Sites are blacklisted when authorities such as Google, Bing, Norton Safe Web, McAfee SiteAdvisor etc., find irregularities on a website that they deduce to be malware. Malware can come in many forms: trojan horses, phishing schemes, pharma hacks, email or information scraping. Most often, the website owner is not even aware that they have been hacked. However, it's in the search engine's best interest not to show infected results, as they don't want to lose users due to these results putting their computer in harm's way.
Understanding Google’s Security Warnings
“This site may be hacked” warning"
This message is used to tell the user that Google believes a bad actor has made changes to the site by adding new pages in the form of spam. Visiting the site might redirect you to a page showing various forms of spam links or spam pages.
Google’s official explanation is:
“You'll see the message "This site may be hacked" when we believe a hacker might have changed some of the existing pages on the site or added new spam pages. If you visit the site, you could be redirected to spam or malware.”
This warning does not generate a red screen, and shows exclusively in the Google Search Engine Results Pages (SERP). For more information on what to do if you see this warning visit the Google help pages.
Why:
There are several reason the domain and site are listed as "This site may be hacked". May refer below for some of the details:
====
1. website compromised
2. code injection under webfile
3. outdated web application version(Joomla, WordPress, OpenCart and etc)
Note: code injection may be caused by outdated themes, plugins, module and etc. Besides that, installing plugins, themes, module from un-trusted/un-verify party may also cause code injection
=====
How:
1. Alias with web developer to check on webfile under hosting. Remove suspicious/unused webfile, remove unverified plugins,module and themes.
2. Update all web application version, themes, plugins, module and etc to latest version from time to time.
3. Install security plugins/module and perform scan on user web application
Upon the above steps had perform, do login into Google Webmaster end to request for site review. Google will take 24-72 hours to review.
Reference from:
https://sucuri.net/guides/what-is-google-blacklist