Not sure about the paywalls. But it might be used for "drive by attacks" or phishing.