They also used their visitors to DoS other sites, Cloudflare's malware blocking resolver (1.1.1.2) blocks their domains: https://news.ycombinator.com/item?id=47474255