Report URI, a UK-based threat intelligence firm, has identified 15,579 websites currently running malicious JavaScript — credit card skimmers, ClickFix malware installers, iOS spyware loaders, and phishing redirects. Their conservative estimate puts combined traffic to these sites at 135 million visits per month. The infections are confirmed, the evidence is solid, and the firm has no viable mechanism to notify the vast majority of affected site owners. The infection vectors are familiar but diverse: direct WordPress compromise, supply-chain poisoning of third-party scripts, traditional XSS vulnerabilities, and a technique Report URI has named "DeadTag" — attackers buying expired domains that sites still reference for JavaScript, then reviving them to serve malware. September 2024 alone produced hundreds of newly confirmed infections. The list grows faster than it can be acted on. The disclosure bottleneck is structural, not motivational. GDPR has gutted WHOIS as a contact mechanism — records return privacy-relay addresses or nothing. CDN and proxy layers obscure hosting providers, making upstream notification impossible. The security.txt standard, designed precisely for this scenario, has negligible adoption. Manual outreach to high-impact sites consumes significant resources and draws almost zero response. Automated email to 16,000 domains risks spam-filter destruction with no evidence it would produce action. Report URI has explicitly declined to publish the full list, and the reasoning reveals the tension at the heart of bulk disclosure. These sites are victims, not perpetrators. Widespread blocklisting would devastate small businesses who may never get delisted. Many infections exploit known CMS vulnerabilities — publishing the list hands attackers a target directory. The ethical constraints that protect site owners also prevent the most obvious notification paths. The firm is calling on national CERTs and NCSCs — particularly in Europe, where .fr, .es, and .de domains are heavily represented — to request regional infection lists and handle notification through channels that carry institutional authority. This is an admission that private-sector threat intelligence has outrun the disclosure infrastructure designed to act on it. The gap exposed here is not technical but institutional. The web security ecosystem has no equivalent of a public health notification system — no mechanism to say "your site is infected" at scale, with authority, without causing collateral damage. Browser vendors could flag infected sites but risk false positives and liability. CERTs could act but are understaffed and often lack mandate for proactive bulk notification. The coordination problem is genuinely unsolved. What Report URI is describing is a market failure in information asymmetry: the people who know about the infections cannot reach the people who need to act, and the people who could bridge that gap — CERTs, registrars, hosting providers, browser vendors — have no obligation or incentive to do so at the required scale. The 135 million monthly visitors bearing the actual risk have no seat at any table.
