Hey, OP here!

I've posted an update to address many of the comments here on HN and also across social media, you can find it here:

https://scotthelme.co.uk/we-know-15-579-websites-are-infecte...

Hi @speckx I'm going to guess that there won't be 15K hosting providers behind all of those websites...so I suggest considering the following:

* If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list.

* Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world.

Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners.

Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps!

As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.

https://www.ncsc.gov.uk/section/about-this-website/report-sc...

abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.

Is there no "have I been powned" for websites?

Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.

Replying to the updated FAQ in this post:

> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address

This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on

Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures

Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)

Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too

> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.

As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?

> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.

...why?

Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?

Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?

Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.

I don't think 'it's hard' is a good excuse to ignore responsible disclosure

Um. Isn't it exactly the reason why abuse@some-domain.com needs to exist? I mean, sending 15k mails is not a big deal I suppose and had I receive such mail I'd read it.

But maybe that's not the way and someone will at least tell me why :)

Whois on domain and IP.