15,579 Infected Websites, No Clear Notification Path

Report URI has identified 15,579 websites running malicious JavaScript that together receive over 135 million monthly visits. The detected attacks include payment card skimmers (Magecart), ClickFix social engineering malware delivery, device exploitation installing spyware, and malicious redirects to phishing pages. Infections arrive through multiple vectors: direct exploitation of site vulnerabilities, compromised third-party scripts, cross-site scripting flaws, and the DeadTag threat group’s tactic of acquiring expired domains that sites still load scripts from.

The central challenge is speed mismatch. Report URI’s detection capability now outpaces the responsible disclosure process—most organizations never respond to notification attempts. Finding legitimate contact information for crawled websites is extremely difficult. WHOIS registrant data became largely unusable after GDPR took effect. Many infected sites operate behind CDN or proxy services, preventing identification of actual hosting providers. Meanwhile, security.txt adoption remains minimal, eliminating a standardized notification channel.

Report URI is requesting help from national cybersecurity agencies and the security community. The organization shares regional infection lists with NCSC/CERT bodies in Europe while declining to publish the full site list, fearing it would either entrench blocklists or provide attackers a curated target list. The organization has actionable intelligence that could protect hundreds of millions of monthly visits but lacks infrastructure to deliver it to affected parties.