Yes, but they still block websites that are not connected to Google Webmaster Tools, and the site owners may not realize it. It would be nice if they notified the domain registrant as a heads-up because most small biz site owners that find their way to me may have sites that were designed years ago that need little to no maintaining, so they don't know they've been blocked as they barely ever look at their own sites.

We explored trying to email whois contacts or standard addresses (such as webmaster@example.com or postmaster@example.com) and essentially got zero pickup. That's one of the reasons we provide Webmaster Tools, and so far it's our best channel to notify small business owners.

We can sometimes label sites as hacked in the search results, but Webmaster Tools is definitely the preferred channel for communication of stuff like this.

"We explored trying to email whois contacts or standard addresses"

Ironic since the original reason for the tech contact was exactly to be notified for issues like this.

Would like to add that as a registrar though we get a reasonably good response to emails that we send. [1]

Perhaps there is something about getting an email from google that says "it's probably spam". Or any large well known company that is often the subject of spam attempts.

Even given that though it's hard for me to believe that the results were close to zero.

[1] We also find that when a domain is deleted for non payment the person frequently claims they received no email notice but then proceeds to make some reference to something that was on the email notice.

Man, we could talk about this for hours. There's a lot of nuances involved in trying to alert site owners to issues, especially at a large scale. We've tried about 6-7 approaches over the years, and I'm still not completely happy with where we are. Freehosts are especially tough (WordPress, Blogger, etc.) because whois would just never work there.

Thanks for the clarification, Matt. Does such an action from google also include penalizing the website in terms of page rank and search rankings?

Yes, but it varies, because we have automatic malware detection, automatic hacked site detection, and manual hacked site detection.

For example, if we manually detect that a subdirectory of a site is hacked, we may remove only that subdirectory from our search results. If your entire site is hacked, then your entire site may be demoted or removed until the site is clean.