Yeah. It's fairly likely the ads link to a URL with a recognizable pattern. Failing that, if an ad is reproducible we can iterate with a site owner to detect the DOM modification a few different ways. I've drafted a blog post to collaborate with others on reverse engineering this: https://push.cx/google-ad-injection