After poking around a bit, the "netflame.cc" domain may be where this was compromised.

It used to be a Fireclick owned domain, but the current ownership might not be Fireclick.

Try: whois -h whois.dynadot.com netflame.cc | grep Registrant

The results don't really look like what they would be if Fireclick owned it. It's registered to a Thailand national using a personal gmail account.

Can't prove it, but I have a suspicion Fireclick let the domain lapse/expire, and some bad actor registered it, then figured out what content to post where, or got hacked themselves.