We Know 15,579 Websites Are Infected. How Do We Tell Them?

Report URI has identified 15,579 websites still serving malicious JavaScript, with conservative estimates putting their combined traffic above 135 million visits a month. The scripts can steal payment-card details, trick visitors into installing malware, exploit vulnerable devices to install spyware, or redirect people to phishing pages and scams. Infections arise through several routes: attackers compromise a site directly, poison a third-party script used by many sites, exploit cross-site scripting vulnerabilities, or revive expired domains that websites still rely on for JavaScript. The confirmed list excludes thousands of additional sites where the evidence is suggestive but not yet conclusive, and it removes sites once their infections are fixed.

The central problem is that detection has outpaced notification. Investigating and contacting site owners takes substantial effort, contact details are often unavailable, security.txt is rarely used, and most outreach goes unanswered. The team can alert a limited number of especially high-impact sites, but cannot responsibly notify thousands at the current scale. It is therefore asking national cybersecurity agencies and CERTs, particularly in Europe, to work with its researchers and notify affected organisations in their regions; organisations may also seek access to threat-intelligence feeds. The appeal is for practical ideas and partners who can turn reliable evidence of widespread infections into effective warnings and protection for the millions of people exposed.