Why not a quick scan twice a day if all static content looking for ip addresses and domains against a whitelist of allowed domains? This would have found the issue same day.