Docs site force-redirects to a third-party landing page (ad tag in AdSupportedFooter)

[MarcusDunn]

Summary

https://curbox.app/docs/ performs a full top-level navigation away from the documentation to various ad domains.

I traced it to the ad tags in src/components/AdSupportedFooter.astro, which is wired into every docs page via the Starlight Footer override inastro.config.mjs.

Reproduction

1. Open https://curbox.app/docs/ in a browser with no ad blocker.
2. Wait / scroll.
3. The tab ends up on https://www.aliexpress.com (or some other sketchy site).

Reproduced on fresh, incognito, tabs on 2026-08-25. In my runs it fired without any interaction at all. There look to be several trigger paths, so timing likely varies by which tag wins the race. I initially suspected I has a virus, but this is the only site with this behaviour so I tracked down the cause.

Source

src/components/AdSupportedFooter.astro loads two tags:

• https://www.highperformanceformat.com/e628ac9098f3174a95ddcfe2a8246bcc/invoke.js
• https://pl30925041.effectivecpmnetwork.com/d2a3f724f27587131efa763529c9a444/invoke.js

Both are Adsterra delivery domains with hardcoded destinations:

• fizzyacerbitymellow.com
• zoologyfibre.com
• kettledroopingcontinuation.com
• protrafficinspector.com
• cdn.cloudvideosa.com
• mamshirt.com
• thedirecthor.com

The effectivecpmnetwork payload registers scroll and click listeners; the other is gated on load / DOMContentLoaded / visibilitychange.

It looks like this behaviour was introduced accidentally in 1a76238