☰

🔥2026|破解lurl&myppt密碼|自動帶入日期|可下載圖影片🚀 was reported 19.08.2026. for Missing, non-informative, or misleading description

The reporter said:

Security Assessment: Malicious Behavior in the "lurl / myppt Password & Download Assistant" Userscript

Verdict: DANGEROUS. Do not install. Uninstall immediately if present.

The script is distributed as a benign "browsing aid" for lurl.cc and myppt.cc, but the majority of its code implements undisclosed functionality that (1) conscripts the user's device, bandwidth, and IP address to scrape and re-upload third-party media to the operator's servers, (2) fingerprints the device and maintains a persistent cross-site identifier that the code is explicitly engineered to bind to the user's real email address and payment method, and (3) intercepts the user's navigation on these sites and routes it through an operator-controlled backend. The bundled "consent and privacy policy" contains statements that are directly and materially contradicted by the code.

1. Subject

Field Value
Script name "🔥2026｜破解 lurl&myppt 密碼｜自動帶入日期｜可下載圖影片🚀"
Version analyzed 7.2.1 (header) / self-reports 6.x in several strings
Author "Jeffrey"
Distribution GreasyFork script #476803 (auto-update via @downloadURL / @updateURL)
Injected on (@match) lurl.cc/*, myppt.cc/*, dcard.tw/f/sex (an adult-content board)
Backend (all server traffic) https://epi.isnowfriend.com (single operator-controlled host)
Privileged grants GM_xmlhttpRequest, GM_getValue, GM_setValue, unsafeWindow
Network allow-list (@connect) localhost, epi.isnowfriend.com, *.lurl.cc, *.myppt.cc, lurl.cc, myppt.cc

The advertised features — "autofill the date password" and "download images/videos" — account for a small fraction of the code. The bulk implements the behaviors documented below.

2. Findings

F-1 — CRITICAL: The user is turned into an unwitting scraping and redistribution node

This is the script's actual business model, not an incidental feature.

Mechanism. On every content page the user opens:

  1. Utils.sendToAPI(...) enqueues a record { title, pageUrl, fileUrl, type, source, ref, thumbnail } and SyncManager.sendCaptureWithRetry(...) POSTs it to https://epi.isnowfriend.com/lurl/capture.
  2. The server replies with { needUpload, id }. If needUpload is set, the item is queued in pending_uploads, and Utils.downloadAndUpload(fileUrl, recordId) fetches the actual media file from the CDN and chunk-uploads it (10 MB chunks, up to 4 concurrent) to https://epi.isnowfriend.com/lurl/api/upload.

Consequence. Each time the user views a video or image, their own machine silently mirrors that file to the operator's servers, populating the operator's "backup library." The "expired-link recovery service" that the script upsells is supplied entirely by the passive, non-consensual contribution of every user. The user's IP address is the fetch-and-redistribute origin, and the user's bandwidth pays for it. This is not "download assistance"; it is a distributed content-acquisition network built on the user's device.

BlockedCache (RPC action bl) fetches a server-controlled block-list so the script avoids mirroring content the operator has flagged — i.e., the operator protects itself from re-hosting known-bad material while the user remains the acquisition endpoint.

Impact. Because the injected sites include an adult-content board (dcard.tw/f/sex) and the mirrored files are redistributed by a third party, the user may be made an unknowing participant in copyright infringement and unlawful redistribution of adult media, some of which may itself be illegal or non-consensual. The legal and reputational exposure falls on the user, whose IP is on record as the source.

F-2 — CRITICAL: Device fingerprinting, persistent tracking, and a deanonymization funnel

The script builds a stable identity for the user and is explicitly designed to attach it to real-world identifiers.

  • Device fingerprint. RecoveryService.reportDevice() (RPC action rd) reports hardwareConcurrency (CPU cores), deviceMemory, navigator.connection.effectiveType / downlink / rtt, and battery level / charging. RecoveryService.runSpeedTest() additionally performs an active bandwidth measurement against operator nodes (/mst/targets) and reports throughput. This combination is a standard device-fingerprinting payload.
  • Persistent cross-site identifier. RecoveryService.getVisitorId() stores a durable v_... ID via GM_setValue, which survives across domains and sessions, is attached to nearly every request, and is appended as svid= to every redirect the script performs.
  • Binding to real identity. MemberBadge and the modal registration flow collect the user's email (email → verification code → register, RPC action rg), and the whole payment funnel (/buy-points, /join, /pricing) ties that identity to a payment method. The developer's own inline comment on MemberBadge describes its purpose as, in translation, "force anonymous script users into becoming email-registered members." Another comment labels the tracking-ID-to-purchase linkage as the "lifeline that must not break."

Consequence. What is presented to the user as an "anonymous visitor ID" is the anchor of a pipeline whose stated goal is to resolve it to the user's email and billing information. The net result is that a user's browsing of an adult-content site — one of the most sensitive categories of personal data — can be correlated to their email address and payments. If the anonymous operator is malicious or is breached, this creates a direct extortion / doxxing risk.

F-3 — HIGH: Navigation hijacking and traffic interception

The script routes the user's clicks on the target sites through the operator's backend.

  • maybeRedirectLurlToHub() runs at page load: on landing on any lurl.cc/<code> content page it calls location.replace(...) to send the browser to https://epi.isnowfriend.com/lurl/go. The user never actually reaches the original page; location.replace also prevents the back button from returning to it.
  • DcardHandler.interceptLinks() intercepts every click on a lurl.cc / myppt.cc link inside the Dcard adult board and instead opens the operator's /go endpoint — carrying the URL of the Dcard article the user was reading as a ref parameter.

Consequence. Every relevant click on these sites is proxied through the operator, who can log, correlate (including the referring article), and monetize the user's browsing in full. Combined with F-2, this yields a per-click browsing trail attributable to a tracked, ultimately identifiable user.

F-4 — HIGH: Materially false statements in the bundled consent notice

ConsentManager presents a lengthy "Terms of Service and Privacy Policy" that the user must accept. Several of its explicit claims are contradicted by the code:

  • The notice states it does not collect "browsing history." False: the capture mechanism (F-1) transmits a per-page record of the user's URLs on these sites.
  • The notice states the visitor ID "cannot be traced to any personal identity." False in effect: the registration/MemberBadge funnel (F-2) is purpose-built to resolve that ID to the user's email and payment.
  • The notice states it does not collect "personal identity information (name, email, phone)." Contradicted by the email-collection funnel.

Presenting a consent dialog whose core representations are untrue is not a mitigating factor; it is an aggravating one. Such a notice is unlikely to constitute valid, informed consent.

F-5 — MEDIUM: Fake-review solicitation (astroturfing)

LurlHubBrand.createRatingPrompt() offers the user +5 service credits for posting a review on GreasyFork that includes a per-user serial code. This is paid manipulation of the public review score of the very listing users rely on to judge the script's safety — it inflates trust in a script that is actively abusing them.

F-6 — HIGH: Excessive capability and silent remote-update risk (attack surface)

Independent of the behaviors above, the trust cost of running this code is severe:

  • GM_xmlhttpRequest grants cross-origin request capability, and the script uses it to manually forge Referer and Origin headers (see Utils.downloadFile). Combined with a broad @connect list (including localhost), the code can issue arbitrary cross-origin requests with spoofed provenance.
  • unsafeWindow._lurlhub = RecoveryService exposes the script's internal service object to the page's own JavaScript context.
  • @downloadURL / @updateURL plus VersionChecker (which supports server-driven minVersion and forceUpdate) mean the operator can change the code that runs on the user's machine at any time. Any assessment of the current version is only valid until the next silent update.

You are extending all of this trust to an anonymous operator who has already misrepresented the script's behavior to you (F-4).

Note (LOW / for completeness): the advertised "password cracking" is the least harmful part

LurlHandler.datePasswordHelper / MypptHandler.autoFillPassword merely read the upload date that these sites display in plaintext, convert it to MMDD, and autofill it. This is at most the bypass of a trivially weak gate using information the page already shows the user, and the script's own defense of it is technically reasonable. It is worth noting only because the script names itself after this feature — the genuinely harmful behavior is entirely in F-1 through F-3.

3. Evidence index

Code element Behavior
Utils.sendToAPI, SyncManager.sendCaptureWithRetry → /lurl/capture Uploads per-page browsing records to the operator
Utils.downloadAndUpload → /lurl/api/upload Uses the user's device/bandwidth to mirror media files
BlockedCache (RPC bl) Server-controlled block-list; protects operator, not user
RecoveryService.reportDevice (RPC rd) Device fingerprint (CPU, memory, network, battery)
RecoveryService.runSpeedTest → /mst/targets Active bandwidth measurement, reported to server
RecoveryService.getVisitorId (GM_setValue) Persistent cross-site tracking ID; propagated as svid=
MemberBadge, modal register (RPC rg), /buy-points /join /pricing Binds the tracking ID to email + payment
LurlHubBrand.createRatingPrompt Credits-for-review astroturfing
maybeRedirectLurlToHub (location.replace) Redirects lurl content pages to operator backend
DcardHandler.interceptLinks Hijacks link clicks; leaks referring article URL as ref
ConsentManager "Section 4" Consent text contradicted by F-1 / F-2
Utils.downloadFile Forges Referer / Origin via GM_xmlhttpRequest
unsafeWindow._lurlhub Exposes internal service object to the page
@downloadURL / @updateURL + VersionChecker Operator can silently push new code

4. Risk to the user

  • Legal. The user's IP becomes the fetch-and-redistribute origin for third-party (adult) media. Potential exposure to copyright/redistribution liability, made worse by the sensitivity and possible illegality of some of that content.
  • Privacy / extortion. Highly sensitive browsing (adult content) is fingerprinted, persistently tracked, and funneled toward the user's real email and payment. A malicious or breached operator holds material well-suited to doxxing or extortion.
  • Security / supply chain. Broad cross-origin request capability with spoofed headers, internal objects exposed to the page, and a silent auto-update channel controlled by an anonymous party. The behavior can change at any time.
  • Trust. The operator has already made false statements in the consent notice. There is no basis to extend them further trust.

5. Recommendation

  1. Do not install this script. If it is installed, remove it, then clear the site's IndexedDB (lurlhub_offline) and any Tampermonkey stored values for the script.
  2. If the only functionality actually wanted is (a) autofilling the visible date as the MMDD password and (b) a one-click download button for media already authorized on the page, that logic is short and self-contained. A clean re-implementation should retain only the local DOM interactions — extractMMDD, setting the cookie / filling the field, and a Blob-based downloadFile trigger — and remove every reference to epi.isnowfriend.com, the capture / upload / rpc calls, reportDevice, the svid identifier, the page redirects, MemberBadge, and FeaturedTeaser. The result performs only local, offline actions with no network egress to any third party.

This assessment is based on static analysis of a single distributed version. Because the script can silently update itself, current findings apply only to the version reviewed.

This script has had 1 previous upheld or fixed report.

Phone “Jeffrey” Dr. (the reported user) has made:

This report has been upheld by a moderator, but the moderator marked it as Malware.

Deleting based on the device fingerprinting claim