TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Report URI says it has identified 15,579 websites that are still running malicious JavaScript and estimates they collectively receive more than 135 million visits per month. The security firm says direct notifications are not keeping pace with its findings and is asking national cyber response teams and others for help reaching affected site operators.
Security firm Report URI says it has identified 15,579 websites that are still serving malicious JavaScript, with the sites estimated to receive more than 135 million visits a month. The company says it cannot notify most operators at the pace it is finding infections, and is asking national cyber response teams and other organisations to help contact those affected.
The figures come from a report by Scott Helme, who said Report URI’s threat intelligence work had identified the sites with a high level of confidence. The count covers sites that were still infected at the time of the report; Report URI removes sites from its active list after it sees that their infections have been cleared. Helme said the number of sites with suspected, but not yet confirmed, infections was in the thousands more.
The malicious scripts can support several types of harm, according to the report. These include payment-card skimming, fake “prove you’re human” prompts designed to trick visitors into installing malware, scripts that target certain devices, and redirects to phishing pages or scams. Report URI grouped suspected ways the scripts get onto sites into direct compromise of a site, an infected third-party script, cross-site scripting vulnerabilities, and a group it calls DeadTag, which it says uses expired domains that websites still load scripts from.
Helme said the monthly traffic estimate was based on various data sources and was deliberately conservative. The report does not provide a site-by-site traffic breakdown in the supplied material. It notes that some affected sites are prominent within their own countries, despite not ranking among the world’s largest sites. Report URI said it currently contacts sites it considers especially high impact, but that disclosure work takes substantial resources and many messages go unanswered.
How Delayed Warnings Expose Visitors
The count matters because malicious code on a website can put its visitors at risk without requiring them to seek out a suspicious site. Depending on the script and the attacker’s aim, a visit could expose a person to payment theft, phishing, scams, or malware. The reported monthly audience estimate indicates the potential reach, but it is not a count of people harmed or of successful attacks.
The disclosure problem also highlights a gap between finding compromised sites and getting warnings to the people who can fix them. Report URI says it has no customer contact records for sites it discovers through its own crawling, and that the use of security.txt contact files is low. If site operators do not receive or act on a warning, the malicious script may remain available to visitors. The report does not establish how long each infection has lasted or how many visitors have been affected.
There is a competing risk in making the list public. Helme said naming sites could amount to publicising victims and could lead to domains being added to blocklists. He warned that removal from those lists can be difficult, potentially harming legitimate operators even after they fix an infection. That concern helps explain why the report seeks help with targeted notification rather than simply publishing the full list.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
DJI Mini 5 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
From Detection to Responsible Disclosure
Report URI says its threat intelligence capabilities have made it more efficient at finding compromised websites. Helme’s report describes a mismatch: detections are accumulating faster than the company can notify site owners. It says reaching out to selected high-impact sites is already happening, but only on a small scale because the process consumes staff time and messages often receive no response.
The report also gives a September tally of newly identified infections, but the supplied source does not include the figures from that tally. It says October processing was incomplete when the report was written. The headline total of 15,579 sites is a current-infection count, not the full number of sites ever identified: sites that had removed their malicious scripts were taken off the active list.
In an update dated November 6, 2026, Helme addressed questions raised on social media and Hacker News, including why Report URI had not published the affected-site list. He said the listed sites were victims and that broad distribution could make it difficult for a business to get its domain removed from blocklists. The supplied update text ends before the full explanation is given, so no further reasons can be confirmed here.
“We know they’re infected, and we have the evidence to back that up, but there’s a problem: how on Earth do we tell them all?”
— Scott Helme, in the Report URI report
The Reach and Response Remain Unverified
The report’s figures are Report URI’s own findings and estimates; the supplied material does not include an independent audit, the full underlying list, or the methods and inputs behind each traffic estimate. The 135 million figure represents estimated monthly visits across the sites, not unique visitors, confirmed exposures, or proven cases of data theft.
It is also unclear how many site operators have received a warning, how many have acted on one, and how long the listed infections have been active. The report says thousands of additional sites are suspected but not confirmed, without giving a precise count. The supplied November update begins to explain the choice not to publish the list but does not contain its complete text, so the full set of reasons is not available here.
Report URI Seeks Regional Response Teams
Helme asked national cyber security centres and computer emergency response teams, particularly those in Europe, to contact Report URI at intel@report-uri.com. The company says it is willing to provide a list of infected sites in a team’s region in the hope that public agencies can reach operators more effectively. Organisations interested in commercial access to its threat intelligence feeds are also directed to the same address.
Report URI has not announced a new notification system or a timetable for resolving the backlog. Its immediate next step, as described in the report, is to seek partners and suggestions while continuing limited direct outreach to sites it views as especially high impact. Whether those efforts lead to broader notifications, and how many operators respond, remains to be seen.
Key Questions
How many websites does Report URI say are infected?
Report URI says 15,579 websites were still infected with malicious JavaScript when it reported the figure. It says thousands more were suspected but not yet confirmed.
What can the malicious JavaScript do?
The report describes scripts used for payment-card skimming, phishing redirects, scams, malware prompts, and attacks aimed at certain devices. The threat depends on the script and the attacker’s objective.
Why hasn’t Report URI published the affected-site list?
Helme said the site operators are victims and that a public list could lead to domains being added to blocklists, which can be difficult to reverse. The supplied update does not include the complete explanation.
How can cyber response teams help?
Report URI asked national cyber security centres and CERTs, especially in Europe, to contact intel@report-uri.com to discuss receiving a regional list and notifying affected operators.
Source: scotthelme.co.uk
