3 ms·

Looking at Yara rules - I won't have time today but a unique-ish string in the script was adsbyText:"ADS BY "+ including quotes.

• andy112 11y ago
  Yep that looks like a good string to key off of. The results for the site you mentioned are here - https://scriptobservatory.org/webpage/543677125f1bea8226ba7c0578e4836332c97f48f56d23894c63b61725965959 https://scriptobservatory.org/webpage/543677125f1bea8226ba7c... - but I don't see anything that looks like a clear match.
  • voltagex_ 11y ago
    Do you differentiate between http and https versions of sites?
    • andy112 11y ago
      Yes, the two are considered as if they were completely separate sites.