What can a Magecart detection scanner find?
External scanning can reveal newly introduced third-party scripts, changed inline code, encoded payload indicators, payment-field access strings and exfiltration-oriented browser APIs present in returned HTML. Each can also have legitimate uses, so context and change history matter.
How should a Magecart detection scanner be used?
Treat results as a lead for verification. Review deployment history, tag-manager changes, third-party vendors, CSP reports, payment-provider logs and the delivered page in a controlled browser. If compromise is suspected, preserve evidence and follow your incident-response and notification obligations.
What does passive scanning miss?
DygDog does not execute page JavaScript. It may therefore miss skimmers delivered only after user interaction, geofencing, runtime tag injection or attacker evasion. Defence in depth can include browser-side monitoring, restrictive CSP, vendor governance and integrity controls where technically suitable.
What DygDog checks
New script origins
Highlights additions that expand the checkout trust boundary.
Inline code changes
Uses fingerprints to reveal material changes to inline script entries.
Encoded-code signals
Looks for conservative indicators such as atob or long base64-like strings.
Payment-field access
Looks for references to card-related fields or form data in observed script text.
Outbound browser APIs
Surfaces combinations involving fetch, XMLHttpRequest, WebSocket or sendBeacon.
SRI gaps
Identifies eligible third-party resources without valid integrity metadata.
CSP gaps
Reports missing or broadly permissive script-source controls.
Coverage limits to understand
- A risk signal is not proof of Magecart or data theft.
- Runtime-only, conditional and obfuscated payloads may be missed.
- A clean result cannot guarantee that a site is uncompromised.
Frequently asked questions
Does DygDog guarantee Magecart detection?
No. It reports observable e-skimming risk signals and script drift. Conditional or runtime-only malware can evade passive HTML analysis.
What should I do with a critical signal?
Validate the script against approved changes, preserve evidence, inspect the page in a controlled environment and activate your incident-response process if the change is unexplained.
Is Magecart the same as a server breach?
Not necessarily. E-skimming can arise from compromised first-party code, third-party vendors, tag managers or other parts of the browser-side supply chain.