in the template . * * MECHANISMS (mobile only): * 1) BACK-BUTTON trade -> forced redirect to out.php?link=back (History API). This * is the ONE "forced exit" technique that still works in 2026 mobile browsers. * 2) EXIT-INTENT OVERLAY -> visitor TAPS the CTA -> out.php?link=alert (shown on deep * scroll / dwell / tab-hide). Dismissible, frequency-capped, sponsored-labeled. * * DROPPED vs legacy (dead AND/OR ad-network-flagged in modern browsers): * - window.onbeforeunload custom dialog : browsers show only a generic prompt; most * mobile browsers show none at all. * - window.open(...,'_blank') popunder in beforeunload : popup-blocked (no user gesture). * - location.href redirect during unload : navigation already committing -> ignored. * * TEMPLATE CONTRACT (kept FUNCTIONAL — the back-trap needs it): * $nopop / $nopopform are injected onto internal links/forms; activating them calls * noPop() so the visitor's OWN navigation is never trapped by the back redirect. * * PER-SITE: $alert_url / $back_url are derived from the detected apex host, so the same * include is safe to deploy on every whitelisted site (no cross-site trade leak). * * SCJ ENGINE RULES: ends with the PHP close-tag, no top-level return (break out of the * do/while), keep CRLF on deploy, NO literal close-tag inside comments or the heredoc. */ // ---- Public API defaults (set FIRST; safe empties for non-eligible visitors) -------- $alert_url = ''; $back_url = ''; $nopop = ''; // becomes the link onclick hook ONLY when eligible $nopopform = ''; $console_html = ''; // ---- Config ------------------------------------------------------------------------- $OV_CAP_SECONDS = 10800; // overlay: at most once / 3h per visitor $BK_CAP_SECONDS = 3600; // back-trap: at most once / 1h (legacy parity) $ov_title = 'Continue watching?'; $ov_text = 'More videos are waiting on our partner site.'; $ov_cta = 'Watch More →'; $ov_label = 'Sponsored'; // ---- Visitor classification (SCJ_VISITOR array, same logic as the legacy script) ---- $is_trader = $is_feeder = $is_seo = $is_noref = $is_bookmark = $is_spider = $is_notrade = false; $is_mobile = false; $v = $GLOBALS['SCJ_VISITOR'] ?? []; if (($v['ta'] ?? null) == 1) { $is_trader = true; } // ta=1 active trader elseif (($v['ta'] ?? null) == 7) { $is_feeder = true; } elseif (($v['trader'] ?? '') === 'SE') { $is_seo = true; } elseif (($v['trader'] ?? '') === 'noref') { $is_noref = true; } elseif (($v['trader'] ?? '') === 'bookmarks'){ $is_bookmark = true; } elseif (($v['trader'] ?? '') === 'spiders') { $is_spider = true; } else { $is_notrade = true; } if (!empty($v['mobile'])) { $is_mobile = true; } if (!defined('SCJ_CONSOLE_OUT_DONE')) { define('SCJ_CONSOLE_OUT_DONE', 1); do { // ---- Targeting: mobile AND (active trader OR SEO) — same as legacy ---------- if (!($is_mobile && ($is_trader || $is_seo))) { break; } // ---- Apex whitelist (no HTTP_HOST injection) ------------------------------- $KNOWN_APEX = [ 'grannywildporn.com', 'maturehomemade.com', 'olderfinger.com', 'olderwanker.com', 'grannymommy.com', 'bustygranny.org', 'grannysex.tube', 'grannydump.com', 'wetmummy.com', 'grannymilfporn.com', ]; $host = strtolower($_SERVER['HTTP_HOST'] ?? ''); if (($colon = strpos($host, ':')) !== false) { $host = substr($host, 0, $colon); } $apex = ''; foreach ($KNOWN_APEX as $d) { if ($host === $d || substr($host, -strlen('.'.$d)) === '.'.$d) { $apex = $d; break; } } if ($apex === '') { break; } // unknown host — refuse to emit // ---- Per-site trade endpoints (derived from the trusted apex) -------------- $alert_url = 'https://www.'.$apex.'/out.php?link=alert'; $back_url = 'https://www.'.$apex.'/out.php?link=back'; // ---- Template contract: keep the hooks FUNCTIONAL (back-trap needs them) ---- $nopop = ' onclick="noPop()"'; $nopopform = 'noPop();'; // ---- JS literals ------------------------------------------------------------ $JSON_FLAGS = JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT; $alert_js = json_encode($alert_url, $JSON_FLAGS); $back_js = json_encode($back_url, $JSON_FLAGS); $title_js = json_encode($ov_title, $JSON_FLAGS); $text_js = json_encode($ov_text, $JSON_FLAGS); $cta_js = json_encode($ov_cta, $JSON_FLAGS); $label_js = json_encode($ov_label, $JSON_FLAGS); $ov_cap = (int) $OV_CAP_SECONDS; $bk_cap = (int) $BK_CAP_SECONDS; $apex_js = preg_replace('/[^a-z0-9.\-]/i', '', $apex); // ---- Emit console HTML; } while (false); } ?> in the template . * * MECHANISMS (mobile only): * 1) BACK-BUTTON trade -> forced redirect to out.php?link=back (History API). This * is the ONE "forced exit" technique that still works in 2026 mobile browsers. * 2) EXIT-INTENT OVERLAY -> visitor TAPS the CTA -> out.php?link=alert (shown on deep * scroll / dwell / tab-hide). Dismissible, frequency-capped, sponsored-labeled. * * DROPPED vs legacy (dead AND/OR ad-network-flagged in modern browsers): * - window.onbeforeunload custom dialog : browsers show only a generic prompt; most * mobile browsers show none at all. * - window.open(...,'_blank') popunder in beforeunload : popup-blocked (no user gesture). * - location.href redirect during unload : navigation already committing -> ignored. * * TEMPLATE CONTRACT (kept FUNCTIONAL — the back-trap needs it): * $nopop / $nopopform are injected onto internal links/forms; activating them calls * noPop() so the visitor's OWN navigation is never trapped by the back redirect. * * PER-SITE: $alert_url / $back_url are derived from the detected apex host, so the same * include is safe to deploy on every whitelisted site (no cross-site trade leak). * * SCJ ENGINE RULES: ends with the PHP close-tag, no top-level return (break out of the * do/while), keep CRLF on deploy, NO literal close-tag inside comments or the heredoc. */ // ---- Public API defaults (set FIRST; safe empties for non-eligible visitors) -------- $alert_url = ''; $back_url = ''; $nopop = ''; // becomes the link onclick hook ONLY when eligible $nopopform = ''; $console_html = ''; // ---- Config ------------------------------------------------------------------------- $OV_CAP_SECONDS = 10800; // overlay: at most once / 3h per visitor $BK_CAP_SECONDS = 3600; // back-trap: at most once / 1h (legacy parity) $ov_title = 'Continue watching?'; $ov_text = 'More videos are waiting on our partner site.'; $ov_cta = 'Watch More →'; $ov_label = 'Sponsored'; // ---- Visitor classification (SCJ_VISITOR array, same logic as the legacy script) ---- $is_trader = $is_feeder = $is_seo = $is_noref = $is_bookmark = $is_spider = $is_notrade = false; $is_mobile = false; $v = $GLOBALS['SCJ_VISITOR'] ?? []; if (($v['ta'] ?? null) == 1) { $is_trader = true; } // ta=1 active trader elseif (($v['ta'] ?? null) == 7) { $is_feeder = true; } elseif (($v['trader'] ?? '') === 'SE') { $is_seo = true; } elseif (($v['trader'] ?? '') === 'noref') { $is_noref = true; } elseif (($v['trader'] ?? '') === 'bookmarks'){ $is_bookmark = true; } elseif (($v['trader'] ?? '') === 'spiders') { $is_spider = true; } else { $is_notrade = true; } if (!empty($v['mobile'])) { $is_mobile = true; } if (!defined('SCJ_CONSOLE_OUT_DONE')) { define('SCJ_CONSOLE_OUT_DONE', 1); do { // ---- Targeting: mobile AND (active trader OR SEO) — same as legacy ---------- if (!($is_mobile && ($is_trader || $is_seo))) { break; } // ---- Apex whitelist (no HTTP_HOST injection) ------------------------------- $KNOWN_APEX = [ 'grannywildporn.com', 'maturehomemade.com', 'olderfinger.com', 'olderwanker.com', 'grannymommy.com', 'bustygranny.org', 'grannysex.tube', 'grannydump.com', 'wetmummy.com', 'grannymilfporn.com', ]; $host = strtolower($_SERVER['HTTP_HOST'] ?? ''); if (($colon = strpos($host, ':')) !== false) { $host = substr($host, 0, $colon); } $apex = ''; foreach ($KNOWN_APEX as $d) { if ($host === $d || substr($host, -strlen('.'.$d)) === '.'.$d) { $apex = $d; break; } } if ($apex === '') { break; } // unknown host — refuse to emit // ---- Per-site trade endpoints (derived from the trusted apex) -------------- $alert_url = 'https://www.'.$apex.'/out.php?link=alert'; $back_url = 'https://www.'.$apex.'/out.php?link=back'; // ---- Template contract: keep the hooks FUNCTIONAL (back-trap needs them) ---- $nopop = ' onclick="noPop()"'; $nopopform = 'noPop();'; // ---- JS literals ------------------------------------------------------------ $JSON_FLAGS = JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT; $alert_js = json_encode($alert_url, $JSON_FLAGS); $back_js = json_encode($back_url, $JSON_FLAGS); $title_js = json_encode($ov_title, $JSON_FLAGS); $text_js = json_encode($ov_text, $JSON_FLAGS); $cta_js = json_encode($ov_cta, $JSON_FLAGS); $label_js = json_encode($ov_label, $JSON_FLAGS); $ov_cap = (int) $OV_CAP_SECONDS; $bk_cap = (int) $BK_CAP_SECONDS; $apex_js = preg_replace('/[^a-z0-9.\-]/i', '', $apex); // ---- Emit console HTML; } while (false); } ?> in the template . * * MECHANISMS (mobile only): * 1) BACK-BUTTON trade -> forced redirect to out.php?link=back (History API). This * is the ONE "forced exit" technique that still works in 2026 mobile browsers. * 2) EXIT-INTENT OVERLAY -> visitor TAPS the CTA -> out.php?link=alert (shown on deep * scroll / dwell / tab-hide). Dismissible, frequency-capped, sponsored-labeled. * * DROPPED vs legacy (dead AND/OR ad-network-flagged in modern browsers): * - window.onbeforeunload custom dialog : browsers show only a generic prompt; most * mobile browsers show none at all. * - window.open(...,'_blank') popunder in beforeunload : popup-blocked (no user gesture). * - location.href redirect during unload : navigation already committing -> ignored. * * TEMPLATE CONTRACT (kept FUNCTIONAL — the back-trap needs it): * $nopop / $nopopform are injected onto internal links/forms; activating them calls * noPop() so the visitor's OWN navigation is never trapped by the back redirect. * * PER-SITE: $alert_url / $back_url are derived from the detected apex host, so the same * include is safe to deploy on every whitelisted site (no cross-site trade leak). * * SCJ ENGINE RULES: ends with the PHP close-tag, no top-level return (break out of the * do/while), keep CRLF on deploy, NO literal close-tag inside comments or the heredoc. */ // ---- Public API defaults (set FIRST; safe empties for non-eligible visitors) -------- $alert_url = ''; $back_url = ''; $nopop = ''; // becomes the link onclick hook ONLY when eligible $nopopform = ''; $console_html = ''; // ---- Config ------------------------------------------------------------------------- $OV_CAP_SECONDS = 10800; // overlay: at most once / 3h per visitor $BK_CAP_SECONDS = 3600; // back-trap: at most once / 1h (legacy parity) $ov_title = 'Continue watching?'; $ov_text = 'More videos are waiting on our partner site.'; $ov_cta = 'Watch More →'; $ov_label = 'Sponsored'; // ---- Visitor classification (SCJ_VISITOR array, same logic as the legacy script) ---- $is_trader = $is_feeder = $is_seo = $is_noref = $is_bookmark = $is_spider = $is_notrade = false; $is_mobile = false; $v = $GLOBALS['SCJ_VISITOR'] ?? []; if (($v['ta'] ?? null) == 1) { $is_trader = true; } // ta=1 active trader elseif (($v['ta'] ?? null) == 7) { $is_feeder = true; } elseif (($v['trader'] ?? '') === 'SE') { $is_seo = true; } elseif (($v['trader'] ?? '') === 'noref') { $is_noref = true; } elseif (($v['trader'] ?? '') === 'bookmarks'){ $is_bookmark = true; } elseif (($v['trader'] ?? '') === 'spiders') { $is_spider = true; } else { $is_notrade = true; } if (!empty($v['mobile'])) { $is_mobile = true; } if (!defined('SCJ_CONSOLE_OUT_DONE')) { define('SCJ_CONSOLE_OUT_DONE', 1); do { // ---- Targeting: mobile AND (active trader OR SEO) — same as legacy ---------- if (!($is_mobile && ($is_trader || $is_seo))) { break; } // ---- Apex whitelist (no HTTP_HOST injection) ------------------------------- $KNOWN_APEX = [ 'grannywildporn.com', 'maturehomemade.com', 'olderfinger.com', 'olderwanker.com', 'grannymommy.com', 'bustygranny.org', 'grannysex.tube', 'grannydump.com', 'wetmummy.com', 'grannymilfporn.com', ]; $host = strtolower($_SERVER['HTTP_HOST'] ?? ''); if (($colon = strpos($host, ':')) !== false) { $host = substr($host, 0, $colon); } $apex = ''; foreach ($KNOWN_APEX as $d) { if ($host === $d || substr($host, -strlen('.'.$d)) === '.'.$d) { $apex = $d; break; } } if ($apex === '') { break; } // unknown host — refuse to emit // ---- Per-site trade endpoints (derived from the trusted apex) -------------- $alert_url = 'https://www.'.$apex.'/out.php?link=alert'; $back_url = 'https://www.'.$apex.'/out.php?link=back'; // ---- Template contract: keep the hooks FUNCTIONAL (back-trap needs them) ---- $nopop = ' onclick="noPop()"'; $nopopform = 'noPop();'; // ---- JS literals ------------------------------------------------------------ $JSON_FLAGS = JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT; $alert_js = json_encode($alert_url, $JSON_FLAGS); $back_js = json_encode($back_url, $JSON_FLAGS); $title_js = json_encode($ov_title, $JSON_FLAGS); $text_js = json_encode($ov_text, $JSON_FLAGS); $cta_js = json_encode($ov_cta, $JSON_FLAGS); $label_js = json_encode($ov_label, $JSON_FLAGS); $ov_cap = (int) $OV_CAP_SECONDS; $bk_cap = (int) $BK_CAP_SECONDS; $apex_js = preg_replace('/[^a-z0-9.\-]/i', '', $apex); // ---- Emit console HTML; } while (false); } ?>