!!Update

Regarding my tests in a safe environment (sandbox) the previous server on Websitesource.net was infected with a trojan known as __BlacoleRef.CL__ which is __classified as severe__. Read more here:
[http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan:JS/BlacoleRef.CL|Microsoft Malware Protection Center]

When I took over the IT-support I changed the permissions on the server for all folders related to old domains to read only. The folders meta-health.org and metamedicine.info stayed as is with all their standard permissions as they were in use.

!!!What might have happened?
 Inside metamedicine.info there's a folder test - containing Wordpress installed by Arpita last summer. Obviously Arpita left this "building site" as is without any security plugin installed. Within this Wordpress installation the plugin Revolution Slider was installed - version 4.6.92. Revolution Slider is wellknown for its security risks and has quite often updates. The actual version is 5.4. 

Here is an example how to hack Revolution Slider. The blog is written by a certified ethical hacker:
[http://hackercool.com/2016/05/hacking-wordpress-revslider-plugin-metasploit/|Hacking WordPress Revslider plugin with Metasploit]

Unfortunately Arpita had used a fictive e-mail address - ''admin@gmail.com'' - for the only existing user ''admin''. So I had to change it in the database to an existing e-mail address to be able to reset the password. When logged in I installed the security plugin Wordfence and made a scan. Beside other changes Wordfence found a file options.php containing just that malware code (Java Script) which has been copied to all PHP and HTML-files on IMMA's server.

This means: Every time, when a visitor opens a page, the Java Script will be executed - with the risk that the visitor's computer will be infected. So IMMA's previous webspace is a high risk area now - only accessable via a sandbox.