We Know 15,579 Websites Are Infected. How Do We Tell Them?

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by mxuribe on Friday November 06, 2026 @03:42PM (#50398216)

[delayed]

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by chinathrow on Friday November 06, 2026 @03:51PM (#50398338)

This. abuse@ works.

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by 2000UltraDeluxe on Saturday November 07, 2026 @02:31AM (#50402460)

Chiming in. abuse@hostingprovider will work.

And yes, it would mean shut the sites down in some cases - the ClickFix stuff for WordPress is near-impossible to clear while the site is online.

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by TZubiri on Monday November 09, 2026 @01:34PM (#50429550)

here is a mini scriptable command to get started

whois $(dig A +short $DOMAIN) | grep OrgAbuseEmail

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by mxuribe on Monday November 09, 2026 @03:05PM (#50431157)

[delayed]

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by TZubiri on Monday November 09, 2026 @06:35PM (#50433922)

no, this script gets the abuse contact for the IP block pointed to by the domain ,(IP block data as reported by the RIR). The whois command may be replaced by rdap although the grepping would need to be changed or replaced with json parsing altogether)

[ Parent | on HN ]