On 6 November 2026, Scott Helme, founder and CEO of Report URI, wrote that his company's threat intelligence crawler has confirmed 15,579 unique websites currently running malicious JavaScript, with thousands more suspected but not yet confirmed. Using what he calls "ultra-conservative" traffic estimates, he puts their combined traffic at more than 135 million visits a month. The list is not published, and sites drop off it once they are cleaned up.
What the infected sites do to visitors: Magecart skimmers that send full card details from payment pages to attackers; ClickFix lures, a fake "prove you're human" step that gets visitors to install malware; code that targets specific iOS versions with the DarkSword and Coruna spyware; and redirects to fake login pages, fake security warnings and scams. Many of the sites are regional leaders in countries such as France, Spain and Germany, often outside the global top one million.
How they got infected, according to Helme: direct compromise, typically through a WordPress or similar vulnerability, with the site's own JS files modified; a third-party script the site loads being compromised; XSS bugs; and DeadTag, a group Report URI named that buys expired domains that sites still load scripts from and uses them to serve malware. Helme's update names WordPress and Magento as likely exploited platforms but gives no per-platform counts.
The real problem is telling the owners. Few sites publish a security.txt file, WHOIS data is mostly unhelpful since GDPR, many sites sit behind CDNs so their host can't be identified, and disclosure emails go unanswered. Report URI still contacts sites it sees as especially high impact, but only on a small scale. Helme is asking national cybersecurity centres and CERTs to help, and offers the list to European NCSC/CERT teams. Report URI sells threat intelligence feeds commercially, so this is its own data and has not been independently verified.
