it's on the pages themselves.

A whois tells me VERY little about this ip address...

I've also seen brave.exe spoofed as other things, but it looks like someone is trying to do some kind of an exploit from a brave browser coming from that IP address (I'll provide it if you'd like it, but I'd rather not post in here)

I'm using Brave. The page is trying to direct the browser to connect to this suspect website.

Likely its one of the ads.

The IP address geolocates to Brazil. Odd.

Who do I contact in Admin to report this?

1. Perhaps it's an embedded gif from a non secure server...
Ie: http vs https at the beginning of the embedded image URL