I have reported it to the abuse contact of the web host, colocation provider, and cloudflare. I am however not expecting a response in a timely manner from any of them.
Luckily they are stripping out the ad tags before displaying by site so it shouldn't affect Ad Sense.