A site running Wordpress is opening a spam site in new tab on first click for new users. If you go directly to the URL or have visited the site before, the malware does not