If the detection is URL:Mal it is not a false positive. URL:Mal = IP and/or domain is blacklisted and that is true.
Blacklisted : http://www.urlvoid.com/scan/udeftour.org/
Bad IP history : https://www.virustotal.com/en/ip-address/104.24.101.193/information/
Browser difference : https://www.websicherheit.at/website-malware-viren-scanner/?url=www.udeftour.org
Vulnerable libraries used : http://retire.insecurity.today/#!/scan/8993e2abf6d757e8ff9f4b5bc0d24b27240109397b35ec495821944573586d78
Old Wordpress version used contact-form-7 4.4.2 latest release (4.6) Update required
