The cause was that the site was in fact compromised and at a certain very discreet URL it hosted a bunch of pages for legit products that linked to external shady sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.
The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.
The cause was that the site was in fact compromised and at a certain very discreet URL it hosted a bunch of pages for legit products that linked to external shady sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.
The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.