The old answer I've heard is to look up what their address and room number is in WHOIS and walk over or pick up the phone!

But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)

Google already does that, and they warn users about malicious sites. The question is: are these sites already flagged by google?