Ah found it: https://sitecheck.sucuri.net/

At least the pages I looked today at aren't recognized by this external tool. Only green checkmarks, also the "List of scripts included" doesn't see the 2 scripts added dynamically by the injected code in the post.

The Wordpress plugin would probably do a better job.

Hi Sujan

Can we get a list of the domains you scanned that weren't recognized?

Thanks

Done, Celise should have them on your site's chat tool.

Seems like it would be very hard for it to catch everything from the outside. I've seen malware that only presents itself to clients with a Referer from Google or an iPhone user-agent, for example

Yup

What you're referring to is Conditional Malware. We actually do very well with that, but there are no 100% solutions. There are also things that are hard, like Defacements and environments used for Phishing Lures..

All great points

100%. Although in this case the html posted in the blog post is present on all requests, all the time.