https://www.spamhaus.org/sbl/query/SBL511172 has a payload on facaoteste.com.br. It is marked as deceptive in Google Safe Browsing, but it is still alive. Cloudflare needs to take it down.
$ host facaoteste.com.br
facaoteste.com.br has address 172.67.136.138
facaoteste.com.br has address 104.21.26.153
facaoteste.com.br has IPv6 address 2606:4700:3032::6815:1a99
facaoteste.com.br has IPv6 address 2606:4700:3032::ac43:888a