I recently stood up a WordPress site in a Docker container and enabled https with Let's Encrypt. Everything seems ok from an https standpoint.
Then I registered the site with Google Search Console, which immediately flagged the site as Deceptive. I did download and enable a few plugins, but I am not sure which of those, if any, might be the culprit.
How do I find this out? Google Search Console merely says:
"These pages attempt to trick users into doing something dangerous, such as installing unwanted software or revealing personal information."