Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.

Check this out:

Google 'There is also hang tag made of leather, a slip pocket to put cards' and go to the sites in the results and look at the source code of the page.

You'll see something like: <div style="position: absolute; top: -966px;left: -966px>...</div> with a lot of spammy shoe keywords in there.

Example of hacked site is the UC police dpt: http://www.ucapd.com/ (checkout the front page HTML and look for shoes...).

My question is:
- how did this happen?
- how can we contact all those guys who have been hacked?
- where can I report this to an authority?

share|improve this question

migrated from serverfault.com Jan 19 '11 at 7:09

This question came from our site for system and network administrators.

Good eye. Unfortunately, you're out of luck when it comes to notification -- that is, unless you're looking to try pretty hard to help out. If that's the case, you might script out the results of your google search, do a whois on the domains and send an email to the registered email. –  editor Jan 19 '11 at 0:39
In the meantime, you might ping Google and submit "mbtshoessale100" as a spammy/malicious website. –  editor Jan 19 '11 at 0:39
I edited the question to remove links to the spam site. No reason to give them additional links - not to mention that we shouldnt be found to have links there either... –  AviD Jan 20 '11 at 1:25
Details on the exploit are described on blog.armorize.com/2011/04/… –  Hendrik Brummermann Apr 20 '11 at 6:18

3 Answers 3

If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites:

And some places you can report bad/malicious sites in general:

Reporting the site to these lists helps other users. Many modern browsers will query one of the lists maintained by these companies, and warn other users who try to visit that site.

Notifying the owners of the website is a bit harder. Here are some options:

  • You can poke around the website to see if it lists any information about how to notify the owners about security problems.
  • Sometimes email to security@example.org, abuse@example.org, root@example.org, or postmaster@example.org will reach a system administrator (replace example.org with the domain of the malicious site). You could try emailing all of those addresses.
  • You could use Whois to look for contact information for the site owners. See, e.g., this example. You can use abuse.net to simplify the process of contacting the site owners: you'll have to register, but once you register, email to example.com@abuse.net is forwarded to the site owners of example.com.

See also What are common/official methods of reporting spam/phishing/nasty-grams to organizations? and Unknown malware, how to report it and whom to report it to? and What is a good method to report security breaches that are being used to actively spam? for related topics.

Footnote: Thanks to Zoredache for the sites listed with a *!

share|improve this answer
Great answer - you rock, D.W.! –  nealmcb Jan 19 '11 at 14:27
Which is most effective? In August, a friend was phished and his compromised email account used to do more phishing. I reported the phish's URL and even after a FEW WEEKDAYS, the URL was still live and not blacklisted. It was listed after about a week, and is now dead. Archive: archive.is/vaoDa I had reported it to PhishTank, to the site's upstreams (level3, globix), to google (as the phish was for gmail credentials) w/ a copy of the phish (with full headers), noting the use of a phished email account). I also just added US-CERT's reporting site to the above answer's list. –  Matthew Elvey Sep 30 '14 at 17:38
I did a bit of research to try to answer my follow-up question. OpenDNS runs PhishTank, and feeds info to the APWG (source). APWG ONLY feeds info to PAYING members (source), which means that non-paying members, like US-CERT and OpenDNS, do NOT get the info. –  Matthew Elvey Sep 30 '14 at 18:03

Contact The Department of Justice. In some states of the United States hacking another private computer is a class B Felony. On conviction it comes with 20 years in prision.

share|improve this answer
If you don't mind me posting the link to The Department of Jusice. Here you are. justice.gov/criminal/cybercrime/reporting.html –  Computer Weary Dec 7 '13 at 3:52

That site is registered through a GoDaddy subsidiary - contact GoDaddy Abuse for starters:


share|improve this answer
I took the liberty of editing the answer to remove the link to the spam/phishing site. –  AviD Jan 20 '11 at 1:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.