As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.

https://www.ncsc.gov.uk/section/about-this-website/report-sc...

▲

pugworthy 6 hours ago | parent [-]

Yes, but 15k emails...

It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)

	▲	PMunch 6 hours ago \| parent [-]
		I guess this is exactly what WHOIS information is meant to provide, a way to contact the owner or administrator of a domain. Of course many sites today rely on WHOIS anonymization, but legit e-mails should still hopefully make it through to the owner.