Malicious-code scanning tools are practically available for identifying suspicious websites. However, such tools only warn users about suspicious sites and do not provide clues as to why the sites were hacked and which vulnerability was responsible for the attack. In addition, the huge number of alarms burdens mangers while executing in-time-response duties. In this paper, a process involving feature modeling and data-mining techniques is proposed to help solve such problems.