We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month.
We know they're infected, and we have the evidence to back that up, but there's a problem: how on
I’d use “webmaster@”, which is a pretty long-running convention, though I don’t know how many people have it set up. I don’t know if there’s an RFC backing that.
If you’re going to provide a standard contact admin email for a website, that’s where I’d expect it to be, at any rate.
EDIT:
Yeah, webmaster@; RFC 2142.
https://www.rfc-editor.org/info/rfc2142/