Missed here: https://sitecheck.sucuri.net/results/russianteatime.com
and here: https://www.virustotal.com/nl/url/c82ca4c5529734174e58120b468f683ebb991eade07bf00f025cf1db5e02e33c/analysis/1509117236/
Flagged: https://urlquery.net/report/3d2f6da5-af3a-48d6-8d45-7acbc7c891e0
About this threat, read: https://www.wordfence.com/blog/2017/10/cryptocurrency-mining-wordpress/
polonus