Researchers have identified 15,579 websites infected with malicious JavaScript, conservatively estimating they receive more than 135 million visits per month. Although they have evidence of the infections, the key challenge is how to notify the affected site owners.