Has anybody else’s site been infected with check-tl-ver-f308-h[.]buzz malware?

Google AdWords keeps disabling my site saying it has detected malware, but all scans, search console and transparency report comes out clean, then the ads run for a few hours and then back to being disabled. Have run wordfence scans but cant find the bad link which Google Support says there is, that being: check-tl-ver-f308-h[.]buzz

all plugins are updated and i dont have any dodgy plugins, what would be the best way to find the bad link or how can i block it? TIA