TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Report URI founder Scott Helme says the company has identified 15,579 websites that are still running malicious JavaScript, with an estimated combined 135 million visits a month. He says the team cannot notify site owners at that scale and is asking national cyber response teams and others for help. The site list has not been published, in part because affected organisations are victims and public lists could cause lasting harm.
Security researcher Scott Helme says Report URI has identified 15,579 websites still running malicious JavaScript, which the company estimates collectively receive more than 135 million visits each month. Helme is asking national cyber response teams and other organisations to help alert site owners, saying the number of infections is growing faster than his team can contact those affected.
Helme said the 15,579 sites are cases where Report URI has high confidence of an active infection. The tally excludes sites that have cleared their infections; the company has found additional sites where it has suspicions but not enough evidence to classify them with the same confidence. The report does not provide a public list of affected domains.
The malicious scripts can be used for several kinds of harm, according to Helme: payment-card skimming, deceptive “prove you’re human” prompts that lead users toward malware, spyware delivery targeting some devices, and redirects to phishing pages or scams. He groups the ways scripts reach sites into direct compromise, infected third-party services, cross-site scripting vulnerabilities, and expired domains that attackers have revived to serve malware.
Helme said Report URI contacts sites it considers particularly high impact, but that outreach is limited. The company often lacks direct contact details for sites it discovers through crawling, security contact files are not widely used, and many emails or messages receive no response. He invited national cyber security centres and computer emergency response teams, particularly in Europe, to contact Report URI for information about infections in their regions.
Millions of Visits May Be Exposed
The reported figure describes potential exposure across a large number of websites, including regional leaders that may not rank among the world’s most visited sites. An infected page can expose visitors to fraud, phishing, or malicious downloads, depending on the script and the attacker’s goal. The reported 135 million monthly visits is an estimate of traffic to the affected sites, not a confirmed count of people harmed or devices compromised.
The disclosure also highlights a gap between finding security incidents and getting warnings to the people able to fix them. If site administrators do not receive or act on a notification, malicious code may remain available to visitors. At the same time, publishing a list of vulnerable sites could expose them to additional scrutiny or cause third parties to block them even after repairs, so notification methods carry risks of their own.
Products Worth Considering
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Report URI Identifies Infections
Report URI provides web security services and says its threat-intelligence capabilities have made it more efficient at detecting malicious scripts on websites it observes. Helme’s report describes the 15,579 domains as sites that were still infected at the time of the tally; it does not present the number as every site detected over the full period. The company said it had not finished processing all October data and used September as an example of its detection activity.
The report identifies several routes for malicious code to appear. Attackers may alter a site’s own JavaScript after compromising it, exploit a site vulnerability to inject code, or compromise a third-party script provider whose code is loaded by many sites. In another pattern Helme calls “DeadTag,” attackers acquire expired domains that websites still reference, then use those domains to deliver scripts. These are the researcher’s categories based on activity his team says it has observed.
In an update dated November 6, 2026, Helme addressed questions about why the affected-site list was not made public. He said the aim was not to “name and shame” organisations that are victims of attacks. He also warned that domains added to blocklists could have difficulty being removed after an infection is fixed. The update’s stated concerns frame the disclosure as a notification problem, not a public accusation against site owners.
““We’ve identified 15,579 websites that are currently infected with malicious JavaScript.””
— Scott Helme, Report URI
The Evidence and Reach Remain Unclear
The report does not name the 15,579 websites or provide a way for readers to independently check each case. It also does not detail the detection method, the exact observation period for the current tally, or how the 135 million monthly visits estimate was calculated. Helme describes the traffic estimate as conservative, but the report does not give a confidence range or specify how much traffic reaches infected pages rather than other parts of each site.
The number of additional suspected infections is also not quantified beyond “thousands more,” and it is unclear how many site owners have received a warning or acted on one. The report does not establish that every visitor to an infected site encountered a malicious payload or suffered harm. The scale of actual user impact therefore remains unknown.
Regional Response Teams Asked to Help
Helme asked national cyber security centres and computer emergency response teams, especially in Europe, to contact Report URI at intel@report-uri.com to discuss receiving information about infected sites in their regions. The company hopes those bodies may be better placed to reach organisations than its own direct outreach. It also invited organisations interested in commercial access to its threat-intelligence feeds to use the same address.
The report does not announce a formal notification partnership, a timetable for distributing regional lists, or a target date for clearing the infections. Helme said he is seeking suggestions from security organisations and readers, while continuing limited direct outreach to sites he considers particularly high impact. The next development will depend on whether responders agree on a way to share actionable warnings without creating lasting reputational or blocking problems for sites that are already victims.
Key Questions
How many websites does Report URI say are infected?
Scott Helme reported 15,579 websites still infected with malicious JavaScript. He said the figure covers cases where his team has high confidence and excludes sites that have already cleared their infections.
What kinds of threats can the scripts deliver?
Helme cited payment-card skimmers, phishing redirects, deceptive prompts linked to malware, and spyware delivery among the threats. The effect depends on the specific script and the attacker’s objective.
Why has the affected-site list not been published?
Helme said the site owners are victims, and he did not want to publicly shame them. He also warned that domains added to blocklists may be difficult to remove from them after the infection is fixed.
What is the 135 million figure measuring?
It is Report URI’s estimate of the combined monthly visits to the affected websites. It is not a confirmed count of visitors who encountered malicious code or suffered harm.
How can organisations help?
Helme asked national cyber security centres and emergency response teams, particularly in Europe, to contact Report URI at intel@report-uri.com about receiving regional information and helping notify affected site owners.
Source: scotthelme.co.uk
