Where to report malicious URLs, phishing, and malicious web sites?

Question

I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.

Check this out:

Google 'There is also hang tag made of leather, a slip pocket to put cards' and go to the sites in the results and look at the source code of the page.

You'll see something like: <div style="position: absolute; top: -966px;left: -966px>...</div> with a lot of spammy shoe keywords in there.

Example of hacked site is the UC police dpt: http://www.ucapd.com/ (checkout the front page HTML and look for shoes...).

My question is:
- how did this happen?
- how can we contact all those guys who have been hacked?
- where can I report this to an authority?

Answer 1

If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites:

• Report a phishing site to Google
• Report a phishing site to Symantec
• Report a phishing site to Yahoo [*]
• Report a phishing site to PhishTank (you will need to register for their site first)
• Report a phishing site to Badwarebusters.org [*]
• Report a phishing site to Anti Phishing Working Group
• To report a phishing site to Microsoft: Visit the site in Internet Explorer 7, go to the Tools menu, select Phishing Filter, and click Report This Website. If you use Internet Explorer 8, go to the Safety menu, click Smartscreen Filter, click Report Unsafe Website, fill out the form, and submit it.

And some places you can report bad/malicious sites in general:

• Report a malicious site to Google [*]
• To report a malicious site to Microsoft: Visit the site in Internet Explorer 8 and follow the instructions listed above.
• Report a bad URL to Badwarebusters.org [*]

Reporting the site to these lists helps other users. Many modern browsers will query one of the lists maintained by these companies, and warn other users who try to visit that site.

Notifying the owners of the website is a bit harder. Here are some options:

• You can poke around the website to see if it lists any information about how to notify the owners about security problems.
• Sometimes email to security@example.org, abuse@example.org, root@example.org, or postmaster@example.org will reach a system administrator (replace example.org with the domain of the malicious site). You could try emailing all of those addresses.
• You could use Whois to look for contact information for the site owners. See, e.g., this example. You can use abuse.net to simplify the process of contacting the site owners: you'll have to register, but once you register, email to example.com@abuse.net is forwarded to the site owners of example.com.

See also What are common/official methods of reporting spam/phishing/nasty-grams to organizations? and Unknown malware, how to report it and whom to report it to? and What is a good method to report security breaches that are being used to actively spam? for related topics.

Footnote: Thanks to Zoredache for the sites listed with a *!

Answer 2

That site is registered through a GoDaddy subsidiary - contact GoDaddy Abuse for starters:

https://supportcenter.godaddy.com/Abuse/SpamReport.aspx