Can't you do a .well-known or DNS handshake (like certbot) so people prove domain ownership, then hand then the report of what you found on their domain?

You gave email addresses to contact you - for NCSC/CERT and for entities who want to incorporate your threat intelligence data into their protection models.

What's the email address for owners of 1 or 1000 sites to find out if they're listed in your stewpot?