I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
> Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem
You've unwittingly helped to spread malware to an innocent person, so yes, it is your problem.
When somebody reports that you are spreading malware, what do you do with that information?
"I run a website where people can upload files."
This is an incredibly brave thing to do in 2026.
Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".
UPDATE: Unpopular because it means there's a lot of work for the owner to moderate the files. And large sites like facebook are notorious for very bad moderation. It's not like we mandate them to hire N moderators per M users.