Highest-leverage move: report the domains straight to the browsers.

https://safebrowsing.google.com/safebrowsing/report_badware/
https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site

...and ppl who think that JS was a mistake are prob right.