diff --git a/http/miscellaneous/polyfill-io.yaml b/http/miscellaneous/polyfill-io.yaml
index d326e0bc9e..d0aa0781c2 100644
--- a/http/miscellaneous/polyfill-io.yaml
+++ b/http/miscellaneous/polyfill-io.yaml
@@ -1,10 +1,11 @@
-id: polyfill-io-detect
+id: polyfill-io
 
 info:
-  name: Polyfill.io Detection
+  name: Polyfill.io - Detection
   author: kazet
   severity: low
-  description: The polyfill.io CDN was suspected to serve malware.
+  description: |
+    The polyfill.io CDN was suspected to serve malware.
   reference:
     - https://sansec.io/research/polyfill-supply-chain-attack
     - https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
@@ -12,7 +13,8 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cdn,polyfill.io
+    shodan-query: html:"polyfill.io"
+  tags: cdn,polyfill-io,malware
 
 http:
   - method: GET