I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked.

Check this out: Google the text 'There is also hang tag made of leather, a slip pocket to put cards' and go to the sites in the results and look at the source code of the page.

You'll see something like: <div style="position: absolute; top: -966px;left: -966px>...</div> with a lot of spammy shoe keywords in there.

Example of hacked site:

My question is:

  • How did this happen?
  • How can we contact all those guys who have been hacked?
  • Where can I report this to an authority?
  • Good eye. Unfortunately, you're out of luck when it comes to notification -- that is, unless you're looking to try pretty hard to help out. If that's the case, you might script out the results of your google search, do a whois on the domains and send an email to the registered email.
    – editor
    Jan 19, 2011 at 0:39
  • In the meantime, you might ping Google and submit "mbtshoessale100" as a spammy/malicious website.
    – editor
    Jan 19, 2011 at 0:39
  • 3
  • I edited the question to remove links to the spam site. No reason to give them additional links - not to mention that we shouldnt be found to have links there either...
    – AviD
    Jan 20, 2011 at 1:25
  • 1
    Details on the exploit are described on blog.armorize.com/2011/04/… Apr 20, 2011 at 6:18

2 Answers 2


If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites:

And some places you can report bad/malicious sites in general:

Reporting the site to these lists helps other users. Many modern browsers will query one of the lists maintained by these companies, and warn other users who try to visit that site.

Here is a good list of places to report to: https://decentsecurity.com/#/malware-web-and-phishing-investigation/

Notifying the owners of the website is a bit harder. Here are some options:

  • You can poke around the website to see if it lists any information about how to notify the owners about security problems.
  • Sometimes email to [email protected], [email protected], [email protected], or [email protected] will reach a system administrator (replace example.org with the domain of the malicious site). You could try emailing all of those addresses.
  • You could use WHOIS to look for contact information for the site owners. See, this example. You can use abuse.net to simplify the process of contacting the site owners: you'll have to register, but once you register, email to [email protected] is forwarded to the site owners of example.com.


Footnote: Thanks to Zoredache for the sites listed with a *!


That site is registered through a GoDaddy subsidiary - contact GoDaddy Abuse for starters:



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .