It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.