This question is meant to ask for general guidance - although I will mention a specific example. (It is not my intention to call out a specific user - simply the issue is better explained on an example.)
I have noticed a domain which has several links on Stack Exchange (28 posts on Stack Overflow and 34 links networkwide.) When trying some of those links I got the warning:
Threat found This web page may contain dangerous content that can provide remote access to an infected device, leak sensitive data from the device or harm the targeted device. Threat: JS/Redirector.PSC
Google diagnostic tool run on this domain says: "Some pages on this site are unsafe The site contains harmful content, including pages that: Try to trick visitors into sharing personal info or downloading software."
It seems likely that the domain worked in the past. (I managed to find Wayback Machine links for some of those posts. In fact, in some cases those links have already been edited. And some of them have been replaced by a link to a new domain.) But after the domain expired, somebody else used the same domain and placed some harmful content there
What should be done in situations like this?
- Should I try to replace the links by the Wayback Machine links, if they are available? (Or a link to some new domain, if it is possible to find whether the original content was moved elsewhere.)
- What should be done if there isn't some suitable replacement for the link?
- If some site has many such links, should I notify the mods? Should I mention this on the per-site-meta?
- In the cases of locked posts, the only reasonable option I was able to think of was flagging for moderators' attention.
- I am not really sure what (if anything) should be done with the links in comments. (In this instance I found 8 comments on SO. I had to do this in one, two, three separate queries - since searching over all comments on SO times out.)
In this case I have option to notify the owner of the domain - the user seems to be still active on Stack Overflow. But in other similar cases, there might be no such possibility.
I found a related discussion on Meta Stack Overflow: How should questions that contain links to an infected/virus page be flagged? But that one seems to be mainly the discussion of a specific flag on one particular post.