I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek restaurant website in the Netherlands.

This, to my mind is a compromised website who are most likely unaware of their situation.

Should I inform them? or their webhost? and if so what is advised?

  • 4
    Inform the webhosting provider that that website runs on. The site's owner may not have any idea what you're talking about; the webhosting provider almost certainly will. Commented Jan 5, 2014 at 1:06

4 Answers 4


Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.

  • 1
    No admin listed in their whois. I've contacted their hosting provider.
    – kobrien
    Commented Jan 5, 2014 at 1:31
  • 1
    @kobrien - there has to be technical and administrative contacts in the WHOIS database. Its an ICANN requirement (see Section 3.3 of the registrar agreement). Be sure you are using the right WHOIS - APNIC for Asia, RIPE for Europe, etc. And ICAAN changed the rules in 2013 to disable domains without valid information (to ensure accuracy). See WHOIS ACCURACY PROGRAM SPECIFICATION.
    – user29925
    Commented Feb 19, 2014 at 5:50

In addition to the administrative and technical contacts from the WHOIS database, you also have the well known addresses from RFC 2142, MAILBOX NAMES FOR COMMON SERVICES, ROLES AND FUNCTIONS:


   Operations addresses are intended to provide recourse for customers,
   providers and others who are experiencing difficulties with the
   organization's Internet service.

   MAILBOX        AREA                USAGE
   -----------    ----------------    ---------------------------
   ABUSE          Customer Relations  Inappropriate public behaviour
   NOC            Network Operations  Network infrastructure
   SECURITY       Network Security    Security bulletins or queries



   For major Internet protocol services, there is a mailbox defined for
   receiving queries and reports.  (Synonyms are included, here, due to
   their extensive installed base.)

   -----------    ----------------    ---------------------------
   POSTMASTER     SMTP                [RFC821], [RFC822]
   HOSTMASTER     DNS                 [RFC1033-RFC1035]
   USENET         NNTP                [RFC977]
   NEWS           NNTP                Synonym for USENET
   WEBMASTER      HTTP                [RFC 2068]
   WWW            HTTP                Synonym for WEBMASTER
   UUCP           UUCP                [RFC976]
   FTP            FTP                 [RFC959]

Just to add to the previous answers:

You can sent a formal but simple worded email to the hacked website contact (if it seems to be legit). I usually sent something along the lines of

Dear madam/sir

My name is ..... and I have reason to believe your website has been hacked because ...reason... I'd suggest you contact your technical staff or your hosting provider to resolve the issue. Bellow you can find more detailed technical information in case it helps.

...Some text with any technical information that might be helpful....

and then pretty much the same to the hosting provider

also, if you can, it would be good to inform the restaurant's hosting provider that their website is serving malware


I would read the WebSite's WhiteHat policy, Some websites have a page describing what to do if you have found a security vulnerability, for example here is GitHub's, It would also be a good idea to disclose your find in a private manner, for example don't publish it on your blog, Some websites also have a PGP key do you can contact the security team more privately.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .