SourTrade malvertising landing page - combined Google Ads, Meta, and Twitter/X pixel tracking with campaign-specific /config or /sw.js indicator

Duo Tech@duotech

•updated Jul 27, 2026•0•0•1

Detects HTTP response bodies containing specific combinations of advertising tracking markers (Google gtag, Meta fbq, and Twitter twq) alongside known path indicators like '/config' or 'sw.js', which are characteristic of SourTrade malvertising landing pages.