@cyberlibrarian That is #Adsterra. I've done a few posts about it in the past, like this one.
https://infosec.exchange/@rmceoin/111563876310012635
You are correct, the website owner intentionally places a chunk of JS to call out to Adsterra. Thus far the only thing I ever see Adsterra lead to is scammy.
Besides the /invoke.js the big tip off is that the Adsterra domains all use the same set of IP's.
They churn through these initial domains. I suspect they issue a new domain for each customer's ad campaign. Or some such.
While I seem to recall it leading to other scams, it very much liked to land at a robot captcha. They do not churn through those domains. So if you're into blocking domains, that's the better bang for your buck.
Unit42 unknowingly blogged about Adsterra. Nice blog, they just didn't get the attribution.
https://unit42.paloaltonetworks.com/apateweb-scareware-pup-delivery-campaign/
While I do have a script that still monitors for these domains, it doesn't catch them all. It'll still give you an idea. The first CSV is the main domain like the one you ran into. The second is something I call "ATRobot", as in Adsterra Robot.
https://gist.github.com/rmceoin/0f10ce3326b356971abba2c3c8464984