We know 15k websites are infected. how do we tell them?

	We know 15k websites are infected. how do we tell them?(scotthelme.co.uk)
	224 points by speckx 5 days ago \| 184 comments
	tl;dr: Report URI has identified 15,579 websites currently infected with malicious JavaScript (skimmers, ClickFix, redirects, etc.) collectively serving ~135 million visits per month, but has no scalable way to notify them. Manual outreach is ineffective, security.txt adoption is low, WHOIS data is useless post-GDPR, hosting providers are obscured by CDNs, and publishing the list risks tipping off attackers or unfairly blocklisting victims. The author is soliciting ideas and asking CERTs/NCSCs, particularly in Europe, to reach out for regional infection lists.
	HN Discussion: ↑Suggest technical discovery via security.txt, CDN/hosting provider contacts, or legally-required imprints ~Report sites to browser blocklists like Google Safe Browsing to force action via traffic loss ↓Just publish the list publicly; ethical duty outweighs concerns about tipping off attackers ↑Contact hosting providers in aggregate since they're a much smaller set than websites •Tangential interest in the detection tooling itself rather than the notification problem