What malware (was) here?

Re: https://urlquery.net/report/f00679be-5a01-4d66-96f0-254478386814
Re: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=auntoke.com%2F&ref_sel=GSP2&ua_sel=ff&fs=1
4 to flag: https://www.virustotal.com/nl/url/615e01965810465fb037e5bbef2e81cca3d530eee7f72220f4f0cec2d1a52841/analysis/1509295457/
Going to default page: https://sitecheck.sucuri.net/results/auntoke.com
F-grade status and recommendations: https://observatory.mozilla.org/analyze.html?host=auntoke.com
Mail abuse in the past van IP: https://www.projecthoneypot.org/ip_217.160.166.53
Listed in blocklist.de. -https://privacyscore.org/site/33899/

polonus