Disabling the infected IPB forum fixed the warnings in the search console - google has cleared both subdomains.
Google Chrome is also no longer blocking the archive.hitmanforum.com domain as a phising site.
So my appologies for wasting your time on that non-discourse related question.
sucuri and quttera still mention some “suspicious” files, which to my eye just look like index.html