Hacker News
points by ryan_glass 1 day ago | 0 comments
Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.
[–] Jolter 1 day ago
Try automating that for 15k sites and you have a whole new engineering problem in front of you!

It should be more or less possible though. Just not easy.

[–] vntok 1 day ago
Just send a bunch of emails a day for days, for weeks, for months. It's perfectly fine if those compromised websites aren't ALL notified on the exact same day.