Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek restaurant website in the Netherlands.

This, to my mind is a compromised website who are most likely unaware of their situation.

Should I inform them? or their webhost? and if so what is advised?

share|improve this question
4  
Inform the webhosting provider that that website runs on. The site's owner may not have any idea what you're talking about; the webhosting provider almost certainly will. –  Shadur Jan 5 at 1:06

4 Answers 4

up vote 11 down vote accepted

Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.

share|improve this answer
    
No admin listed in their whois. I've contacted their hosting provider. –  kobrien Jan 5 at 1:31
    
@kobrien - there has to be technical and administrative contacts in the WHOIS database. Its an ICANN requirement (see Section 3.3 of the registrar agreement). Be sure you are using the right WHOIS - APNIC for Asia, RIPE for Europe, etc. And ICAAN changed the rules in 2013 to disable domains without valid information (to ensure accuracy). See WHOIS ACCURACY PROGRAM SPECIFICATION. –  jww Feb 19 at 5:50

In addition to the administrative and technical contacts from the WHOIS database, you also have the well known addresses from RFC 2142, MAILBOX NAMES FOR COMMON SERVICES, ROLES AND FUNCTIONS:

4.  NETWORK OPERATIONS MAILBOX NAMES

   Operations addresses are intended to provide recourse for customers,
   providers and others who are experiencing difficulties with the
   organization's Internet service.

   MAILBOX        AREA                USAGE
   -----------    ----------------    ---------------------------
   ABUSE          Customer Relations  Inappropriate public behaviour
   NOC            Network Operations  Network infrastructure
   SECURITY       Network Security    Security bulletins or queries

and

5.  SUPPORT MAILBOX NAMES FOR SPECIFIC INTERNET SERVICES

   For major Internet protocol services, there is a mailbox defined for
   receiving queries and reports.  (Synonyms are included, here, due to
   their extensive installed base.)

   MAILBOX        SERVICE             SPECIFICATIONS
   -----------    ----------------    ---------------------------
   POSTMASTER     SMTP                [RFC821], [RFC822]
   HOSTMASTER     DNS                 [RFC1033-RFC1035]
   USENET         NNTP                [RFC977]
   NEWS           NNTP                Synonym for USENET
   WEBMASTER      HTTP                [RFC 2068]
   WWW            HTTP                Synonym for WEBMASTER
   UUCP           UUCP                [RFC976]
   FTP            FTP                 [RFC959]
share|improve this answer

Just to add to the previous answers:

You can sent a formal but simple worded email to the hacked website contact (if it seems to be legit). I usually sent something along the lines of

Dear madam/sir

My name is ..... and I have reason to believe your website has been hacked because ...reason... I'd suggest you contact your technical staff or your hosting provider to resolve the issue. Bellow you can find more detailed technical information in case it helps.

...Some text with any technical information that might be helpful....

and then pretty much the same to the hosting provider

also, if you can, it would be good to inform the restaurant's hosting provider that their website is serving malware

share|improve this answer

I would read the WebSite's WhiteHat policy, Some websites have a page describing what to do if you have found a security vulnerability, for example here is GitHub's, It would also be a good idea to disclose your find in a private manner, for example don't publish it on your blog, Some websites also have a PGP key do you can contact the security team more privately.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.