The location of injected payment checkout libraries on affected online stores were:  hxxps://[online store domain]/innerweb/v4.0/include/js/checkout_payment[.]js hxxps://[online store domain]/innerweb/v3.1/include/js/checkout_payment[.]js  The injected script forged the Google Analytics script format, but loaded a different script from the attackers’ server.