a Chrome extension using a MutationObserver to detect and surgically remove the overlay layers in realtime.

const observer = new MutationObserver(() => {
    document.querySelectorAll('.suspicious-overlay')
        .forEach(el => el.remove());
});

observer.observe(document.body, {
    childList: true,
    subtree: true
});

For a brief moment…
…it worked.
Then the site hit back.

🤖 The Moment I Realized I Was Fighting an Anti-Bot System

Buried deep inside the bundled scripts was an aggressive anti-fraud service called Adscore.

The behavior suddenly changed:

🧹 Console logs started disappearing
🔄 The player entered infinite click loops
🕵️ Hardware fingerprinting routines activated
🎮 WebGL context checks triggered
📏 Screen dimension math got evaluated
🧠 Browser behavior started getting profiled

The site wasn’t just showing ads anymore.
It was actively detecting interference.
And then I realized my mistake:

I was still fighting inside the webpage sandbox.

That was their territory.

🧠 Phase 4 — Stop Fighting the UI. Attack the Network.

If the frontend is weaponized…
…you stop fighting visuals.
You cut the supply lines.
Instead of targeting the popup elements themselves, I started tracing the network behavior behind them.
During tiny windows before the console got wiped, I managed to capture the redirect domains responsible for the popup chains.
That changed everything.
Because once you identify the routing infrastructure the illusion collapses.

🔥 The Final Architecture

I rebuilt the extension entirely around Chrome’s native browser APIs:

1. declarativeNetRequest
2. tabs
3. background service workers

No more DOM fighting.
No more chasing invisible overlays.
No more playing inside their sandbox.
The browser itself would now intercept requests before the scripts could fully execute.

📦 manifest.json

json
{
  "manifest_version": 3,
  "name": "Native Ad Network Guard",
  "version": "1.0",
  "description": "Drops ad-network connections and instantly auto-closes leaked popups.",
  "permissions": [
    "declarativeNetRequest",
    "tabs"
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "background": {
    "service_worker": "background.js"
  }
}

⚡ background.js

javascript
const BLOCKED_DOMAINS = [
    "xadsmart.com",
    "adsco.re"
];

// 1. Network-Level Block
const rules = BLOCKED_DOMAINS.map((domain, index) => ({
    id: index + 1,
    priority: 1,
    action: { type: 'block' },
    condition: {
        urlFilter: domain,
        resourceTypes: [
            'main_frame',
            'sub_frame',
            'script',
            'xmlhttprequest'
        ]
    }
}));

chrome.runtime.onInstalled.addListener(() => {
    chrome.declarativeNetRequest.updateDynamicRules({
        removeRuleIds: rules.map(r => r.id),
        addRules: rules
    });
});

// 2. Instant-Kill Safety Net
chrome.tabs.onUpdated.addListener((tabId, changeInfo) => {
    if (changeInfo.url) {

        const url = changeInfo.url.toLowerCase();

        const shouldKill =
            BLOCKED_DOMAINS.some(domain => url.includes(domain)) ||
            url.includes('zoneid=') ||
            url.includes('afu.php');

        if (shouldKill) {
            chrome.tabs.remove(tabId);
        }
    }
});

🚀 The Result

The transformation was surreal.
The site still attempts the same aggressive click-hijacking flow.
Invisible overlays still spawn.
Scripts still try redirect chains.
But now?

💀 The tabs die instantly.

No chaos.
No cleanup.
No losing immersion every five seconds.
Just a silent war happening underneath the browser while the video plays normally.

🧩 What This Actually Taught Me

The interesting part wasn’t blocking ads.

It was understanding how modern websites are willing to weaponize the browser itself:

• Event hijacking
• Trusted-click exploitation
• Fingerprinting
• Anti-debugging
• Console wiping
• Behavioral analysis
• Redirect chaining
• Dynamic overlay injection

👨‍💻 Final Thought

This entire project started because I got annoyed clicking “Close Tab” fifteen times.
It ended with me reverse-engineering popup infrastructure, anti-bot systems, and browser-level request interception pipelines.
And honestly?
That escalation path perfectly summarizes what I enjoy most about software engineering.

Tinkering.

And refusing to accept that a system is “unbeatable.”