Websites are inherently vulnerable to a wide range of threats, one of the most common ones being vulnerabilities to cross-site scripting (XSS). XSS is a class of attack that enables a malicious user to inject client-side scripts, using the website as a channel, into other users’ browsers. This python script is suitable for MongoDB where collection contains differend versions of same the scraped webpage. Script is comparing newest and second newest version of HTML code saved in MongoDB with idea that malicious code might be injected. When talking about malicious code the main focus of this finder is to find injected URL's that may lead to illegal casino webpages or fake webshop stores. In the first step saved HTML code is being stripped down to only HTML tags with no attributes or innerHTML text and two versions are being compared. If there are any differences in versions we are continuing search for malicious code injected. Second step is result of manual code analysis and result of known CSS stylings used for hiding contnent on visible screen. The HTML tags in newest version are checked only if they can contain URL links in some form (,<script>,...).The inline styling in those HTML tags are raising "security index" if they are containing z-index,hidden,letter-spacing,opacity or CSS positioning with values less than -500px or greater than 2500px. Tags that "might" contain malicious code are being saved in separated document with all URL's found on that webpage. The script is not 100% perfect because it finds false-positives because alot of CSS combinations can be used in regular development. In most cases if the webpage contains malicious URL's the script recognizes it.