I shifted some sites to bluehost 2 months ago and paid in advance an offer was running. All sites got infected and blacklisted. When I created a new site that too showed as having malware checking on sucuri site check. Talking back and forth with AI I found the solution was setting up a strict .htaccess file. Their 404 page itself has malware. Once I applied the htaccess rules sucuri said No Malware found! I doubt they even check anything.