Hi @speckx I'm going to guess that there won't be 15K hosting providers behind all of those websites...so I suggest considering the following:

* If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list.

* Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world.

Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners.

Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps!

This. abuse@ works.