[adrianmonk]

Thanks, that makes sense. It's <iframe>, not <script>. (They're embedding more than JS.)