TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Report URI founder Scott Helme says the company has identified 15,579 websites that are still serving malicious JavaScript, with a conservative estimate of more than 135 million visits a month across them. The company says it can verify the infections but lacks the resources and contact information to notify site owners at scale; it is asking national cyber-response teams and others for help.
Report URI has identified 15,579 websites that it says are currently infected with malicious JavaScript, and estimates those sites collectively receive more than 135 million visits a month. Founder Scott Helme says the security company can verify the infections but cannot contact affected operators at the pace its threat-intelligence work is finding them, and is asking national cyber-response teams and others to help notify them.
Helme’s report says the count includes unique sites that remain infected and for which Report URI has high confidence. The company removes sites from the active list after it detects that an infection has been cleared. Helme says there are also thousands of additional sites that appear suspicious but have not reached the same level of confidence. The 15,579 figure is therefore a count of confirmed, ongoing cases in the report, not every site the company has investigated.
The malicious scripts can be used for several kinds of abuse, according to the report. Examples include payment-card skimming on checkout pages, fake “prove you’re human” prompts that trick visitors into installing malware, and code intended to exploit some devices. Other scripts may redirect visitors to phishing pages, fake security alerts or scams. The effects depend on the attacker’s payload and target; the report does not say that every infected site uses every type of attack.
Helme groups suspected ways the scripts reach websites into direct compromise of a site, infection of a third-party script in the supply chain, cross-site scripting vulnerabilities, and a method the company calls DeadTag. In that last category, attackers reportedly acquire expired domains still referenced by websites and use them to serve malicious code. The report’s traffic estimate is described as conservative and draws on various data sources; it does not provide a site-by-site traffic breakdown in the supplied material.
The Notification Bottleneck
The disclosure highlights a gap between detecting compromised websites and getting a warning to the people able to fix them. Visitors may encounter malicious code through an otherwise familiar site, while the site operator may not know that its own files or a third-party resource have been altered. The potential reach is large: Report URI estimates more than 135 million monthly visits to the currently infected sites, though that is a combined estimate, not a count of affected individuals.
Helme says direct outreach is focused on sites considered particularly high impact and happens on a small scale. The report says responsible disclosure takes substantial staff time, security contact files are not widely used, and most emails or messages receive no response. If those constraints hold across a list this large, simply finding infections does not by itself get malicious code removed or warn visitors.
There is also a risk in how warnings are distributed. Helme says he has not published the full list partly because the sites are victims, and broad circulation could lead to domains being added to blocklists. Removing a site from such lists after remediation can be difficult, he says, potentially harming organisations that were already dealing with a compromise. That makes the choice of notification channel part of the response, not just an administrative detail.
Products Worth Considering
eufy Security Essential 7-Piece Alarm System with HomeBase Mini
Ring Alarm 14-Piece Wireless Security System
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
As an affiliate, we earn on qualifying purchases.
How Report URI Found the Sites
Report URI says its threat-intelligence capabilities have made it increasingly efficient at identifying websites that load malicious JavaScript. The report describes the affected sites as ones its team crawls and identifies itself, rather than customer sites for which the company already has account contacts. That leaves investigators with limited direct routes to the people responsible for remediation.
The count is a snapshot of infections that were still active when the report was written. Helme also refers to a tally of newly identified sites for September, while saying October processing was not complete. The supplied report does not give the September tally itself, so no monthly rate of new infections can be established from the information available here.
Helme says some affected sites are regional leaders even if they do not rank among the world’s largest websites. The report points to sites using French, Spanish and German country domains as examples. Its estimate of combined visits is intended to convey exposure across many sites, rather than suggest that any single infected site receives that volume.
““We know they’re infected, and we have the evidence to back that up, but there’s a problem: how on Earth do we tell them all?””
— Scott Helme, founder of Report URI
The Reach and Response Remain Unclear
The report does not identify the 15,579 sites publicly or provide enough detail in the supplied material to independently check each infection, its duration or its impact. Helme says the company has evidence for the listed cases, but the sites have not been named here. It is also unclear how many operators have already been privately notified, how many have acted, or how quickly infections are being removed.
The 135 million monthly visits figure is an estimate based on multiple sources, which the report describes as conservative; the methods and uncertainty range are not specified in the supplied text. It should not be read as 135 million distinct people or as proof that every visit resulted in exposure to a harmful payload. The report also does not provide a breakdown of attacks by type, country or infection vector.
Helme’s November 6, 2026 update says questions about why the list was not published had been raised on social platforms and a Hacker News discussion. He says one reason is avoiding a “name and shame” effect against site owners who are themselves victims. He also warns that domains could be absorbed into blocklists and that removal after cleanup may be difficult. The supplied update is cut off before all of his explanation is available, so its full account of the risks is not included here.
A Request for Coordinated Notification
Report URI is asking national cybersecurity centres and computer emergency response teams, particularly in Europe, to contact the company at intel@report-uri.com if they can help notify sites in their jurisdictions. Helme says Report URI would be willing to provide a region-specific list to those organisations. The report does not say that any agency has accepted the request or established a process for handling the data.
The company is also inviting suggestions from other organisations and people who may be able to use its threat-intelligence data to protect their customers. Helme says commercial access to its feeds may be available to organisations that believe the information could help them. For now, direct outreach to selected high-impact sites is continuing, but the report offers no timetable for wider notifications or a target date for reducing the active infection count.
Key Questions
How many websites does Report URI say are infected?
Report URI says 15,579 unique websites were still infected with malicious JavaScript when its report was published. It says thousands more sites were suspicious but had not met its confidence threshold for inclusion in the confirmed count.
What can the malicious JavaScript do?
The report describes possible uses including stealing payment-card details, directing visitors to phishing pages or scams, and tricking people into installing malware. The specific payload can vary; the report does not say every affected site carries the same threat.
Why has Report URI not published the site list?
Helme says publishing the list could unfairly expose site owners who are victims of attacks and could cause domains to be added to blocklists. He warns that removing a domain from blocklists after fixing an infection can be difficult. The supplied update does not include his full explanation.
How much traffic do the affected sites receive?
Report URI estimates the sites collectively receive more than 135 million visits per month, using data from various sources and what Helme calls conservative estimates. The figure is not a count of distinct visitors, and the report does not provide a detailed methodology in the supplied material.
What help is Report URI seeking?
Helme is asking national cyber-response centres and CERTs, especially in Europe, to contact Report URI about receiving lists of affected sites in their regions and helping notify operators. He is also inviting other organisations to suggest ways to use the data for remediation.
Source: scotthelme.co.uk
