Hacker News Reader

Looking at Yara rules - I won't have time today but a unique-ish string in the script was

adsbyText:"ADS BY "+

including quotes.

Yep that looks like a good string to key off of.

The results for the site you mentioned are here - https://scriptobservatory.org/webpage/543677125f1bea8226ba7c... - but I don't see anything that looks like a clear match.

Do you differentiate between http and https versions of sites?

Yes, the two are considered as if they were completely separate sites.