--- title: We Know 15,579 Websites Are Infected. How Do We Tell Them? description: Report URI's threat intelligence has identified 15,579 websites currently infected with malicious JavaScript, receiving a combined 135 million visits a month.... canonical: https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We Know 15,579 Websites Are Infected. How Do We Tell Them? | daily.dev og:description: Report URI's threat intelligence has identified 15,579 websites currently infected with malicious JavaScript, receiving a combined 135 million visits a month.... og:url: https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i og:image: https://api.daily.dev/og/posts/L7oEhZo0i.png og:image:alt: We Know 15,579 Websites Are Infected. How Do We Tell Them? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We Know 15,579 Websites Are Infected. How Do We Tell Them? **[Scott Helme](https://daily.dev/sources/scotthelme)** · 5 min read · 0 upvotes · 0 comments ## Summary Report URI's threat intelligence has identified 15,579 websites currently infected with malicious JavaScript, receiving a combined 135 million visits a month. Infections include Magecart card skimmers, ClickFix malware, iOS spyware like DarkSword and Coruna, and malicious redirects. Compromise routes include direct WordPress hacks, supply chain attacks on third-party scripts, XSS, and a threat group named 'DeadTag' that buys expired domains still referenced by site JS and serves malware. The company says it finds infections far faster than it can notify site owners, since the vast majority of emails go unanswered, and is asking NCSC and CERT contacts to get in touch for lists of infected sites in their region. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the DeadTag attack technique that compromises websites via expired domains? DeadTag is a threat group that buys expired domains still referenced by third-party JavaScript tags on live websites, revives those domains, and serves malware through them. It was identified as part of ongoing threat intelligence work tracking website compromises, alongside spyware campaigns named DarkSword and Coruna that target specific iOS versions. _Developers auditing third-party scripts for supply chain risk can follow emerging threats like this on daily.dev._ ### What are the main ways attackers get malicious JavaScript onto a legitimate website? The main categories are direct compromise (often via WordPress vulnerabilities modifying site JS files), supply chain attacks (a loaded third-party script becomes infected), traditional XSS vulnerabilities allowing JS injection, and DeadTag-style attacks that revive expired domains still referenced by a site's script tags. _Teams hardening their site's script dependencies can track these attack patterns on daily.dev._ ### How many websites are currently infected with malicious JavaScript according to recent threat intelligence findings? 15,579 unique websites are confirmed infected with malicious JavaScript, a number that excludes thousands more sites under suspicion but not yet confirmed. These infected sites together receive a conservatively estimated 135 million visits per month, including several regional top-ranked sites in countries like France, Spain, and Germany. _Security teams gauging the scope of web malware threats can follow this kind of research on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 80 comments across hackernews (as of 2026-11-06). **TL;DR:** Discussion centers on how to actually reach 15,000+ site owners, with most favoring reporting to browsers/Safe Browsing or hosting providers over mass emailing, while others push back on public shaming and question how 'infected' is even defined. **Sentiment:** 10% positive · 35% mixed · 55% skeptical **The case for** - Reporting infected domains to browser vendors (e.g. Google Safe Browsing) would protect users immediately and often force owners to notice via traffic drops. - Publishing a public, searchable list (like haveibeenpwned) would let owners self-check without requiring individual outreach. - Grouping by hosting provider or ASN could shrink the outreach problem to a manageable number of recipients. - WHOIS/abuse@ contacts, though degraded, can still route messages to real administrators via registrars. **The pushback** - Mass-emailing 15,000 addresses is indistinguishable from a spam campaign and likely to be ignored or flagged. - abuse@/admin@ inboxes are widely reported as unmonitored or buried under spam, so direct email rarely reaches anyone. - The criteria for labeling a site 'infected' (e.g. via third-party scripts) may be too vague and could sweep in many legitimate sites. - Publicly shaming or listing sites could be seen as reckless since it doesn't make them less vulnerable and may invite legal threats against the discloser. **By community** - hackernews (heated): Strong disagreement between those favoring automated/browser-based blocklisting for immediate user protection and those favoring quieter responsible disclosure or direct owner contact, with side arguments over whether public shaming is appropriate. **Hottest debate:** Whether to protect users immediately via browser/search-engine blocklisting and public disclosure, versus trying responsible, direct notification to site owners first. **Open questions** - What exact criteria determine whether a site counts as 'infected' in the list (e.g. does a vulnerable third-party analytics script count)? - Why hasn't a 'haveibeenpwned'-style public lookup tool for infected websites been built already? - What have they already tried beyond security.txt to find contact details (e.g. scraping 'contact us' pages or guessing common admin emails)? **Highlights** > Hi @speckx I'm going to guess that there won't be 15K hosting providers behind all of those websites...so I suggest considering the following: * If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list. * Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world. Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners. Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps! > — [mxuribe on hackernews · 1 comments](https://news.ycombinator.com/item?id=50398216) > > We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up. ...why? Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's? Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article? Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal. I don't think 'it's hard' is a good excuse to ignore responsible disclosure > — [fusslo on hackernews](https://news.ycombinator.com/item?id=50397126) > Quote from TFA: > Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors. I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given. Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model. You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction. You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname" > — [sublinear on hackernews · 3 comments](https://news.ycombinator.com/item?id=50396805) > NOBODY messages abuse@ I had mine on my domains for decades, never got one single email. > — [pmlnr on hackernews](https://news.ycombinator.com/item?id=50398060) > I think something has gone very wrong for you to be doubting the answer. Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm. They're already infected - or so you claim. I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure. But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice. In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”. Publish the URLs that prove they're infected. Auto update it whenever one get's fixed. > — [athrowaway3z on hackernews · 3 comments](https://news.ycombinator.com/item?id=50397247) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50396064) · 95 points · 80 comments ## Similar posts on daily.dev - [Crooks compromise WordPress sites, spread infostealers](https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup) · The Register · 0 upvotes · 0 comments - [100\+ Websites Hacked, Sensitive Records Exposed, and Three Critical Flaws Rated 9.9](https://daily.dev/posts/100-websites-hacked-sensitive-records-exposed-and-three-critical-flaws-rated-9-9-mhfe7q9ka) · Security Boulevard · 0 upvotes · 0 comments - [WordPress malware campaign hides payloads in Steam profiles](https://daily.dev/posts/wordpress-malware-campaign-hides-payloads-in-steam-profiles-nm8uhmlpa) · BleepingComputer · 0 upvotes · 0 comments - [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts](https://daily.dev/posts/when-scanners-miss-the-attack-how-cloudflare-client-side-security-protects-storefronts-fbmrifn8f) · Cloudflare · 0 upvotes · 0 comments - [Major security alert for iPhone users](https://daily.dev/posts/major-security-alert-for-iphone-users-6l54y270k) · TechCentral · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We Know 15,579 Websites Are Infected. How Do We Tell Them?","url":"https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i"},"datePublished":"2026-11-06T16:33:35.030Z","dateModified":"2026-11-06T21:18:31.874Z","description":"Report URI's threat intelligence has identified 15,579 websites currently infected with malicious JavaScript, receiving a combined 135 million visits a month....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/14c5e4d9a01f99d3ef4f5a9f0bef4047?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/14c5e4d9a01f99d3ef4f5a9f0bef4047?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Scott Helme","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Scott Helme","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/01acb643b26d47bab30089a607e07829","url":"https://daily.dev/sources/scotthelme"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,javascript,malware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Scott Helme","item":"https://daily.dev/sources/scotthelme"},{"@type":"ListItem","position":3,"name":"We Know 15,579 Websites Are Infected. How Do We Tell Them?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/we-know-15-579-websites-are-infected-how-do-we-tell-them--l7oehzo0i#faq","mainEntity":[{"@type":"Question","name":"What is the DeadTag attack technique that compromises websites via expired domains?","acceptedAnswer":{"@type":"Answer","text":"DeadTag is a threat group that buys expired domains still referenced by third-party JavaScript tags on live websites, revives those domains, and serves malware through them. It was identified as part of ongoing threat intelligence work tracking website compromises, alongside spyware campaigns named DarkSword and Coruna that target specific iOS versions. Developers auditing third-party scripts for supply chain risk can follow emerging threats like this on daily.dev."}},{"@type":"Question","name":"What are the main ways attackers get malicious JavaScript onto a legitimate website?","acceptedAnswer":{"@type":"Answer","text":"The main categories are direct compromise (often via WordPress vulnerabilities modifying site JS files), supply chain attacks (a loaded third-party script becomes infected), traditional XSS vulnerabilities allowing JS injection, and DeadTag-style attacks that revive expired domains still referenced by a site's script tags. Teams hardening their site's script dependencies can track these attack patterns on daily.dev."}},{"@type":"Question","name":"How many websites are currently infected with malicious JavaScript according to recent threat intelligence findings?","acceptedAnswer":{"@type":"Answer","text":"15,579 unique websites are confirmed infected with malicious JavaScript, a number that excludes thousands more sites under suspicion but not yet confirmed. These infected sites together receive a conservatively estimated 135 million visits per month, including several regional top-ranked sites in countries like France, Spain, and Germany. Security teams gauging the scope of web malware threats can follow this kind of research on daily.dev."}}]} ```