@liaizon in the case of climatejustice dot social, Virus Total lists quite a few detections (source: https://www.virustotal.com/gui/url/626d9959cb7a0745e607af1f1543d4d2d74e2340d8e8da691e5bec56a87417a1/summary ). From the comments, I see someone claim the admin runs an old version of nginx. It might be the case that the server was hacked at some point and used to run phishing campaigns / spread malware. Something that can definitely be fixed!