Three websites have been found infected with the malicious GTM identifier (GTM-MLHK2N68), down from six initially reported.