alt Hacker NewsMake a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.
Replies
This is the right move. Contrary to what the other comment says, this is not "name and shame". Instead, this is a database, useful to check for website owners to see if their site is listed inside.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.
He should just put up a txt file on his blog and call it a day.
I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.
Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.
Just give them the deets.