Compromised small, legitimate websites are among the top four security danger zones on the internet, says security firm Avast software.
"These sites have relatively low traffic, but the risk adds up dramatically when looked at globally," said Ondrej Vlcek, chief technology officer at Avast.
According to researchers at the firm, which provides basic security software for free, 85% of new malware infections are through websites, 60% of which are legitimate.
Typically a high-profile site will be infected for a very short period during which a large number of visitors are exposed to the malware.
But the majority of infected sites are for small businesses or hobby groups, where security is not a priority, said Vlcek.
Vodafone, City Furniture Clearance and Kids Play Centres are three UK brands that have had their sites hijacked in recent months, said Avast. The sites are all now safe to visit.
Web pages are made up of multiple elements such as scripts, iframes and meta-tags, all of which can be exploited as a way of passing on an infection.
In June, Avast detected 150,000 unique web domains with links to malware, including government, business and community sites covering all categories and topics.
The only danger zone web users can avoid is download sites, which are the most likely source of malware infections, said Vlcek.
But there is no way to avoid specially-created stealth sites, which are typically non-porn sites that appear clean and legitimate, he said.
"It is often not clear if these sites are set up to spread malware or are just poorly maintained, allowing them to be compromised," said Vlcek.
Another significant danger zone is infected search engine results and malicious adverts, he said.
Attackers identify popular search terms, often linked to current affairs, then hack legitimate sites or set up fraudulent sites that rank highly in search results.
Third-party adverts on legitimate websites are also commonly exploited to infect unsuspecting visitors, said Vlcek.
"The multiple layers in placing web advertisements creates more opportunities for infections to penetrate the system," he said.
According to Avast, this trend underlines the importance of having advanced threat detection systems in place and not relying on safe web browsing practises.
"There is nothing like a 'safe surfer' anymore," said Vlcek.