Report URI has identified 15,579 websites still serving malicious JavaScript, security researcher Scott Helme reported on November 6. The company is finding infections faster than it can notify site owners and is asking national cybersecurity centres and computer emergency response teams for help. Visitors remain exposed while those warnings struggle to reach someone who can act.
The count is Report URI's assessment. MrKeyoor has not independently inspected the affected sites. Helme says the list excludes sites where the team is still uncertain and removes those that clear their infections. That makes it a reported snapshot of unresolved infections, rather than a cumulative count of everything the company has detected, according to his account.
Several routes to malicious JavaScript
Helme describes payment-card skimmers and ClickFix attacks, which lure visitors into installing malware through fake human-verification prompts. His report also lists malicious redirects and attacks aimed at exploiting particular iOS versions. These are different payloads across the detected sites, not evidence that every site carries every attack.
The entry points vary too. Report URI groups them into direct changes to a site's own files, compromised external scripts, cross-site scripting flaws and expired domains that websites still reference for JavaScript. In the last case, an attacker can buy a forgotten domain and resume serving code through an existing script tag, Helme explains. For a site operator, that distinction matters: an investigation has to account for code loaded from elsewhere as well as files under the operator's control.
A contact file has limits
Helme says most outreach goes unanswered and use of security.txt is low. Report URI crawls these sites itself, so it lacks the customer contact details it would otherwise use. It continues to approach particularly high-impact sites, but says it cannot scale that manual process.
For operators, RFC 9116 provides a defined place to publish reporting details: /.well-known/security.txt, served over HTTPS. The format requires a Contact field and an Expires timestamp. Keeping that contact current gives researchers a route to the organization, though it cannot ensure a response.
There is a complication when a site is already compromised. The RFC's incident-response guidance warns that an attacker can alter security.txt or redirect it, sending reports to the attacker instead. The document primarily addresses vulnerability reporting and urges extra caution when using the file for an active incident. Researchers need to verify the contact information through additional means before trusting it.
Helme is offering national response teams lists of infected sites in their regions, with a particular appeal to Europe, where he says the team is finding many affected sites. The next result to watch is whether that regional handoff reaches owners and leads to infections being removed. His announcement does not yet establish that outcome.