DETAILS: On July 3, our website was blocked the 1st time. This was justified (although I disagree with the immediate punishment): it was an old Drupal 7 site that was installed in 2011 and, because of budget constraints, rarely received security patches. For years, it had the Drupageddon and Drupalgeddon exposures. Not surprising it was infested with malware. This is when I got involved (volunteering my time & skills). The website was rewritten as a static site (virtually unhackable) using Hugo on Netlify. On July 26, we were unblocked.

At 1am ET this morning (Aug 1), we were blocked by Google again! The new (Hugo) website had one link to the old (Drupal) website (now with a different subdomain) so users could access content we had not yet migrated to the new website. This link was the reason Google gave for blocking us. I read Google's notification at 6am and immediately removed the links and requested a review via Google's Search Console. At 9am, Google said the review had failed, our website was still blocked, without any additional information. Search Console still says the bad link is to the old website's subdomain. I verified my Hugo source files: there is zero instances of the old website's subdomain name. At 10:30 I submitted another request for review and am still waiting for a response. Their request pop-up says "Warning! Requesting a review of issues that weren't fixed will result in longer review cycles" so I may be waiting a longer time.

(BTW, anyone with inside Google connections, help would be appreciated)