Report each domain to the major browser vendors so they can update their list of suspicious sites?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.
Make a website,
name it 15579infected.com and name everywebsite.
Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify.
You can charge them for your service.
In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.
The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided spam people, we would probably still have public contact info.
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
Primary obligation is to the users, not the owners of websites that got themselves infected.
https://www.ncsc.gov.uk/section/about-this-website/report-sc...
I suspect that these problems exist everywhere at this moment in all major systems.
Perhaps a bot to attempt to make contact and alert the staff.
im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable
My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.
Hope all of them explode.