Nothing so complicated. The HTML source of femboy.ca/ literally contains:
<img src="https:////ipv4.games/claim?name=femboy.cat" hidden>
However, the question is why would this domain get 20 million distinct visitors (before being posted on Hacker News)?