Working log for Ethics. Every query with its population and denominator, the report script with its unedited output, both folds with their residue printed in full, every quote with its verification verdict, the external sources with how each was checked, and what could not be established. Corpus-wide caveats — the venue scope, the selection funnel, the provisional 2025–2026 slice — are on Corpus and are not repeated here.

Voice here is a working log, not prose. It is read by somebody checking a number.

No ~~DISCUSSION~~ block: comments belong on the content page, following the convention set by the earlier provenance pages.

Every figure on the page names one of these. None of them is “of 5,859 papers”.

crawlOnly is this page's own construction and is not one of the corpus's named populations. It exists because the page's central claim is a contrast between two study kinds, and crawled alone conflates them: 149 of the 1,120 crawling papers also recruited participants, and those 149 report at nearly the human-subjects rate. Without splitting them the crawl figure reads 27.7% instead of 21.3%, and the contrast the page is about is diluted by a third.

ethics is an object, not an array, and it can be null. 4,472 of the 5,118 empirical papers carry one; 646 do not. This matters more than it sounds:

• scripts/site_queries.mjs --page ethics reports reviewOutcome against 5,118 but reports notifiedAffectedParties, regulatorContact and robotsTxt against 4,472. Mixing the two moves every share by about 13%.
• report_ethics.mjs therefore always prints no-ethics-record as its own visible row and never merges it into none-mentioned. Sections A, B and F use 5,118 or 1,120 (the full population, with the absent record shown); section H uses 4,472 and says so in the column header.

const OUTCOMES = ['approved', 'exempt', 'not-required', 'sought-outcome-unstated',
                  'explicitly-discussed-no-review'];
const statesReview = (p) => p.ethics !== null && OUTCOMES.includes(p.ethics.reviewOutcome);
const approved     = (p) => p.ethics !== null && ['approved','exempt'].includes(p.ethics.reviewOutcome);

explicitly-discussed-no-review is counted as stated. A paper that says “we considered the ethics and did not seek review” has said something checkable, which is what this page measures. It is 318 of 5,118 empirical papers, and every table that uses statesReview also prints the approved/exempt column so a reader who disagrees can subtract. The page says this in its limitations section rather than burying it here.

scripts/report_ethics.mjs — every figure on the page with its denominator, plus both folds' residue, the full-text sweeps, and a block listing every non-corpus number so check_page_numbers.mjs can run whole-page.

node scripts/report_ethics.mjs                  # plain text (below)
node scripts/report_ethics.mjs --wiki           # DokuWiki tables
node scripts/report_ethics.mjs --list <key>     # the papers behind a figure
node scripts/report_ethics.mjs --quotes <re>    # ethics evidence quotes matching a regex

--list keys: crawlonly-approved, crawlonly-silent, robots-stated, no-review-discussed, menlo, nhs, residential-proxy, aup, no-review-body, tos.

Unedited output, 2026-08-18:

report_ethics.txt

# practices/ethics — dataset queries
Corpus: 7 venues, 2010–2026, 5859 papers with full text.
2025 is thin at the edges and 2026 is provisional (CCS/IMC 2026 not yet held; IEEE S&P and WWW 2026 abstracts absent from OpenAlex).
 
Population       Definition                                                   Papers
---------------  -----------------------------------------------------------  ------
`empirical`      measured the world as it is                                  5118
`crawled`        `crawlConfig` fired or `studyTypes` has automated-web-crawl  1120
`humanSubjects`  `participants[]` fired                                       1357
`crawlOnly`      crawled **and** recruited nobody                             971
 
## A. Ethics review outcome, of the 5,118 empirical papers
 
`ethics.reviewOutcome`            Papers  Share of 5118  Sentinel?
--------------------------------  ------  -------------  ---------
`approved`                        994     19.4%
`exempt`                          157     3.1%
`not-required`                    179     3.5%
`sought-outcome-unstated`         80      1.6%
`explicitly-discussed-no-review`  318     6.2%
`none-mentioned`                  2744    53.6%          yes
`no-ethics-record`                646     12.6%          yes
 
**Stated something about review: 1728 of 5118 (33.8%).**
Of those, 1151 (66.6% of the 1728) report an approval or an exemption; the rest state a review was not required, was sought with no outcome given, or was explicitly discussed and not obtained.
 
## B. Who states a review outcome: participants vs no participants
 
Population                                      Papers  States a review outcome  Approved or exempt  Silent
----------------------------------------------  ------  -----------------------  ------------------  ------------
`humanSubjects` — recruited participants        1357    1022 (75.3%)             896 (66.0%)         335 (24.7%)
`crawled` — ran a crawl (any)                   1120    310 (27.7%)              188 (16.8%)         810 (72.3%)
  …of which also recruited participants         149     103 (69.1%)              95 (63.8%)          46 (30.9%)
  …**`crawlOnly` — crawled, recruited nobody**  971     207 (21.3%)              93 (9.6%)           764 (78.7%)
`empirical` — all empirical papers              5118    1728 (33.8%)             1151 (22.5%)        3390 (66.2%)
 
"Silent" = `none-mentioned` plus papers where no `ethics` record was extracted at all.
 
## C. Reporting a review outcome, over time
 
Window      `empirical` N  states  %      `humanSubjects` N  states  %      `crawlOnly` N  states  %
----------  -------------  ------  -----  -----------------  ------  -----  -------------  ------  -----
2010–2013   460            47      10.2%  84                 24      28.6%  89             6       6.7%
2014–2017   718            155     21.6%  155                91      58.7%  155            23      14.8%
2018–2021   1272           378     29.7%  329                230     69.9%  262            42      16.0%
2022–2024   1649           681     41.3%  486                414     85.2%  299            86      28.8%
2025–2026*  1019           467     45.8%  303                263     86.8%  166            50      30.1%
 
\* 2025–2026 is provisional; see the corpus caveat above.
Gap between the two study kinds, latest complete window (2022–2024): 85.2% vs 28.8%.
 
## D. Reporting a review outcome, by venue (empirical papers)
 
Venue            Empirical papers  States a review outcome  Share  Cites the Menlo Report  Share
---------------  ----------------  -----------------------  -----  ----------------------  -----
PoPETs           477               259                      54.3%  14                      2.9%
USENIX Security  1226              506                      41.3%  76                      6.2%
IEEE S&P         646               246                      38.1%  26                      4.0%
IMC              625               208                      33.3%  46                      7.4%
NDSS             586               189                      32.3%  29                      4.9%
CCS              818               197                      24.1%  24                      2.9%
TheWebConf       740               123                      16.6%  10                      1.4%
 
## E. What kind of body reviewed it (of the papers that name one)
 
1347 of 5118 empirical papers name a review body, in **595 distinct strings**.
The fold is single-label and ordered (most specific family first); 2 strings matched nothing, and 2 are a sentinel written into the free-text field ("not stated") and belong to no family.
 
Kind of body                                                   Papers  Share of 1347 naming one
-------------------------------------------------------------  ------  ------------------------
A US-style Institutional Review Board (IRB)                    986     73.2%
An ethics committee or ethical review board (non-IRB wording)  241     17.9%
The institution, named only as such                            47      3.5%
Data protection officer or data protection office              28      2.1%
Legal department, general counsel or compliance office         25      1.9%
A regulator or government body                                 7       0.5%
An internal company or partner review                          5       0.4%
An external or community safety board                          4       0.3%
 
Unmapped residue, in full:
  - internal review process
  - ethics and data protection review
 
Papers naming a network operations / services / management department among the reviewing bodies: 7.
  IMC/2014/forced-perspectives-evaluating-an-ssl-trust-enhancement-at-scale  —  university network services department
  USENIX/2016/website-targeted-false-content-injection-by-network-operators  —  networks' administration teams
  NDSS/2019/the-use-of-tls-in-censorship-circumvention  —  IRB and institutional networking and IT staff
  IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s  —  network management department and regulatory authority of Coremail
  NDSS/2024/on-precisely-detecting-censorship-circumvention-in-real-world-networks  —  campus institutional review board (IRB) and network operations staff
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services  —  network management department
  NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists  —  network management department
 
## F. robots.txt (population: the 1,120 papers that ran a crawl)
 
`ethics.robotsTxt`  Papers  Share of 1120
------------------  ------  -------------
`respected`         15      1.3%
`ignored`           9       0.8%
`discussed`         29      2.6%
`not-stated`        939     83.8%
`no-ethics-record`  128     11.4%
 
**Says anything at all about robots.txt: 53 of 1120 (4.7%).**
 
How the robots.txt reporting rate compares with the other low-reporting enums (each against its own population,
and counting `not-applicable` as a sentinel, which is how OVERVIEW.md counts them):
Field                                                                      Population N  Stated  Share
-------------------------------------------------------------------------  ------------  ------  -----
`ethics.robotsTxt`                                                         1120          53      4.7%
`crawlConfig.headless`                                                     1120          140     12.5%
`humanAnnotation.agreementMetric`                                          3318          512     15.4%
`crawlConfig.statefulness`                                                 1120          219     19.6%
`crawlConfig.consentAction (field populated; not an audited paper claim)`  1120          349     31.2%
`ethics.reviewOutcome`                                                     5118          1728    33.8%
Full-text cross-check: the literal string `robots.txt` appears anywhere in 55 of 1120 crawling papers (4.9%); 0 full-text files were missing.
The sweep is the upper bound (it fires on a reference-list title too); the schema figure is the lower one. Both say the same thing.
 
## G. What crawling papers say they did to limit harm
 
Like-for-like on the crawlOnly population: 585 of 971 (60.2%) state a mitigation, against 207 of 971 (21.3%) that state a review outcome.
697 of 1120 crawling papers (62.2%) give a free-text harm-mitigation step. The other 423 say nothing — which is not the same as doing nothing, and is not counted as such anywhere below.
 
The fold is **multi-label** — one sentence routinely names three steps — so shares do not sum to 100%.
 
Mitigation family                                                           Papers  Share of 697 that state one
--------------------------------------------------------------------------  ------  ---------------------------
Data minimisation — collecting less than you could                          180     25.8%
Rate limiting, pacing and load control                                      164     23.5%
Disclosure and notification of affected parties                             123     17.6%
Anonymisation, pseudonymisation and hashing                                 108     15.5%
Staying non-intrusive: no exploitation, no tampering, no logins             104     14.9%
Test accounts, synthetic identities and the researchers’ own assets         92      13.2%
Isolation: sandboxes, VMs, containers, lab-only deployment                  59      8.5%
Access control, encryption and secure storage                               53      7.6%
Deletion and retention limits                                               50      7.2%
Avoiding financial harm to operators and advertisers                        33      4.7%
Consent, opt-in and opt-out mechanisms                                      28      4.0%
Screening and handling of harmful or illegal content                        25      3.6%
Respecting robots.txt, terms of service and acceptable-use policies         17      2.4%
Formal review, legal advice and named legal regimes                         17      2.4%
Identifying the crawler and offering an operator an opt-out (hand-decided)  10      1.4%
 
Unmapped residue: 28 of 697 (4.0%). In full:
  - Stripped JavaScript and rewrote links to prevent malicious traffic reaching other sites.
  - Closed experimental Twitter accounts after 48 hours.
  - Advertised legitimate Chinese e-commerce sites and filtered search engines and bots.
  - Limited orders to three per day per campaign to reduce detection.
  - WHOIS queries were limited to a small percentage of domains.
  - Collected URLs without automated visits and avoided sending automated traffic to monetization services.
  - Stored only raced sessions and at most their last 30 packets.
  - They state that the attacks cannot automatically compromise devices at scale.
  - They decided not to contact affected app publishers about findings.
  - Used bucketing, daily writes, and rounding counters to protect anonymity.
  - Sent one email per provider and did not follow up.
  - Used static screening to focus later dynamic analysis on selected apps.
  - Limited clicks to fewer than 15 per app and advertiser visits to fewer than 25 on average.
  - Only scraped publicly accessible pages; landmarks could be removed and webcams were never accessed or controlled.
  - One visit per site per OS, with visits at different times and no concurrent visits.
  - Collected alerts were transferred to an EDR client for manual verification.
  - Registered unintended domains to prevent attackers from exploiting them.
  - Used anonymous expressions and did not focus on particular forum users.
  - Avoided residential IPs and used university addresses instead.
  - Avoided explicitly clicking ads; discussed ecosystem harms.
  - Only downloaded firmware images released to the general public.
  - Tested each API once, used 10 kB labeled beacons, uploaded 447 images totaling 4.4 MB.
  - They discuss potential sensitive-information leakage from sharing frontend URLs.
  - Contacted each address once, offered opt-out, explained recruitment, and stopped GitHub recruitment.
  - Avoided highlighting individual government strategies or security weaknesses.
  - Artifact warns that aggressive eviction may destabilize or crash systems.
  - Did not report sites to preserve observation of scam operations.
  - Crawler visits used a fresh browser and a dynamic pool of IPs.
 
Crawler identification and opt-out — a hand-decided family, because a bare
"opt-out" fires on participant and notification-recipient opt-out too.
Sweep and hand map agree on all 21 candidates.
 
Verdict      Papers  Share of 21 candidates
-----------  ------  ----------------------
operator     10      47.6%
participant  4       19.0%
telemetry    4       19.0%
recipient    2       9.5%
evasion      1       4.8%
 
**Directed at the party being measured: 10 of 697 papers that state a mitigation (1.4%).** This is the figure the page uses.
 
Every candidate with its verdict and deciding text:
  [participant] CCS/2014/private-by-design-advertising-meets-the-real-world
                 Opt-in participation and an easy opt-out mechanism — the opt-out is for the users of the advertising system, not for site operators.
  [telemetry  ] IEEE-SP/2015/the-attack-of-the-clones-a-study-of-the-impact-of-shared-code-on-vulnerability-p
                 Used opt-in telemetry and excluded user-identifiable information.
  [operator   ] CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
                 did not obfuscate user agents or IP addresses.
  [operator   ] CCS/2021/out-of-sight-out-of-mind-detecting-orphaned-web-pages-at-internet-scale
                 customized opt-out User-Agent.
  [recipient  ] USENIX/2021/effective-notification-campaigns-on-the-web-a-matter-of-trust-framing-and-suppor
                 honored opt-outs — from the notification campaign, not from the crawl.
  [evasion    ] PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
                 Used legitimate User-Agent strings ... avoided detectable automation frameworks. This is the opposite of identifying yourself.
  [telemetry  ] USENIX/2022/online-website-fingerprinting-evaluating-website-fingerprinting-attacks-on-tor-i
                 opt-in entry circuits — consent from relay operators contributing data, not from a measured site.
  [operator   ] IMC/2023/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
                 Dedicated machines, informative rDNS, measurement website, and blocklisting option — the full set.
  [recipient  ] PETS/2023/comparing-large-scale-privacy-and-security-notifications
                 opt-out from the notification campaign.
  [participant] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
                 offered opt-out, explained recruitment — study recruitment.
  [telemetry  ] USENIX/2023/rods-with-laser-beams-understanding-browser-fingerprinting-on-phishing-pages
                 participation was explicitly opt-in — the telemetry contributors.
  [operator   ] PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process
                 warnings, opt-out — directed at the messaging providers under measurement.
  [participant] PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing
                 participants could opt out or uninstall.
  [operator   ] CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the
                 identifying header, opt-out link.
  [operator   ] IEEE-SP/2025/gptracker-a-large-scale-measurement-of-misused-gpts
                 opt-out offered to the measured GPT authors.
  [operator   ] PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
                 Dedicated identifiable measurement machines; stakeholders could opt out.
  [participant] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
                 opt-outs offered to the volunteers, per-website.
  [operator   ] NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists
                 opt-out information published for the measured mail operators.
  [operator   ] USENIX/2025/s-mine-collecting-and-analyzing-s-mime-certificates-at-scale
                 opt-out contact.
  [operator   ] NDSS/2026/one-email-many-faces-a-deep-dive-into-identity-confusion-in-email-aliases
                 opt-out notices.
  [telemetry  ] IEEE-SP/2021/trouble-over-the-air-an-analysis-of-fota-apps-in-the-android-ecosystem
                 Used anonymized, opt-in telemetry.
 
## H. Disclosure and regulator contact (context only — see the two sibling pages)
 
`ethics.notifiedAffectedParties`  Papers  Share of 4472 empirical papers with an ethics record
--------------------------------  ------  ----------------------------------------------------
`yes`                             1636    36.6%
`partial`                         524     11.7%
`no`                              194     4.3%
`not-applicable`                  1001    22.4%
`not-stated`                      1117    25.0%
 
`ethics.regulatorContact`  Papers  Share of 4472
-------------------------  ------  -------------
`yes`                      147     3.3%
`no`                       1982    44.3%
`not-stated`               2343    52.4%
 
## I. Full-text sweeps (upper bounds — a sweep fires on a reference-list title too)
 
Probe                                            Papers  Population        Share
-----------------------------------------------  ------  ----------------  -----
`Menlo Report`                                   225     empirical (5118)  4.4%
`Belmont Report`                                 36      empirical (5118)  0.7%
`IRB` anywhere                                   987     empirical (5118)  19.3%
a "not human subjects" determination             79      empirical (5118)  1.5%
`ACM Code of Ethics`                             6       empirical (5118)  0.1%
`robots.txt`                                     55      crawled (1120)    4.9%
terms of service / terms of use                  129     crawled (1120)    11.5%
`acceptable use policy`                          5       crawled (1120)    0.4%
`residential prox*`                              25      empirical (5118)  0.5%
data donation / donated data                     24      empirical (5118)  0.5%
opt-out signalling (rDNS, info page, blocklist)  63      crawled (1120)    5.6%
`Common Rule` or `45 CFR 46`                     32      empirical (5118)  0.6%
`Tor Research Safety Board`                      7       empirical (5118)  0.1%
a named ethics/REC committee of the venue        39      empirical (5118)  0.8%
**"our institution has no review body"**         20      empirical (5118)  0.4%
 
Of the 20 papers stating their institution has no review body: 16 recruited participants, 2 ran a crawl, and 10 name the Menlo Report.
 
Menlo Report citations over time (population: empirical papers in the window):
Window      Empirical papers  Cite the Menlo Report  Share
----------  ----------------  ---------------------  -----
2010–2013   460               0                      0.0%
2014–2017   718               7                      1.0%
2018–2021   1272              32                     2.5%
2022–2024   1649              84                     5.1%
2025–2026*  1019              102                    10.0%
 
## J. Sensitivity check: does the reporting gap survive dropping posters and short records
 
Population       N (all)  States review (all)  N (trimmed)  States review (trimmed)  Dropped
---------------  -------  -------------------  -----------  -----------------------  -------
`empirical`      5118     33.8%                4920         34.8%                    198
`crawlOnly`      971      21.3%                948          21.6%                    23
`humanSubjects`  1357     75.3%                1322         76.4%                    35
 
Trimmed = posters (slug `poster-*` or title `Poster:`) and records of 4 pages or fewer removed.
 
## K. Figures on the page that do NOT come from this corpus
 
Every number below is external and is cited on the page with its source and the date it was read.
They are listed here so a whole-page number audit does not flag them as unsourced corpus figures.
 
  Ramulu et al., CCS 2025 (in the corpus as a paper, but these are ITS figures, not ours):
    1154 papers reviewed; 839 with no ethics discussion; 315 with one; 270 with a dedicated
    section; 45 in the body only; 36 naming the Menlo Report; 251 mapped to Menlo principles;
    159 beneficence; 110 confidentiality; 89 informed consent; 79 compensation; 56 law;
    18 justice; 11 vulnerable persons; 257 mentioning vulnerability disclosure; 116 human-subject
    papers, of which 102 discuss ethics and 90 have a dedicated section; 17 of those 116 do not
    mention a review board; 52 non-human-subject papers that do; 24 interviewees.
 
  Load and cost figures quoted from individual papers, each verified against the paper by
  scripts/eth_quotecheck.mjs (all 34 quotes exact):
    2.7 URLs per second (Zhang et al., NDSS 2014); a 1 minute delay between page loads
    (Bashir et al., USENIX Security 2016); no more than ten queries per second (Almansoori
    et al., PoPETs 2022); no more than 4 visits per day (Zeng et al., IMC 2021); 256 parallel
    workers, pausing on HTTP 429 and HTTP 503 (Amos et al., TheWebConf 2021); about $400 in
    impressions (Datta et al., PoPETs 2015); USD 1.12 maximum and USD 0.04 average per landing
    domain (Subramani et al., IMC 2020).
 
  Hantke et al., IEEE S&P 2024 (its own study design, not ours): 23 interviews, 119 survey
    respondents, 5 scenarios; and the figure it reports for IEEE S&P 2022 — a Reject
    recommendation for 2 of 67 flagged papers out of 1,006.
 
  Venue policies, standards and legal instruments, each cited on the page with its URL and the
  date it was read (2026-08-18). The bare numbers they contribute, so a whole-page number audit
  can account for them:
    45 CFR 46.102, 46.104 (and the subsection numbers 1, 4, 6 inside them); the year 2012 for
    the Menlo Report and 2013 for its companion; GDPR Article 89; EU AI Act Article 2, and its
    paragraphs 6 and 8; DSA Article 40, its 49 applications received by 19 May 2026, and the
    delegated act of 2 July 2025; Van Buren v. United States, 593 U.S. 374 (2021); hiQ Labs v.
    LinkedIn, No. 17-16783 (9th Cir., 18 April 2022); Jisc MF-POL-007 Issue 5.1 and its 1
    working day of notice; ACM policy approved 15 August 2021; HTTP statuses 200 and 403
    encountered while fetching those sources; Mozilla Rally archived 29 July 2024; Citizen
    Browser last post October 2022; DataSkop 2022-2023; Tracking Exposed ended 2023;
    Bright Data residential KYC for zones created after 7 July 2026; arXiv:2511.10408 and its
    hiQ Labs v. LinkedIn district-court docket 3:17-cv-03301-EMC, entry 406, the $500,000
    consent judgment of 8 December 2022; Regulation (EU) 2016/679 Art. 89(1) and 89(2);
    Regulation (EU) 2024/1689 Art. 2(6), 2(8) and Recital 25; Swiss HRA SR 810.30 Art. 2;
    the European Commission ethics self-assessment guidance version 2.0 of 13 July 2021;
    HTTP 301 redirects on the DHS and Jisc pages; Hantke et al. interviewee composition
    (9 legal experts, 10 operators, 5 REC members); Ramulu et al. "all but 17" read as 99 of
    116 or 85 of 102; the Menlo Report companion of 2013; Azure dropping pre-approval in
    June 2017; Singh et al. 22 volunteers across 23 countries in 2025; Chehade et al. 100 live
    web applications; and the conference-cycle shorthands 26 and 27 (as in "USENIX Security
    '27"), which are years, not counts;
    16 interviewees; the rhetorical 100,000 sites in the introduction; Wu et al. NDSS 2025 own
    figures (1,407 scanner IPs, 28 honeypots, one year); Ramulu et al. 257 disclosure papers;
    Hantke et al. 100 web applications tested by Chehade et al.; and the derived ~1,038
    (1,154 - 116) non-human-subject papers in Ramulu et al.

scripts/harm_fold.mjs. ethics.harmMitigation is a free-text, at-most-20-word summary of the steps a paper says it took. Two design decisions, both load-bearing:

• It is not a name field. There is no canonical string to converge on, so a spelling fold (the name_fold.mjs approach used for tools and locations) is meaningless here. What is stable across two readings of the same sentence is the *kind* of step, so the fold maps a sentence to a set of mitigation families.
• It is multi-label. “Rate-limited requests, avoided off-limit information, and anonymized collected data” is three steps in one string. Single-labelling it would throw two away. So a string can match several families, each family is counted in papers, and the shares on the page do not sum to 100% — which the page states above the table.

A paper with harmMitigation === null is never counted as “took no steps”. It is counted as “did not say”, which is a different and larger set (423 of the 1,120 crawling papers).

14 regex families, ordered but not exclusive, plus one hand-decided family (below) that has no regex at all. 14 self-tests, each a real string from the corpus:

14 fold self-tests pass

Residue: 28 of 697 papers (4.0%), printed in full in section G of the report output above. Reading it: most of the 27 are genuinely idiosyncratic single-instance steps (“Registered unintended domains to prevent attackers from exploiting them”, “Advertised legitimate Chinese e-commerce sites and filtered search engines and bots”) rather than a family the fold is missing. Two near-misses were left unmapped on purpose rather than widened into: “Avoided residential IPs and used university addresses instead” (a vantage-point choice framed as harm mitigation) and “Crawler visits used a fresh browser and a dynamic pool of IPs” (the opposite choice, also framed as harm mitigation). A family for “vantage-point hygiene” would have two members pointing in opposite directions.

The first version of the anonymisation regex ended …|anonymised|/i — a trailing empty alternative, which matches the empty string, so every non-null harmMitigation string scored as anonymisation. The self-test caught it because two test cases asserted families that string did not contain and got anonymisation back instead. Recorded here because the failure is silent in every other respect: the family counts looked plausible (106 papers) and the residue went down, which is the direction that normally reads as an improvement.

The first complete run had a residue of 162 of 697 (23.2%). Reading the residue showed almost all of it belonged to families that already existed — the regexes were written from the first 60 strings and did not generalise (“Visited each page once”, “one request per URL per day”, “Time-gapped measurements” are all rate limiting; “Did not retain IP addresses” is data minimisation). Broadening the fourteen families cut it to 4.0% with no new family except one: crawler-identification, split out of consent-and-optout because identifying your crawler and offering an operator an opt-out is a different act from obtaining a participant's consent, and it is the one the page argues for. That family then turned out to need a hand map rather than a regex — see below.

The page publishes a count for identifying the crawler and offering an operator an opt-out and builds an argument on it (“the cheapest credible thing on the list”). The first version was a regex whose broadest alternative was a bare opt-?out, and it reported 17 of 697.

Reviewer 1 pulled the 17 and found that 7 of them recruited human participants, quoting four whose text is unambiguously about a study participant's right to withdraw. That is not the same act as telling a site operator who is crawling them.

The fix was to remove the family from the regex list entirely. What replaced it:

• CRAWLER_ID_CANDIDATES — a loose sweep (opt-out, opt-in, rDNS, measurement website, identifying header, legitimate User-Agent, …), deliberately over-broad.
• CRAWLER_ID — a hand verdict for every candidate, with the deciding text, in one of five categories: operator (directed at the party being measured), participant, telemetry (opt-in consent from people whose client data is reused), recipient (opt-out from a notification campaign — that is disclosure hygiene and belongs to Notifying websites), and evasion (a “legitimate” User-Agent chosen so the crawler is not identifiable, which is the opposite act).
• report_ethics.mjs fails loudly if the sweep returns a paper the map does not cover, or the reverse.

That guard fired on the first run, surfacing four opt-in-telemetry papers that neither the tightened regex nor the reviewer had found. Final split of the 21 candidates: 10 operator, 4 participant, 4 telemetry, 2 recipient, 1 evasion.

The published figure moved 17 → 10, and foldHarm() now takes an optional paper key so the table row comes from the hand map rather than from a string match. Without the key it simply does not emit that family — it is never guessed.

scripts/body_fold.mjs. ethics.reviewBody is free text naming who reviewed the study: 1,347 papers, 595 distinct strings. Single-label and ordered, most specific family first, because the question the page asks is “what kind of body signs a web measurement off” — a student in a department with no IRB needs to know what the alternatives are called.

Order matters and was set by the failures:

• dpo and regulator before legal and irb, because “data protection officer” and “CNIL” are more specific than the words around them.
• irb before ethics-committee, because “institutional ethics review board (IRB)” should count as an IRB.
• institution-unspecified last, because it is a catch-all containing institution|universit|department|board|office and would otherwise swallow everything.

Two keyed exceptions, checked before the families. “Data Protection Inspectorate of Estonia” is a regulator, not a DPO, and the string for the first contains the string for the second. “Privacy and Security Board of Politecnico di Torino” is a university body, not a company one — the company family exists to catch corporate “privacy review board” language and fired on it first; caught in review, and it moved two published rows by one paper each. One sentinel rule: the extractor occasionally writes “not stated” into this free-text field; that is a non-answer, reported apart from both the families and the residue (2 papers).

17 self-tests:

16 body-fold self-tests pass

Residue: 2 of 1,347 strings — “internal review process” and “ethics and data protection review”. Both are real review bodies that no family names; neither was worth a rule.

The page says 4.7% is “the lowest reporting rate of any field in the extraction behind this site”. That is a claim about fields this page does not otherwise touch, so section F of the report computes them rather than quoting them, each against its own population and counting not-applicable as a sentinel:

All six reproduce data/extract/OVERVIEW.md's Where the field goes quiet table exactly, which is a useful independent check that this script's sentinel handling matches the corpus's own.

A first version of this table did not reproduce it, and the reason is the one this site keeps re-learning: it tested !== 'not-stated' instead of isSentinel(…), so not-applicable counted as an answer. That put consentAction at 52.2% instead of 31.2% and statefulness at 21.1% instead of 19.6% — plausible-looking numbers that would have been published with no way to notice. The fix was to use lib.mjs's isSentinel everywhere, which is why it exists.

Section I of the report. Every sweep is an upper bound: it matches the reference list and the related-work section as well as the methods, so a hit is not a claim that the paper did the thing.

Three of them are used on the page as evidence, and each is paired with a schema figure so the two can be read against each other:

Sweeps run but not published on the page, with why:

The page says “Seven papers in the corpus name a network operations, network services or network management department among the bodies that reviewed the study”. That is not a fold family — it came from reading the reviewBody residue and noticing a recurring institution kind that the family list treats as institution-unspecified. Section E of the report lists all seven with their exact strings. Two of the seven name an IRB as well, so this is “among the bodies”, not “instead of a board”, and the page says it that way.

An earlier draft said “four”, from an eyeball count of the reviewBody frequency table. The report now computes it.

scripts/eth_quotecheck.mjs checks every sentence the page quotes from a corpus paper against the rendering the extractor read, with the ligature / line-break-hyphen / smart-quote normalisation from le_quotecheck.mjs, and falls back to a pypdf re-extraction when paper.cols.txt fails — the two renderings defeat different sentences on two-column ACM PDFs.

exact    100%  [cols] IMC/2017/fifteen-minutes-of-unwanted-fame-detecting-and-characterizing-doxing
exact    100%  [cols] CCS/2020/censored-planet-an-internet-wide-longitudinal-censorship-observatory
exact    100%  [cols] IMC/2022/spfail-discovering-measuring-and-remediating-vulnerabilities-in-email-sender-val
exact    100%  [cols] IMC/2022/spfail-discovering-measuring-and-remediating-vulnerabilities-in-email-sender-val
exact    100%  [cols] USENIX/2017/i-have-no-idea-what-im-doing-on-the-usability-of-deploying-https
exact    100%  [cols] NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists
exact    100%  [cols] USENIX/2013/enabling-fine-grained-permissions-for-augmented-reality-applications-with-recogn
exact    100%  [cols] NDSS/2026/should-i-trust-you-rethinking-the-principle-of-zone-based-isolation-dns-bailiwick-checking
exact    100%  [cols] IEEE-SP/2024/digital-security-a-question-of-perspective-a-large-scale-telephone-survey-with-f
exact    100%  [cols] CCS/2017/why-do-developers-get-password-storage-wrong-a-qualitative-usability-study
exact    100%  [cols] PETS/2024/internet-users-willingness-to-disclose-biometric-data-for-continuous-online-acco
exact    100%  [cols] NDSS/2014/dspin-detecting-automatically-spun-content-on-the-web
exact    100%  [cols] USENIX/2016/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
exact    100%  [pdf] PETS/2022/a-global-survey-of-android-dual-use-applications-used-in-intimate-partner-survei
exact    100%  [pdf] IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n
exact    100%  [cols] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
exact    100%  [cols] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
exact    100%  [cols] PETS/2015/automated-experiments-on-ad-privacy-settings
exact    100%  [cols] IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [pdf] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
exact    100%  [pdf] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
exact    100%  [cols] NDSS/2025/revealing-the-black-box-of-device-search-engine-scanning-assets-strategies-and-ethical-consideration
exact    100%  [cols] CCS/2025/ethics-in-computer-security-research-a-data-driven-assessment-of-the-past-the-pr

34 quotes: 34 exact, 0 partial (>=60% of 5-word windows), 0 below threshold.

34 of 34 exact. Four quotes across three papers needed the pypdf fallback (Almansoori et al. PoPETs 2022; Zeng et al. IMC 2021; Singh et al. IMC 2025, two quotes), which is the expected rate and the reason the fallback exists.

External quotes — venue calls for papers, statutes, court opinions, vendor documentation, network AUPs — are not in this checker. They are cited on the page with the source URL and the date they were read, and the load-bearing ones were re-fetched by hand; see External sources below.

Both were headed for the page's rate-limiting list and were cut. Recorded because the failure mode — a plausible harmMitigation summary that the source does not support — is invisible unless you open the paper.

Five papers are attributed by author name on the page (in the rate-limiting table). All five were checked with scripts/check_attributions.mjs against the bibliography: 5/5 match.

One was wrong in the draft and is recorded here because it is the exact failure that guard exists for: the PoPETs 2022 dual-use-apps paper was first attributed to “Chatterjee et al.” — Rahul Chatterjee is its last author. First author is Majed Almansoori, confirmed from Crossref for DOI 10.56553/popets-2022-0102. PoPETs index records in this corpus carry no authors, so the name had to be fetched rather than read.

Authors fetched from a landing page rather than the index, because PETS and USENIX records have neither authors nor DOIs:

The page leans on [1Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] for an independent count. Its figures are its own, not this corpus's, and they are listed in section K of the report so a whole-page number audit does not treat them as ours: 1,154 papers hand-read across CCS, IEEE S&P, NDSS and USENIX Security 2024; 839 with no ethics discussion; 315 with one; 270 with a dedicated section; 45 in the body only; 36 naming the Menlo Report; 116 human-subject papers of which 102 discuss ethics and 90 have a dedicated section; 17 of those 116 not mentioning a review board; 52 non-human-subject papers that do.

The two counts are not directly comparable and the page does not present them as such. Theirs is “does the paper discuss ethics at all”, read by hand over one year and four venues. Ours is “does the paper state a review outcome”, extracted over seventeen years and seven venues. They agree on shape (the apparatus tracks participants, not harm) and on nothing numerically.

The ~1,038 figure the page quotes (“52 of the ~1,038 papers without human subjects”) is derived by arithmetic: 1,154 − 116. Their paper gives 52 and 116 but not the complement. The tilde is doing real work and is deliberate.

Required by the corpus notes: 138 posters and 251 records of ≤4 pages have their methodology compressed out, so they bias every silence figure upward. Section J of the report re-runs the headline with them dropped.

The gap the page is about — 75.3% against 21.3% — is 76.4% against 21.6% after trimming. It survives. The page reports the untrimmed figures and states the check in its limitations section.

Every external claim on the page was fetched on 2026-08-18. A sonnet sub-agent did the first pass into notes/ethics_external.md under instructions to give a primary-source URL, a fetch date and a verbatim quote for every claim and to mark anything else UNVERIFIED. The load-bearing claims were then re-fetched by hand before they reached the page.

Used as cited, each with the source URL and read-date on the page: the IEEE S&P '27, NDSS '27, CCS '26, PoPETs '27, IMC '26 and TheWebConf '26 CFP text; ACM's 2021 human-participants policy; 45 CFR 46.102(e) and 46.104(d)(4)(i) from the eCFR renderer API; GDPR Art. 89; EU AI Act Art. 2(6) and 2(8); the Swiss HRA and Dutch WMO scope clauses; the Jisc, SURF and Internet2 policies; Verisign's WHOIS and RDAP terms; the AWS and Azure penetration-testing policies; the Menlo Report and companion, including their DHS “Archived Content” banner; Mozilla Rally's GitHub archive date; the Citizen Browser, DataSkop and Tracking Exposed / AI Forensics status; the DSA Art. 40 delegated act and the 49 applications; Bright Data's and Oxylabs' consent claims; and EWDCI's membership and audit mechanics.

Three of those carry a caveat the page reproduces rather than hides:

• dhs.gov, acm.org and jisc.ac.uk all return HTTP 403 to scripted clients. The Menlo pages resolve in a browser; the ACM policy and the Jisc security policy were read from Wayback captures (2025-12-02 and 2026-08-14). The page says so in the footnote in each case, and gives script-friendly CAIDA mirrors for the Menlo PDFs.
• The EWDCI claim was tightened. The sub-agent's own note flagged that the accrediting body and the auditor are the same trade association and that the audited companies are its paying members. The page says that in those words rather than calling it a third-party audit.
• arXiv:2511.10408 is a preprint and the page labels it as one.

• Whether any of this changes behaviour. The page measures what papers report. A silent paper may have done everything right, and the corpus cannot tell the difference. Every framing on the page is about disclosure, deliberately.
• The recall of the harm-mitigation fold. Reviewer 1's spot check found real misses — “respected the 40-interaction limit” does not match the rate-limiting family because the regex expects limit(ed) <object> word order, and “controlled rates” matches nothing. These were not fixed: each is another phrasing-specific alternative rather than a rule, and the residue is already published in full. The consequence is directional and should be stated wherever these figures are reused: every family count on the page is a lower bound.
• What the 423 crawling papers with no stated mitigation actually did. Nothing in the schema distinguishes “did nothing” from “did not write it down”, and the page never counts them as the former.
• How often measurement papers disclose LLM use in the pipeline. There is no schema field for it, and the venue requirements are newer than most of the corpus. The page states the requirements and marks the measurement as not done.
• Whether copyright or database rights have ever been asserted against an academic crawl. Not searched. The page's licensing bullet is about practice, not about case law, and says so.
• The precision of the terms of service sweep. 129 papers, unread. A hand pass separating “we complied” from “the service's ToS says” would make that a real figure.
• Whether venue policy causes the reporting rate or tracks it. PoPETs states an outcome at 54.3% and mandates an ethics section from the 2027 cycle — the mandate is later than the behaviour, so the page describes the correlation and claims no direction.
• Non-US, non-EU ethics regimes. Only the Swiss and Dutch statutes were checked, and both turned out to be biomedical-only. A German (DFG) counterpart was not checked against a primary source. The page's claim is scoped to “most of the world has no equivalent standing body”, supported by the 20 papers that say so, not by a survey of national law.
• Whether the 20 “no review body” papers are representative. They are the papers that said so. Institutions without a board that simply wrote nothing are invisible to this sweep and are certainly more numerous.

1. Extend the stub, not write a sibling. practices:ethics was a skeleton whose own headings matched the material almost exactly. Broadening it was the obvious call; the only real question was whether the pre-measurement material deserved a separate page from Notifying websites, and it does — that page is 59 KB about a channel, this one is about a decision made before any measurement runs.
2. Lead with the participants-versus-crawls split rather than the headline reporting rate. 33.8% of empirical papers is a fact about a mixed population and reads as an indictment of the whole field. 75.3% against 21.3% is the actionable version, and it is the one that tells the reader which column they are in.
3. Count explicitly-discussed-no-review as stated. Argued above. A reasonable person would exclude it; the page prints the approved/exempt column beside every such figure so they can.
4. Publish the robots.txt non-answer as a non-answer. The literature has no consensus and inventing one would be dishonest. The page says decide, be consistent, and write the sentence — and specifically asks for the share of the sample an honoured exclusion removes, because that is a denominator change and nobody reports it.
5. Give the venue table a read-date and a warning rather than presenting it as stable. Two of its seven rows moved within twelve months, in opposite directions.
6. Do not write a proxy-vendor consent checklist. The sub-agent established that no such checklist exists anywhere and explicitly declined to fabricate one. The page reports the absence and gives three rules of thumb clearly framed as such, rather than presenting original synthesis as an established standard.
7. Name the volunteer platforms that are dead. A student reading a 2021 paper will find Mozilla Rally and plan around it. Reporting its archive date is more useful than listing only what is alive.
8. Publish “the contract claim is what the final judgment rests on” rather than “what ended the company”. The draft said the latter; the docket supports the former and nothing cited supports a causal claim about hiQ's business. Flagged by the generic reviewer.
9. Put “What the venues require” third, not seventh. It was drafted after the harm and vantage-point sections, on the logic that practice comes before paperwork. It was moved ahead of them before publication because it is the section a reader arrives looking for, and because the <WRAP important> box at the top forward-references it.
10. Keep the corpus's “Legal aspects of crawling” heading from the stub, but move the substance to Legal enforcement. The stub listed fraud, trespass and breach of contract. This page carries only what a crawler's ethics section needs — the CFAA narrowing and the surviving contract exposure — and points at the sibling for enforcement.

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script and its output, the folds, and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were applied.

Re-ran report_ethics.mjs and confirmed byte-identical output to the committed file, then checked every table cell and percentage, audited both folds, and spot-checked 15 random harmMitigation strings by hand.

Reviewer 1 also confirmed as correct, having recomputed them: sections A–J in full, the 149 + 971 = 1,120 arithmetic, the 4,472 = 5,118 − 646 arithmetic, the year-window and by-venue tables, the Menlo-by-window series, and the sensitivity figures.

Reviewer 2 confirmed as correct: all 23 citekeys resolve with no duplicates and no unused additions; all 15 added BibTeX entries against Crossref and venue landing pages; the rate-limiting table's five attributions; and the Singh, Chehade, Datta and Subramani figures.

Fetched every external URL on the page. Full inventory in the reviewer's report; the findings that changed the page:

Reviewer 3 confirmed verbatim: the Menlo four-principles quote, GDPR Art. 89, AI Act Art. 2(6)/2(8), 45 CFR 46.102(e)(1) and 46.104(d)(4)(i), the “publicly available” undefined-term claim, the DSA 49-applications figure as still current, Prolific's and MTurk's quoted wording, Bright Data's KYC date, the SURF, Verisign and Azure quotes, the Tor board, and the Rally / Citizen Browser / DataSkop / AI Forensics statuses. It also confirmed that User studies and Artifacts are genuine red links already promised by several other pages — a pre-existing gap, not one this page introduces.

No checklist; handed the page, the provenance page, the scripts and the stub, and told to look for whatever the focused three were not. It re-derived several figures independently and re-fetched the neighbouring pages.

Rejected: none. Every finding was accepted, which is itself worth recording — a generic pass with no checklist found the page's largest substantive gap (O) after three focused passes had gone over it.

Three of the four reviewers found something that changed a published number or a published claim. Reviewer 1's finding 1 was the expensive one: a figure the page built an argument on (“the cheapest credible thing on the list”) was inflated by 70%, and the defect was in code the page never shows. Reviewer 3's finding H was the one no corpus query could have produced: the page had a legally accurate but incomplete account of a case whose ending is the page's own argument. Reviewer 2's findings E and F are the ordinary kind — citations dropped in editing — and are the reason a citations pass is worth its slot even when nothing is wrong with the sources.

• Ethics — the page this log is for.
• Corpus — corpus-wide provenance: the venue scope, the selection funnel, the provisional 2025–2026 slice.
• notifying_websites and legal_enforcement — the two sibling logs; the disclosure figures on this page are recomputed here rather than copied from either.
• crawling_location — the vantage-point log, which carries the residential-proxy market research this page does not repeat.

Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with check_wrap.mjs and check_typography.mjs. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.

What was wrong. The reporting-completeness table presented 349/1,120 = 31.2% for crawlConfig.consentAction without distinguishing a populated extraction field from a claim supported by paper text. The number is correct as a schema statistic but was easy to read as the latter.

Command and real output. node scripts/report_ethics.mjs → crawlConfig.consentAction (field populated; not an audited paper claim) | 1120 | 349 | 31.2%. The companion node scripts/consent_action_noninteraction_audit.mjs output records 55/1,120 = 4.9% audited papers stating an action and 279/313 = 89.1% unsupported no-interaction labels.

What changed. The page and its embedded report output now label 349 as field population and explain that paper-claim support is a separate audit result; no schema figure changed.

Review. One model: 'sonnet' figures-vs-script pass re-ran report_ethics.mjs and checked the consent row plus the rows immediately before and after it. No mismatch was found. No citation pass was needed: no citekey or quoted claim changed.

Rejected finding. The 349 schema count was not replaced by 55 in this table: the table is intentionally a reporting-completeness/schema table, while the audited claim count belongs to consent.

Working log for the registration and claiming section. Corpus-level selection and provisional-year caveats: corpus. No discussion block: comments belong on the content page.

• Date: 2026-10-08. Author and verifier: Codex, GPT-6. Existing local code and reading notes from a 2026-09-28 Claude run were available, but its section and provenance additions were not on the live wiki. They were treated as leads, not completed publication or current figures.
• Extending, not creating or duplicating: fresh JSON-RPC exports of practices:ethics (revision 1790510868), provenance:practices:ethics (1789641906), security:domain_abuse and its provenance read before writing. The live ethics page had no receiving-traffic section; its account-registration bullet described a different intervention. A section here keeps review and harm decisions together; the measurement pipeline remains on the domain-abuse page.
• node scripts/sitemap.mjs ran first. Its existing colon-free-link guard failed on 21 links across six unrelated pages. The sitemap still supplied page/link inventory; this task does not repair those pages. Newly added links use explicit namespaces.
• Read data/extract/OVERVIEW.md, README.md, and the two frozen benchmark METHOD logs for audit-log format. No old benchmark figures reused.
• Orientation query: node /workspace/publications_dataset/scripts/site_queries.mjs --run /workspace/publications_dataset/data/extract/run1 --page ethics → ethreg/run20261008/site-queries-ethics.txt. Used to orient; no unfolded free-text tables pasted.
• Current mount: /workspace/publications_dataset/data. The report reads 5,859 extraction records and checks that every IN paper key is still present. This is a fixed hand-selected population, not a fresh exhaustive search for every receiver across all seven venues.
• Workspace is not a Git repository. Scripts are retained under scripts/ and reproduced below; a Git commit was not possible here.

• node scripts/report_domain_abuse.mjs > ethreg/run20261008/domain-output.txt: re-ran the neighbouring page's 149-candidate / 48-IN selection and PASS D hand counts. Its full selection rules and script live on domain_abuse. No selection threshold was changed in this task.
• node scripts/report_ethics_registration.mjs > scripts/report_ethics_registration-output.txt: select HAND rows with reg != 0 || claimed among those 48 IN identities. Denominator 19; registered-only and claimed-resource sets overlap. It asserts exact agreement between selected identities and CODES, and between purpose: logged and LOGGED_ARRIVALS. Denominator for retained content and receiving review counts is the seven logged-arrival papers, not all 19.
• review vocabulary: approved, exempt, other-body, discussed, none. Approval can cover any part of the study; it is not necessarily review of the registration itself. Pauley's CISO-office review is stated separately from its IRB exemption. Silence is a report about text, never misconduct.
• after is multi-label: some papers state a disposition for an IP or one defensive name but omit others. For registered-domain disposition, select the 15 reg != 0 papers and require an after code other than n/s or released-immediately (the latter denotes claimed resources). Result: five papers describe at least some registered names; this does not mean all their names had a documented lifecycle.
• Year table: group IN identities, registered/claimed identities and logged-arrival identities separately by the year component of their corpus key. Print every year, including zero rows. 2025–2026 remain provisional; the page uses these counts to limit its currency claim, not to infer abandonment.
• No automated free-text synonym fold is used for this section. Identity-based inclusion and a finite hand-code vocabulary replace name aggregation. Full code definitions, per-paper assignments and source spans follow. Unmapped residue is printed below: zero uncoded selected identities, zero extra coded identities, and invalid vocabulary values fail the run. These guards establish coverage of the fixed selection, not recall outside it.
• node scripts/report_ethics.mjs > ethreg/run20261008/ethics-output.txt; diff -u out/report_ethics.txt ethreg/run20261008/ethics-output.txt: empty diff. Existing corpus tables were regenerated unchanged. No old corpus number copied into the added section.

The codes predate this run and are not double-coded. Their 91 evidence spans were re-located in the current paper.cols.txt files. Mechanical matching collapses whitespace and normalises curly quotes and ligatures; a second dehyphenation path is available. The current run required no dehyphenation. This is localisation, not semantic validation of every code.

report_ethics_registration.mjs

// report_ethics_registration.mjs — every figure in the practices:ethics section "Registering or
// claiming names to receive traffic meant for someone else", with its denominator.
//
//   node scripts/report_ethics_registration.mjs > scripts/report_ethics_registration-output.txt
//
// Population: the 19 of security:domain_abuse's 48 IN papers that registered or claimed names
// (da_fold.mjs HAND: reg != 0 || claimed). Codes: ethreg_codes.mjs. Every quote in the codes is
// re-located in paper.cols.txt (whitespace collapsed; a second pass also joins a line-end hyphen
// split "re- register" → "re-register"/"reregister"); any quote not found fails the run.
import fs from 'node:fs';
import path from 'node:path';
import { dataRoot, table, loadExtractions } from './lib.mjs';
import { VERDICTS, HAND, LOGGED_ARRIVALS } from './da_fold.mjs';
import { FIELDS, CODES, DECLINED, OUTSIDE, MARKET } from './ethreg_codes.mjs';
 
const FT = path.join(dataRoot(), 'fulltext');
const h = (s) => console.log(`\n=== ${s} ===`);
const colsOf = (key) => {
  const [v, y, ...rest] = key.split('/');
  const f = path.join(FT, y, v, rest.join('/'), 'paper.cols.txt');
  return fs.readFileSync(f, 'utf8').replace(/\s+/g, ' ');
};
const norm = (s) => s.replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/fi/g, 'fi').replace(/fl/g, 'fl');
 
// --- population, both directions ---
const IN = new Set(VERDICTS.filter((v) => v[1] === 'IN').map((v) => v[0]));
if (IN.size !== 48) throw new Error(`expected 48 IN papers, got ${IN.size}`);
const handMap = new Map(HAND);
const POP = HAND.filter(([, x]) => x.reg !== 0 || x.claimed).map(([k]) => k);
const coded = new Map(CODES.map((c) => [c[0], c]));
const missing = POP.filter((k) => !coded.has(k));
const extra = CODES.map((c) => c[0]).filter((k) => !POP.includes(k));
if (missing.length || extra.length) throw new Error(`codes vs population diverge — uncoded: ${missing.join(', ')}; not in population: ${extra.join(', ')}`);
if (POP.length !== 19) throw new Error(`expected 19 registering/claiming papers, got ${POP.length}`);
for (const [k, , , c] of CODES) {
  const hand = handMap.get(k);
  if (hand === undefined) throw new Error(`no HAND row for ${k}`);
  if (hand.ethics !== c.review) throw new Error(`review code differs from da_fold.mjs HAND for ${k}: ${c.review} vs ${hand.ethics}`);
  for (const f of ['purpose', 'keep', 'answer', 'review']) if (!(c[f] in FIELDS[f])) throw new Error(`${k}: unknown ${f} code ${c[f]}`);
  for (const f of ['handling', 'after']) for (const v of c[f]) if (!(v in FIELDS[f])) throw new Error(`${k}: unknown ${f} code ${v}`);
}
const logged = new Set(LOGGED_ARRIVALS.map((x) => x[0]));
const codedLogged = new Set(CODES.filter((c) => c[3].purpose === 'logged').map((c) => c[0]));
for (const k of logged) if (!codedLogged.has(k)) throw new Error(`LOGGED_ARRIVALS has ${k} but its purpose code is not "logged"`);
for (const k of codedLogged) if (!logged.has(k)) throw new Error(`purpose "logged" for ${k}, which is not in LOGGED_ARRIVALS`);
for (const [k] of [...DECLINED, ...MARKET]) if (!IN.has(k)) throw new Error(`${k} is not one of the 48 IN papers`);
for (const [k] of OUTSIDE) if (IN.has(k)) throw new Error(`${k} is IN; OUTSIDE is for papers outside the 48`);
 
const extracted = loadExtractions();
const extractedKeys = new Set(extracted.map(p => `${p.venue}/${p.year}/${p.slug}`));
const absent = [...IN].filter(k => !extractedKeys.has(k));
if (absent.length) throw new Error(`IN keys absent from current extraction: ${absent.join(', ')}`);
h('CORPUS GUARD');
console.log(`extracted records: ${extracted.length}; IN keys absent from current extraction: ${absent.length}`);
h('POPULATION');
const yr = (k) => Number(k.split('/')[1]);
const regd = POP.filter((k) => handMap.get(k).reg !== 0);
const claimed = POP.filter((k) => handMap.get(k).claimed);
console.log(`security:domain_abuse IN papers: ${IN.size}`);
console.log(`registered or claimed (HAND reg != 0 || claimed): ${POP.length}  — registered domains: ${regd.length}; claimed third-party resources: ${claimed.length}; both: ${regd.filter((k) => claimed.includes(k)).length}`);
console.log(`of the ${POP.length}, received and logged traffic meant for someone else (LOGGED_ARRIVALS): ${logged.size} — years ${[...logged].map(yr).sort().join(', ')}`);
console.log(`years of the ${POP.length}: ${POP.map(yr).sort().join(', ')}  (2025–2026 provisional)`);
 
// --- tallies ---
const tally = (field, rows, multi = false) => {
  const out = [];
  for (const [code, meaning] of Object.entries(FIELDS[field])) {
    const ks = rows.filter((c) => (multi ? c[3][field].includes(code) : c[3][field] === code));
    if (ks.length) out.push([code, ks.length, ks.map((c) => c[1]).join(' ')]);
    else out.push([code, 0, '']);
    void meaning;
  }
  return out;
};
const LOG = CODES.filter((c) => c[3].purpose === 'logged');
for (const [field, rows, label, multi] of [
  ['purpose', CODES, `all ${CODES.length}`, false],
  ['review', CODES, `all ${CODES.length}`, false],
  ['review', LOG, `the ${LOG.length} that logged arrivals`, false],
  ['keep', LOG, `the ${LOG.length} that logged arrivals`, false],
  ['handling', LOG, `the ${LOG.length} that logged arrivals (multi-label)`, true],
  ['answer', CODES, `all ${CODES.length}`, false],
  ['after', CODES, `all ${CODES.length} (multi-label: a paper can state one disposition for some names and nothing for others)`, true],
]) {
  h(`${field.toUpperCase()} — denominator: ${label}`);
  console.log(table(['code', 'papers', 'citekeys'], tally(field, rows, multi)));
}
const afterStated = CODES.filter((c) => c[3].after.some((a) => a !== 'n/s'));
const afterFull = CODES.filter((c) => !c[3].after.includes('n/s'));
console.log(`\nstate a disposition for at least some of what they held: ${afterStated.length} of ${CODES.length}; for all of it: ${afterFull.length} of ${CODES.length}; for none of it: ${CODES.length - afterStated.length} of ${CODES.length}`);
const regAfter = CODES.filter((c) => handMap.get(c[0]).reg !== 0);
const regAfterStated = regAfter.filter((c) => c[3].after.some((a) => !['n/s', 'released-immediately'].includes(a)));
console.log(`of the ${regAfter.length} that registered domains, state what happened to (some of) the domains: ${regAfterStated.length} — ${regAfterStated.map((c) => `${c[1]}=${c[3].after.filter((a) => a !== 'n/s').join('+')}`).join(', ')}`);
const logNoBody = LOG.filter((c) => ['discussed', 'none'].includes(c[3].review));
console.log(`of the ${LOG.length} that logged arrivals, no review body: ${logNoBody.length} (${logNoBody.map((c) => c[1]).join(', ')}); IRB said exempt / not human-subjects: ${LOG.filter((c) => c[3].review === 'exempt').map((c) => c[1]).join(', ')}`);
 
h('PER PAPER');
console.log(table(['year', 'citekey', 'what', 'purpose', 'keep', 'handling', 'answer', 'after', 'review'],
  CODES.map(([k, ck, what, c]) => [yr(k), ck, what.slice(0, 60), c.purpose, c.keep, c.handling.join('+'), c.answer, c.after.join('+'), c.review])));
 
// --- quote check ---
h('QUOTE CHECK — every quote in ethreg_codes.mjs located in paper.cols.txt');
let n = 0, exact = 0, dehyph = 0; const fails = [];
const check = (key, ck, field, q) => {
  n++;
  const t = norm(colsOf(key)), nq = norm(q);
  if (t.includes(nq)) { exact++; return; }
  const t2 = t.replace(/(\w)- (\w)/g, '$1$2'), t3 = t.replace(/(\w)- (\w)/g, '$1-$2');
  if (t2.includes(nq) || t3.includes(nq)) { dehyph++; console.log(`  dehyphenated match: ${ck} [${field}] "${q.slice(0, 80)}"`); return; }
  fails.push(`${ck} [${field}] "${q}"`);
};
for (const [k, ck, , , qs] of CODES) for (const [f, arr] of Object.entries(qs)) for (const q of arr) check(k, ck, f, q);
for (const [k, ck, , qs] of [...DECLINED, ...OUTSIDE]) for (const q of qs) check(k, ck, 'declined/outside', q);
for (const [k, ck, qs] of MARKET) for (const q of qs) check(k, ck, 'market', q);
console.log(`quotes: ${n}; exact: ${exact}; after joining line-end hyphens: ${dehyph}; NOT FOUND: ${fails.length}`);
for (const f of fails) console.log(`  NOT FOUND: ${f}`);
if (fails.length) { console.error(`FAIL: ${fails.length} quote(s) not located`); process.exit(1); }
 
h('DECLINED OR NEVER RECEIVED (comparison set, of the 48)');
for (const [k, ck, what] of DECLINED) console.log(`  ${yr(k)} ${ck}: ${what}`);
h('OUTSIDE THE 48 (pointer, not counted)');
for (const [k, ck, what] of OUTSIDE) console.log(`  ${yr(k)} ${ck}: ${what}`);
 
h('YEAR COUNTS — paper counts, 2025–2026 provisional');
console.log(table(['year', 'domain-abuse IN denominator', 'registered/claimed', 'logged arrivals'], Array.from({length:17}, (_,i)=>2010+i).map(y=>[y,[...IN].filter(k=>yr(k)===y).length,POP.filter(k=>yr(k)===y).length,[...logged].filter(k=>yr(k)===y).length])));
h('UNMAPPED RESIDUE — identity selection and finite hand-code vocabulary');
console.log(`uncoded selected papers: ${missing.length}; coded outside selection: ${extra.length}; unknown code values: 0 (invalid values throw); no free-text alias fold used`);

ethreg_codes.mjs

// ethreg_codes.mjs — hand codes behind the practices:ethics section "Registering or claiming
// names to receive traffic meant for someone else". Imported by report_ethics_registration.mjs;
// nothing here is computed, it is the audit surface.
//
// Population: the 19 of security:domain_abuse's 48 IN papers that registered domains themselves
// or took control of third-party names, zones, NS slots or cloud IPs (da_fold.mjs HAND:
// reg != 0 || claimed). The report script throws if this list and that set diverge in either
// direction, and if any `review` code here differs from HAND's `ethics` code.
//
// Coded 2026-09-28 by the author of the section from paper.cols.txt, after five sonnet sub-agents
// wrote structured reading notes with verbatim quotes (ethreg/read_0[0-4].md). Every quote below is
// re-located in the paper by the report script; a quote that cannot be found fails the run.
// Not double-coded.
// 2026-10-08 review correction: chen2025_cross releases then repurchases its test domain
// during the experiment; final disposition is not stated, so after=n/s, not released-test-domain.
 
export const FIELDS = {
  purpose: {
    logged: 'received the traffic, mail or queries meant for someone else and logged it (da_fold.mjs LOGGED_ARRIVALS)',
    parked: 'parked the names with parking services, so real visitors were monetised',
    'nothing-deployed': 'registered to protect or to prove the name was obtainable; deployed nothing on it',
    proof: 'claimed a live third party\'s resource (zone, NS slot) to prove the takeover works',
    testbed: 'names used only as the researchers\' own test infrastructure',
  },
  keep: {
    content: 'message content: full mail bodies, packet captures or payloads',
    metadata: 'request metadata only: IP, time, request line, headers, user agent, query names',
    none: 'nothing from third parties was collected',
    'n/s': 'not stated',
  },
  handling: {
    'scrub-before-storage': 'sensitive strings removed before anything was stored',
    'declined-extra': 'explicitly chose not to collect more than it could (no tracking JS, no decoding)',
    encrypted: 'stored encrypted or on restricted-access infrastructure',
    'deleted-logs': 'logs deleted after the analysis',
    'pii-deleted-before-publication': 'personal data anonymised, then deleted before publication',
    'regret-stated': 'the paper says, in retrospect, it collected more than it needed',
    'none-stated': 'no handling measure stated',
  },
  answer: {
    silent: 'never responded to anyone but the researchers\' own clients',
    'tcp-accept': 'accepted connections, non-interactive above the transport layer',
    'accept-all-mail': 'accepted every message and never replied or bounced',
    'blank-page': 'a zero-length page',
    'notice-page': 'a page explaining the experiment, with a contact address',
    'interactive-traps': 'a 404 page carrying bot traps and fingerprinting JavaScript, plus login honeypots',
    'inert-record': 'a minimally interactive record (loopback A or identifying TXT; changes can still affect clients)',
    monetised: 'parking pages serving ads or paid redirects',
    'nothing-deployed': 'nothing served',
    'testbed-only': 'answered only inside the researchers\' own testbed',
    'n/s': 'not stated',
  },
  after: {
    expired: 'let the names expire back into the pool',
    renewing: 'keeps renewing the names',
    'offered-to-owner': 'contacted the legitimate owner and offered a free transfer',
    'surrender-on-request': 'would surrender a name to a trademark owner on request (none asked)',
    'kept-defensively': 'kept a name as a defensive registration pending outreach',
    'released-immediately': 'released the claimed IPs, zones or records within minutes of the test',
    'released-test-domain': 'released a registered test domain back to the registrar',
    'n/s': 'not stated',
  },
  review: {
    approved: 'reports IRB or ethics-body approval, including unspecified ethics approval (any part of the study)',
    exempt: 'an IRB ruled it exempt / not human-subjects research',
    'other-body': 'approved by a non-IRB body (general counsel, the partner\'s network department)',
    discussed: 'ethics section, no review body',
    none: 'nothing',
  },
};
 
// [key, citekey, what they registered or claimed, { purpose, keep, handling[], answer, after[], review }, { field: [verbatim quote, …] }]
export const CODES = [
  ['USENIX/2014/understanding-the-dark-side-of-domain-parking', 'alrwais2014_parking', '23 purchased domains, parked with 7 services',
    { purpose: 'parked', keep: 'none', handling: ['none-stated'], answer: 'monetised', after: ['n/s'], review: 'discussed' },
    { purpose: ['der a number of top level domains and parked them with', 'the 7 services. The names of those domains were care'],
      answer: ['so the parking services can monetize the traf'],
      other: ['we avoid cashing in the revenues we earned from the 7 parking services hosting our parked domains ($81.06 in total)'] }],
  ['NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains', 'vissers2015_parking', 'one typo domain of stackoverflow.com, parked with each service in turn',
    { purpose: 'parked', keep: 'none', handling: ['none-stated'], answer: 'monetised', after: ['n/s'], review: 'none' },
    { purpose: ['With explicit permission of the authoritative company, we'],
      answer: ['typosquatting domain for at least a week, until we transferred', 'parking page was receiving visitors daily'] }],
  ['CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study', 'chen2017_client', 'one new-gTLD domain for a testbed',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['n/s'], review: 'none' },
    { purpose: ['we registered a real new gTLD domain to set up the name collision domain'],
      answer: ['we configure our DNS servers to only serve the IP addresses we control'] }],
  ['IMC/2017/email-typosquatting', 'szurdi2017_email', '76 typo domains of email providers, over seven months',
    { purpose: 'logged', keep: 'content', handling: ['scrub-before-storage', 'encrypted'], answer: 'accept-all-mail', after: ['surrender-on-request', 'n/s'], review: 'approved' },
    { keep: ['While we elected to keep emails accidentally sent to our domains to carry out deeper analyses than could be done by simply keeping headers'],
      handling: ['we automatically remove sensitive information using regular expression matching prior to storage', 'we encrypt all emails prior to storing them, using an encryption key kept separately from the server'],
      answer: ['which we configure to accept any email', 'Our collection server never sends any', 'email out, but ultimately forwards these emails to a processing and'],
      after: ['We agreed to surrender any domain we registered to the legitimate owner of a trademark it could potentially infringe upon simple request. To date, we have not received any such requests.'],
      review: ['The protocol was approved by our IRB, and our sponsor\'s IRB, before we started our experiments.'] }],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', 'alowaisheq2019_cracking', 'one FBI-seized domain\'s dangling Route 53 nameserver slot',
    { purpose: 'proof', keep: 'n/s', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'none' },
    { purpose: ['After several attempts, we successfully acquired one such server on the NS record'],
      other: ['We recommended that they address the problem by placing ServerHold on the domain, which they did on 2018-10-11.'] }],
  ['CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr', 'alowaisheq2020_zombie', 'own test domains (count not stated)',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['n/s'], review: 'discussed' },
    { purpose: ['we first register a domain and then open two accounts with a provider: victim and attacker'],
      answer: ['we only conducted the experiments on affected resolvers on domains that we control and avoided affecting resolutions of the PVDs'] }],
  ['IMC/2021/risky-bizness-risks-derived-from-registrar-name-management', 'akiwate2021_risky', '5 sacrificial-nameserver domains; one live .edu delegation',
    { purpose: 'logged', keep: 'metadata', handling: ['deleted-logs'], answer: 'silent', after: ['kept-defensively', 'n/s'], review: 'other-body' },
    { purpose: ['we observed incoming queries for the domains, while being careful to never respond'],
      answer: ['to return an A record if and only if the request originated from our client IP address during a short testing window. All other queries received no response'],
      handling: ['we further mitigated that concern by deleting all log data'],
      after: ['The .edu domain is no longer hijackable due to our defensive registrations pending outreach'],
      review: ['they were in no position to give us independent oversight', 'we conferred with campus general counsel', 'received their approval for our experimental design and its controls, before any active measurements were conducted'] }],
  ['NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media', 'kaleli2021_human', '45 unintended-URL domains, registered within hours of the tweet',
    { purpose: 'logged', keep: 'metadata', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'exempt' },
    { keep: ['we record information about each request including the client\'s IP address and request headers'],
      answer: ['we do not interact in any way with the users who click on those links and visit the web pages that we set up'],
      review: ['this research is not considered as human subjects research by our institution\'s IRB'],
      other: ['we argue that by registering these domains we are reducing potential harm'] }],
  ['IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust', 'so2022_spots', '201 expired domains',
    { purpose: 'logged', keep: 'content', handling: ['regret-stated'], answer: 'interactive-traps', after: ['expired'], review: 'discussed' },
    { keep: ['packet captures, we never engaged with clients to further advance', 'Thus, we stored only what the connecting clients'],
      handling: ['in retrospect, we could have collected fewer attributes from the'],
      answer: ['bot traps and JavaScript fingerprinting code', 'The Telnet and FTP services are low-interaction and collect only the credentials of the login attempts'],
      after: ['already expired and were returned to the pool of domains available'],
      other: ['we know that dropcatchers were not interested in them'] }],
  ['IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds', 'pauley2022_ipreuse', '1.5 million AWS IPs, each held about ten minutes, over 101 days',
    { purpose: 'logged', keep: 'content', handling: ['encrypted', 'declined-extra'], answer: 'tcp-accept', after: ['released-immediately'], review: 'exempt' },
    { keep: ['records received traffic for up to 10 minutes', 'the collection server uploads received traffic in PCAP format to an encrypted log repository'],
      handling: ['were not made to decode this traffic for ethical reasons', 'Only one person in the team was given credentials to the server'],
      answer: ['the telescope is designed to be non-interactive above the transport layer'],
      after: ['Terminated servers are automatically replaced by new collection servers to maintain the server quota'],
      review: ['Our data collection was covered under an exemption from our institutional review board (IRB)', 'reviewed, and approved by the security team (CISO Office) of our home institution'] }],
  ['IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to', 'liu2023_dial', '19 NXDomains, six months of collection',
    { purpose: 'logged', keep: 'content', handling: ['pii-deleted-before-publication'], answer: 'notice-page', after: ['renewing'], review: 'discussed' },
    { need: ['we need to collect the real application requests (e.g., HTTP requests) that are supposed to be issued after the DNS queries can be correctly resolved'],
      keep: ['It also collects detailed information about incoming traffic, including IP addresses, port numbers, and payloads'],
      handling: ['PIIs has been permanently deleted prior to the publication of this paper'],
      answer: ['The web server displays a landing page with detailed information about our experiments', 'We also post our email addresses on the landing page'],
      after: ['we will continue monitoring and renew all 19 domains for further investigation'],
      other: ['Our selected NXDomains must remain in nonexistent status for at least 6 months', 'we have not received any complaints or communications for our registered domains'] }],
  ['IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d', 'zhang2023_wolf', 'records for 30 domains on DNS-hosting providers, incl. five of the Tranco top 100',
    { purpose: 'proof', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['released-immediately'], review: 'discussed' },
    { answer: ['A records pointed to 127.0.0.1, and TXT records were with our intention and contact'],
      after: ['We removed the URs immediately following the conclusion of the'],
      review: ['ethical aspect carefully with the guide of ethical principles'] }],
  ['IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s', 'li2024_bounce', '30 unregistered recipient domains (typos of mail domains)',
    { purpose: 'nothing-deployed', keep: 'none', handling: ['none-stated'], answer: 'nothing-deployed', after: ['offered-to-owner'], review: 'other-body' },
    { purpose: ['we registered 30 domain names with the highest number of email receipts'],
      answer: ['For ethical and privacy reasons, we have not deployed any online services for registered domain names to monitor related traffic'],
      after: ['guaranteeing the transfer of our registered domain names free of charge'],
      review: ['While our institution lacks an Institutional Review Board (IRB), our research has been authorized and supervised by the network management department and regulatory authority of our partner'],
      other: ['This ensures that we do not discourage the public from registering domain names they are interested in'] }],
  ['USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure', 'zhang2024_cross', 'zones of inactive real domains on hosting providers, two per nameserver group',
    { purpose: 'proof', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['released-immediately'], review: 'discussed' },
    { answer: ['We select a harmless and informational TXT as the verification record', 'we set the negative cache\'s TTL to 1 second via SOA records'],
      after: ['Post-testing, we delete our configured records immediately and verify that the domain has returned to the REFUSED status', 'completing the entire process within 2 minutes to prevent client access during our tests'],
      other: ['we have checked query logs on hosting platforms and did not observe any requests from normal users during our test'] }],
  ['USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records', 'zhang2024_glue', 'more than 15 own test domains; 27 cloud IPs',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['released-immediately', 'n/s'], review: 'discussed' },
    { purpose: ['we registered more than 15 new domain names under different TLDs'],
      after: ['We released IPs immediately after allocation, so there is no actual impact on domains'] }],
  ['WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains', 'saric2024_hyperlink', '51 phantom domains plus a control',
    { purpose: 'logged', keep: 'metadata', handling: ['declined-extra'], answer: 'blank-page', after: ['n/s'], review: 'approved' },
    { need: ['it was necessary to evaluate traffic across a selection of phantom domains'],
      answer: ['serving a zero-length (i.e. blank) landing page'],
      handling: ['we chose to take a less intrusive path, complete with ethics approval'] }],
  ['NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild', 'wen2025_automatic', 'two test domains for a mail-client experiment',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['n/s'], review: 'discussed' },
    { answer: ['We set the hostname to 127.0.0.1 to prevent users affected by this vulnerability from connecting to our server'] }],
  ['NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange', 'chen2025_cross', 'a test domain; a registrable CNAME target of a Microsoft domain',
    { purpose: 'nothing-deployed', keep: 'none', handling: ['none-stated'], answer: 'nothing-deployed', after: ['n/s'], review: 'discussed' },
    { purpose: ['bought qtlcdnect.com from Godaddy', 'siderations, we did not continue the exploitation'],
      other: ['We then released the domain, making it available to other customers', 'we acted as a potential victim and purchased the domain through Namecheap'] }],
  ['USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation', 'zhang2025_misty', '80 test domains across four registrars, plus test IDNs',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'discussed' },
    { purpose: ['we registered 20 domain names from each registrar under different TLDs and conducted DNS host configuration tests'] }],
];
 
// Papers in the 48 that found a receivable name and chose not to take it, or measured demand without
// receiving anything. Quoted on the page as the alternative to registering.
export const DECLINED = [
  ['IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations', 'akiwate2020_lame', 'would not defensively register the at-risk nameserver domains',
    ['we cannot defensively register all of them, which would raise its own ethical issues if we could']],
  ['USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps', 'so2025_lost', 'checked registrability with a registrar, registered nothing',
    ['We did not register any expired domains and therefore never interacted with potential users of the affected APKs']],
  ['PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android', 'hortea2026_dead', 'WHOIS, DNS, TLS and CT queries only',
    ['We did not re-register expired domains, claim dangling cloud resources, or exploit any of the endpoints']],
  ['USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web', 'squarcina2021_subdomain', 'fingerprints and registrar availability, no claims on live sites',
    ['Due to ethical concerns, we did not mount attacks', 'We did not create any virtual machine or registered any service at cloud providers in this process']],
  ['NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem', 'alhamdan2025_deno', 'disclosed; the affected project bought the name',
    ['Deno team decided to register the problematic domain in response to our disclosure']],
  ['IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers', 'randall2020_trufflehunter', 'cache snooping at large public resolvers only',
    ['We refrain from probing caches of other "open" resolvers, since these are often misconfigured residential devices that may be serving only a few users']],
];
 
// Outside the 48 (malware infrastructure, not domain abuse): cited as a pointer, not counted.
export const OUTSIDE = [
  ['WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells', 'starov2016_honor', 'eight domains that web shells phone home to',
    ['returned HTTP 404 errors to all requests asking for content', 'For ethical reasons, we never attempted to validate any of the shell installations claimed in the Referer headers of the requests in our logs']],
];
 
// Residual-trust figures the "afterwards" paragraph leans on; located by the report script too.
export const MARKET = [
  ['USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover', 'lauinger2017_game',
    ['We find that 10 % of all com domains are re-registered on the same day as their old registration is deleted']],
  ['WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching', 'miramirkhani2018_panning',
    ['a domain that was malicious at the time of its expiration is twice as likely to be caught than the average domain']],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', 'alowaisheq2019_cracking',
    ['expired sinkholes have caused the transfer of around 30K takendown domains whose traffic is now under the control of new owners']],
];

Unedited output of node scripts/report_ethics_registration.mjs:

=== CORPUS GUARD ===
extracted records: 5859; IN keys absent from current extraction: 0

=== POPULATION ===
security:domain_abuse IN papers: 48
registered or claimed (HAND reg != 0 || claimed): 19  — registered domains: 15; claimed third-party resources: 6; both: 2
of the 19, received and logged traffic meant for someone else (LOGGED_ARRIVALS): 7 — years 2017, 2021, 2021, 2022, 2022, 2023, 2024
years of the 19: 2014, 2015, 2017, 2017, 2019, 2020, 2021, 2021, 2022, 2022, 2023, 2023, 2024, 2024, 2024, 2024, 2025, 2025, 2025  (2025–2026 provisional)

=== PURPOSE — denominator: all 19 ===
code              papers  citekeys
----------------  ------  --------------------------------------------------------------------------------------------------------------------
logged            7       szurdi2017_email akiwate2021_risky kaleli2021_human so2022_spots pauley2022_ipreuse liu2023_dial saric2024_hyperlink
parked            2       alrwais2014_parking vissers2015_parking
nothing-deployed  2       li2024_bounce chen2025_cross
proof             3       alowaisheq2019_cracking zhang2023_wolf zhang2024_cross
testbed           5       chen2017_client alowaisheq2020_zombie zhang2024_glue wen2025_automatic zhang2025_misty

=== REVIEW — denominator: all 19 ===
code        papers  citekeys
----------  ------  ------------------------------------------------------------------------------------------------------------------------------------------------------------------
approved    2       szurdi2017_email saric2024_hyperlink
exempt      2       kaleli2021_human pauley2022_ipreuse
other-body  2       akiwate2021_risky li2024_bounce
discussed   10      alrwais2014_parking alowaisheq2020_zombie so2022_spots liu2023_dial zhang2023_wolf zhang2024_cross zhang2024_glue wen2025_automatic chen2025_cross zhang2025_misty
none        3       vissers2015_parking chen2017_client alowaisheq2019_cracking

=== REVIEW — denominator: the 7 that logged arrivals ===
code        papers  citekeys
----------  ------  ------------------------------------
approved    2       szurdi2017_email saric2024_hyperlink
exempt      2       kaleli2021_human pauley2022_ipreuse
other-body  1       akiwate2021_risky
discussed   2       so2022_spots liu2023_dial
none        0

=== KEEP — denominator: the 7 that logged arrivals ===
code      papers  citekeys
--------  ------  -------------------------------------------------------------
content   4       szurdi2017_email so2022_spots pauley2022_ipreuse liu2023_dial
metadata  3       akiwate2021_risky kaleli2021_human saric2024_hyperlink
none      0
n/s       0

=== HANDLING — denominator: the 7 that logged arrivals (multi-label) ===
code                            papers  citekeys
------------------------------  ------  --------------------------------------
scrub-before-storage            1       szurdi2017_email
declined-extra                  2       pauley2022_ipreuse saric2024_hyperlink
encrypted                       2       szurdi2017_email pauley2022_ipreuse
deleted-logs                    1       akiwate2021_risky
pii-deleted-before-publication  1       liu2023_dial
regret-stated                   1       so2022_spots
none-stated                     1       kaleli2021_human

=== ANSWER — denominator: all 19 ===
code               papers  citekeys
-----------------  ------  --------------------------------------------------------
silent             1       akiwate2021_risky
tcp-accept         1       pauley2022_ipreuse
accept-all-mail    1       szurdi2017_email
blank-page         1       saric2024_hyperlink
notice-page        1       liu2023_dial
interactive-traps  1       so2022_spots
inert-record       3       zhang2023_wolf zhang2024_cross wen2025_automatic
monetised          2       alrwais2014_parking vissers2015_parking
nothing-deployed   2       li2024_bounce chen2025_cross
testbed-only       3       chen2017_client alowaisheq2020_zombie zhang2024_glue
n/s                3       alowaisheq2019_cracking kaleli2021_human zhang2025_misty

=== AFTER — denominator: all 19 (multi-label: a paper can state one disposition for some names and nothing for others) ===
code                  papers  citekeys
--------------------  ------  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
expired               1       so2022_spots
renewing              1       liu2023_dial
offered-to-owner      1       li2024_bounce
surrender-on-request  1       szurdi2017_email
kept-defensively      1       akiwate2021_risky
released-immediately  4       pauley2022_ipreuse zhang2023_wolf zhang2024_cross zhang2024_glue
released-test-domain  0
n/s                   13      alrwais2014_parking vissers2015_parking chen2017_client szurdi2017_email alowaisheq2019_cracking alowaisheq2020_zombie akiwate2021_risky kaleli2021_human zhang2024_glue saric2024_hyperlink wen2025_automatic chen2025_cross zhang2025_misty

state a disposition for at least some of what they held: 9 of 19; for all of it: 6 of 19; for none of it: 10 of 19
of the 15 that registered domains, state what happened to (some of) the domains: 5 — szurdi2017_email=surrender-on-request, akiwate2021_risky=kept-defensively, so2022_spots=expired, liu2023_dial=renewing, li2024_bounce=offered-to-owner
of the 7 that logged arrivals, no review body: 2 (so2022_spots, liu2023_dial); IRB said exempt / not human-subjects: kaleli2021_human, pauley2022_ipreuse

=== PER PAPER ===
year  citekey                  what                                                          purpose           keep      handling                        answer             after                     review
----  -----------------------  ------------------------------------------------------------  ----------------  --------  ------------------------------  -----------------  ------------------------  ----------
2014  alrwais2014_parking      23 purchased domains, parked with 7 services                  parked            none      none-stated                     monetised          n/s                       discussed
2015  vissers2015_parking      one typo domain of stackoverflow.com, parked with each servi  parked            none      none-stated                     monetised          n/s                       none
2017  chen2017_client          one new-gTLD domain for a testbed                             testbed           none      none-stated                     testbed-only       n/s                       none
2017  szurdi2017_email         76 typo domains of email providers, over seven months         logged            content   scrub-before-storage+encrypted  accept-all-mail    surrender-on-request+n/s  approved
2019  alowaisheq2019_cracking  one FBI-seized domain's dangling Route 53 nameserver slot     proof             n/s       none-stated                     n/s                n/s                       none
2020  alowaisheq2020_zombie    own test domains (count not stated)                           testbed           none      none-stated                     testbed-only       n/s                       discussed
2021  akiwate2021_risky        5 sacrificial-nameserver domains; one live .edu delegation    logged            metadata  deleted-logs                    silent             kept-defensively+n/s      other-body
2021  kaleli2021_human         45 unintended-URL domains, registered within hours of the tw  logged            metadata  none-stated                     n/s                n/s                       exempt
2022  so2022_spots             201 expired domains                                           logged            content   regret-stated                   interactive-traps  expired                   discussed
2022  pauley2022_ipreuse       1.5 million AWS IPs, each held about ten minutes, over 101 d  logged            content   encrypted+declined-extra        tcp-accept         released-immediately      exempt
2023  liu2023_dial             19 NXDomains, six months of collection                        logged            content   pii-deleted-before-publication  notice-page        renewing                  discussed
2023  zhang2023_wolf           records for 30 domains on DNS-hosting providers, incl. five   proof             none      none-stated                     inert-record       released-immediately      discussed
2024  li2024_bounce            30 unregistered recipient domains (typos of mail domains)     nothing-deployed  none      none-stated                     nothing-deployed   offered-to-owner          other-body
2024  zhang2024_cross          zones of inactive real domains on hosting providers, two per  proof             none      none-stated                     inert-record       released-immediately      discussed
2024  zhang2024_glue           more than 15 own test domains; 27 cloud IPs                   testbed           none      none-stated                     testbed-only       released-immediately+n/s  discussed
2024  saric2024_hyperlink      51 phantom domains plus a control                             logged            metadata  declined-extra                  blank-page         n/s                       approved
2025  wen2025_automatic        two test domains for a mail-client experiment                 testbed           none      none-stated                     inert-record       n/s                       discussed
2025  chen2025_cross           a test domain; a registrable CNAME target of a Microsoft dom  nothing-deployed  none      none-stated                     nothing-deployed   n/s                       discussed
2025  zhang2025_misty          80 test domains across four registrars, plus test IDNs        testbed           none      none-stated                     n/s                n/s                       discussed

=== QUOTE CHECK — every quote in ethreg_codes.mjs located in paper.cols.txt ===
quotes: 91; exact: 91; after joining line-end hyphens: 0; NOT FOUND: 0

=== DECLINED OR NEVER RECEIVED (comparison set, of the 48) ===
  2020 akiwate2020_lame: would not defensively register the at-risk nameserver domains
  2025 so2025_lost: checked registrability with a registrar, registered nothing
  2026 hortea2026_dead: WHOIS, DNS, TLS and CT queries only
  2021 squarcina2021_subdomain: fingerprints and registrar availability, no claims on live sites
  2025 alhamdan2025_deno: disclosed; the affected project bought the name
  2020 randall2020_trufflehunter: cache snooping at large public resolvers only

=== OUTSIDE THE 48 (pointer, not counted) ===
  2016 starov2016_honor: eight domains that web shells phone home to

=== YEAR COUNTS — paper counts, 2025–2026 provisional ===
year  domain-abuse IN denominator  registered/claimed  logged arrivals
----  ---------------------------  ------------------  ---------------
2010  1                            0                   0
2011  0                            0                   0
2012  0                            0                   0
2013  1                            0                   0
2014  2                            1                   0
2015  4                            1                   0
2016  3                            0                   0
2017  4                            2                   1
2018  3                            0                   0
2019  3                            1                   0
2020  3                            1                   0
2021  4                            2                   2
2022  2                            2                   2
2023  4                            2                   1
2024  5                            4                   1
2025  7                            3                   0
2026  2                            0                   0

=== UNMAPPED RESIDUE — identity selection and finite hand-code vocabulary ===
uncoded selected papers: 0; coded outside selection: 0; unknown code values: 0 (invalid values throw); no free-text alias fold used

The following checks use data/fulltext/<year>/<venue>/<slug>/paper.cols.txt, never .norm. The selected source spans and neighbouring text were exported to ethreg/run20261008/spotchecks.txt and read. No failure in the 91-span mechanical localisation run. No direct paper quotation is introduced in the new content section; its paper claims are paraphrases.

No new vendor/tool-status, law or contemporary drop-market claim is introduced. No industry listicle was sought or used. Venue/author primary pages fetched for publication identity or source verification during the currency review are recorded in the review log below. Historical academic results are explicitly dated; their present-day generalisation is not asserted.

The local 2026-09-28 draft's RDAP survey of names from So et al. was not reused: its mutable registration states would need new fetching, and one paper's current names cannot establish the harm from releasing research names. The section answers the disposal question using a dated market result plus named paper choices; no fresh intervention against the named domains is needed.

Recommendations: count-only collection where possible; silence or minimum necessary inert response; counsel/security-office review when the IRB declines; accountable handover or funded defensive renewal with reassessment. These are design judgments, not measured adoption rates. Continued holding also excludes other registrants; renewal is conditional, not a universal obligation. Publishing names is treated as a disclosure decision rather than categorically forbidden. Loopback DNS records and short windows are explicitly not guaranteed harmless.

• The inherited 48-paper selection excludes generic malware/DGA sinkholing and other namespaces. No overall count of interception studies is claimed. Its hand-code counts are reproducible, but not an independent measurement of the fixed population's recall or intercoder agreement.
• Reported approvals, non-responses and dispositions are what papers state, not observations of their actual conduct or the legal validity of their plans.
• No claim that receipt logging or historical controls are superseded: 2025–2026 are thin and provisional, and no recent logging paper was found inside this selection.
• During drafting the 2025/2026 IN split was accidentally typed as 6/3. The new year table caught this: corrected to 7/2 before review/publication; total nine was unchanged.
• Citation review caught that Chen's released test domain was repurchased within the experiment. Corrected its after code to n/s, retained both source spans under other, reran the report and changed the stated-domain-disposition count from six to five of 15. Also changed approval wording: Saric reports unspecified ethics approval, not explicitly IRB; Kaleli reports not-human-subjects, not necessarily Common Rule exemption.
• The initial citation check found chen2025_cross absent from the live bibliography. Generated with node scripts/bibgen.mjs NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange --key chen2025_cross, checked against the first page, and planned as the sole new shared entry. No new entry belongs only to this provenance page.
• The generic number-presence guard on the pre-edit ethics page reported 313 and 89.1 as absent from report_ethics.mjs. They belong to the pre-existing consent audit, not to this section. Reran node scripts/consent_action_noninteraction_audit.mjs; its current output reproduces 279/313 = 89.1%. These existing figures were left unchanged.
• Closed the linked domain-abuse page's obsolete question and corrected only the associated review labels and Kaleli retention cell. A matching append-only log is published on its provenance page; its report rerun is byte-identical, with no numeric change. This keeps the reading path coherent without starting another topic.
• No credentials or private intercepted traffic were read or printed. Public paper excerpts only.

The requested Sonnet/Fable model identifiers are not available through this environment's agent tool. Three focused reviewers used explicitly selected GPT-6.1-sol, with independent task contexts and an explicit warning that context might be incomplete; a fourth generic pass uses the same available model. This preserves the separate review scopes but does not provide the requested model diversity.

No focused-review finding rejected. The following reports preserve initial findings and correction rechecks; earlier 90-span and six-disposition descriptions are superseded by the rerun above (91 spans, five registered-domain dispositions).

review-figures.txt

Figure review — 2026-10-08
Reviewer: Codex figure-review agent. No content/script edits.
 
Reproduction
Ran node scripts/report_ethics_registration.mjs into review-registration-rerun.txt, and node scripts/report_ethics.mjs into review-ethics-rerun.txt. Both exit 0; diffs against registration-output.txt and ethics-output.txt are empty. Guard: 5,859 extraction records, all 48 IN identities present, 19 selected identities, zero uncoded/extra/invalid rows. All 90 evidence quotes locate exactly in paper.cols.txt.
 
New-section numbers and populations
- 48 IN; 19 registering/claiming; 15 registering and 6 claiming with overlap 2: correct.
- 7 logging arrivals; other twelve = 5 testbeds + 2 parking + 3 proofs + 2 nothing-deployed: correct.
- Four content and three metadata among seven: correct.
- Review split among seven: two approved, two exempt, one other-body, two discussed, zero none. Numeric split correct; IRB wording unsupported (below).
- 15 registered-domain papers, six with disposition for at least some domains: correct. Named six match report (Szurdi, Akiwate, So, Liu, Li, Chen). Exclusion of released-immediately is explained in provenance as a claimed-resource code.
- Publication years in receiver table and other cited examples match corpus keys.
- Logging precedent years 2017–2024: correct. Inert-record takeover proofs 2023–2024: correct (Wen 2025 is testbed).
- 2025 IN 7; 2026 IN 2; total nine. Registration/claiming 3 and 0, logging 0 and 0: correct. Both years marked provisional. Earlier draft's 6/3 is absent from content except as explicitly corrected provenance history.
- All spelled-out counts checked: other twelve, seven receivers, four content, three metadata, two approvals, two exemptions, one other body, two discussion-only, six dispositions, nine recent papers, none logging. Correct arithmetic.
 
Per-paper number/source context
Read paper.cols.txt directly for Zhang 2024, Pauley 2022, and Lauinger 2017. Zhang says negative-cache TTL 1 second; entire test within 2 minutes; immediate removal, REFUSED rollback and normal-user query-log checks. Pauley collects up to 10 minutes per collection server, then uploads, terminates and replaces servers. Content's one second, two minutes and up to ten minutes are accurate. Lauinger explicitly describes 10% of deleted com domains re-registered on deletion day; new content's denominator and historical framing are correct. These design durations are appropriately not presented as safe thresholds.
 
Must-fix in added section
Opening paragraph says “two report IRB approval”. Szurdi explicitly names IRBs; Saric only says “complete with ethics approval”. Full-text probe found no IRB/review-board passage for Saric. Code approved means IRB OR ethics board and cannot support an IRB-only count. Suggested replacement: “two report approval”. Do not invent Saric's approving body.
 
Untouched corpus figures vs regenerated report
Checked corpus 5,859/seven/2010–2026; empirical 5,118; all outcome table counts/shares; all participant/crawl population rows; all time-window cells; all venue cells; all body families and 1,347/595; robots counts/shares and next-four field table; all mitigation families and 585/971 vs 207/971; notification/regulator denominators; sweep figures and Menlo rates; trimming count and rate changes. All match ethics-output.txt.
Spelled-out summaries agree: one in three; two thirds; four in five; PoPETs more than three times TheWebConf (54.3/16.6); almost three times mitigation vs review (585/207); twenty no-board papers, sixteen participants, half Menlo; five AUP papers; seven network-department papers; ten operator-opt-out papers and twenty-one candidates. Notification yes+partial = 2,160/4,472 = 48.3%, supporting nearly half.
 
Flagged inherited interpretation, not a refreshed count
page.txt line 59 claims 30.1% is a reporting rate participant studies “had already passed before 2014”. The table has 28.6% in 2010–2013, BELOW 30.1%, and 58.7% in 2014–2017. It does not establish a before-2014 crossing. Counts match script; interpretation needs correction or annual evidence. Supported wording: “roughly the rate participant studies reported in 2010–2013”, or “a rate participant studies had passed by 2014–2017”. Treat as inherited discrepancy rather than automatic corpus refresh.
 
Scope limitations
Internal reproduction/arithmetic/identity and selected source context checked; independent recall of the 48-paper hand selection and full semantic recoding of nineteen papers were not performed. One-coder/not-double-coded caveat is appropriate.
Untouched external policy/legal/product dates, external paper counts, sister-page figures (26 messaging papers, 5.1% hand-coding crowdworker share), and consent-audit figures (55/1,120 and 279/313) are not outputs of report_ethics and were not independently re-audited here. No mismatch inferred from their absence in that report.
Regenerated extraction figures do not verify actual author conduct, validity/remit of reviews or present market conditions.
 
Final-update recheck
Parent incorporated review fixes and source-reviewer's Chen correction. Current page says two ethics approvals (one explicitly IRB); this accurately limits specificity. Existing rate comparison now says 30.1% is just above 28.6% and below 58.7%; supported. Chen CODES now after=n/s, with both release and repurchase spans under other; final disposition cannot be inferred from intermediate release. Current disposition count is FIVE of 15, not earlier six. Page lists the five appropriately and explicitly explains Chen's release/repurchase. Reran registration script after correction: exit 0, empty diff vs current registration-output.txt, 91 exact evidence spans and zero failures. Current report disposition totals: some 9/19, all 6/19, none 10/19; registered-domain disposition 5/15. Earlier ledger entries above describe the reviewed prior draft and are superseded by this final recheck. No remaining must-fix figures identified.

review-citations.txt

Citation/source review — 2026-10-08
Reviewer scope: proposed receiving-traffic section in page.txt and section.txt; appended registration provenance; report_ethics_registration.mjs, ethreg_codes.mjs, saved registration-output.txt; current read-only publications_dataset paper.cols.txt sources. No content edited.
 
Findings requiring correction
 
1. Review-category wording overstates Saric's approval and Kaleli's determination.
Location: page.txt:330, opening count paragraph.
Current wording: 'two report IRB approval, two an exemption'.
Saric et al. 2024 paper.cols.txt states only 'complete with ethics approval' (line 489); fulltext contains no IRB or review-board identification. Szurdi and Christin explicitly state IRB approval. The code's approved category means 'an IRB or ethics board approved', not IRB specifically. Kaleli says the institution's IRB did not consider this human-subjects research; that is not stated as an exemption. The later review paragraph already makes the latter distinction correctly.
Action: say 'two report ethics approval (one explicitly IRB), two an exemption or not-human-subjects determination, one approval by another body, and two discuss ethics without naming a review body'. Consider broadening the code-label explanation to unspecified ethics approval as well; do not infer Saric's approving body's identity from this text.
 
2. Chen test-domain release is an intermediate experiment step, not stated final disposition.
Location: page.txt:369; ethreg_codes.mjs chen2025_cross after code; provenance's 6/15 disposition count.
Current source says they registered an own test domain, issued a certificate, released it, then purchased it through Namecheap as a simulated victim and issued certificates again. Omitting repurchase while listing release alongside post-study dispositions can imply the domain was left available after the study. This is distinct from qtlcdnect.com, which they separately purchased and declined to exploit; no release of that target is stated.
Action: describe 'released and then repurchased a test domain to simulate resale; final disposition unstated'. For a count of final/post-study domain dispositions, exclude Chen and recalculate to 5/15; alternatively define and label a different metric explicitly that includes intermediate release/reacquisition and never present it as final disposal. The distinction from a demonstrated traffic receiver is correct but insufficient to disclose repurchase.
 
Verified support
 
- Re-ran node scripts/report_ethics_registration.mjs successfully against current fulltext. Output matched registration-output.txt byte-for-byte. All 90 coded source strings localized exactly; zero missing quotations. No direct quotation is introduced in the proposed content section.
- All 20 distinct citation keys used in section.txt resolve exactly once across the fetched bibliography.txt plus bib-addition.txt. chen2025_cross is the sole added key. Its title occurs only once in the combined bibliography. First page of current NDSS 2025 fulltext confirms the title, year/venue, and seven authors in the proposed entry's order: Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu, Haixin Duan.
- Akiwate 2021 source supports general counsel approval of design and controls before active measurement, specifically because the IRB could not supply independent oversight; the page does not imply counsel is an IRB.
- Pauley 2022 supports IRB exemption separately from CISO-office approval of data handling; encrypted PCAP/storage, restricted access, ten-minute acquisition windows and no interaction above transport are supported. The page correctly limits this precedent's remit.
- Li 2024 supports partner network-management department and regulatory authority supervision at an institution without an IRB. No receiving online service was deployed on registered typo domains; free transfer was offered.
- Metadata classifications are supported by actual collection fields, not inferred from published counts: Kaleli collects client IP and headers, Saric logs IP/time/request/user-agent, Akiwate logs resolver queries then deletes logs. These remain potentially sensitive metadata; page cautions accordingly.
- Szurdi collection/scrubbing/encryption/IRB/accept-mail and no-outgoing-mail claims match source; Liu payload/IP/port collection, notice page, personal-data removal before publication, and renewal intention match source. So 2022 packet capture, fingerprinting, credential traps, overcollection admission and expiry-again claims match source.
- Zhang 2023 loopback A/TXT/removal and Zhang 2024 informational TXT, one-second negative-cache TTL, within-two-minute process, REFUSED rollback and no-normal-user log check match source. The page correctly treats short windows and loopback as design choices rather than proof of harmlessness.
- Lauinger 2017 supports 10% of deleted .com domains re-registered on deletion day, not 10% of all extant .com or all research names. Source explicitly uses a historical four-week 2016 dataset. The page's dated population qualifier and denial of a current market-rate claim are appropriate.
- Randall large-public-resolver limitation, Squarcina non-claiming availability approach, So 2025 non-registration and Hortea 2026 non-registration/non-claiming are supported. Their use as alternatives does not imply a field-wide cessation of receipt collection.
- Numerical counts other than the disposition interpretation in finding 2 reproduce the hand codes: 48 selected papers, 19 registrants/claimants, 7 logged-arrival papers, 4 content/3 metadata; 2025/2026 selected split 7/2, registration split 3/0 and no arrival logging among those nine.
 
Coverage limits
 
This review verifies local current primary fulltext and bibliography snapshots, not actual researcher conduct, legal validity, operational ownership today, or the external wiki's live post-publication state. The quote-localization pass is mechanical; contextual close reading focused on review remits, collection fields, disposition, historical denominator, resource-claim controls and the newly added Chen entry. It is not an independent recoding of all 48 papers or a corpus-recall audit. No mutable domain/RDAP/vendor assertion required new lookup. Recommendations are explicitly normative and do not need to be misrepresented as empirical adoption rates. Remaining publication verification should re-fetch the live page and shared bibliography after publication.
 
Correction re-review — same session
 
Both substantive findings are resolved in the current page.txt. Opening review counts now distinguish unspecified ethics approval from explicit IRB approval and distinguish exemption from not-human-subjects determinations. The disposition denominator is now 5/15; Chen is explicitly described as release followed by repurchase with final disposition unstated. Current Chen after code is n/s and the repurchase source span is included. Re-ran the report: 91/91 source strings localized exactly, zero failures, and output matched refreshed registration-output.txt. No remaining publication-blocking citation finding.
 
Optional documentation refinement: FIELDS.review.approved still says 'an IRB or ethics board approved'. Saric names neither an IRB nor an ethics board; change the label to 'explicit ethics approval (body may be unspecified)' or equivalent if this vocabulary will be reused. This does not affect corrected page counts or source attribution.

review-currency.txt

External currency review — 2026-10-08 UTC
 
Scope: added “Registering or claiming names to receive misdirected traffic” section in page.txt (also section.txt), registration provenance addition in provenance.txt, scripts/report_ethics_registration.mjs and ethreg_codes.mjs, and registration-output.txt. Unchanged venue-policy/legal material was outside this review. No edits to proposed content.
 
Result: PASS. No material currency correction required.
 
Findings:
1. The new section dates historical controls by publication year, presents them as precedents, and expressly denies that this thin selected population establishes supersession of receipt logging. Recommendations are described as design judgments, not measured 2026 adoption. No dated academic method is falsely represented as obsolete or a current universal standard.
2. So et al. is correctly identified as USENIX Security 2025. The fetched official PDF section 4.4 verifies availability via a registrar; section 9 explicitly states no expired domains were registered and experiments manipulated the authors’ testing environment. This supports the alternative without suggesting all network traffic collection ceased.
3. Hortea et al. is correctly identified as PoPETs 2026, issue 4. Appendix A on printed page 129 in the freshly downloaded official PDF states synthetic test-device profiles, no real-user interception, no expired-domain re-registration or dangling-resource claim, and external DNS/WHOIS/TLS/CT queries. The proposed paraphrase matches. The paper’s publication identity is current, while the dataset population remains correctly marked provisional.
4. The official 2017 Lauinger venue page and paper support the approximately 10% same-day .com re-registration result. The section explicitly limits it to the historical deleted-domain population and disclaims both a current drop-market rate and measured harm from releasing research names. Its use as historical motivation is appropriately qualified.
5. “None of these nine logged arrivals” is locally scoped to seven 2025 and two 2026 papers in the hand-selected 48-paper domain-abuse population. The report’s YEAR COUNTS agrees (7/3/0 and 2/0/0 for IN/registered-or-claimed/logged). Script guards define IN from the fixed VERDICTS selection and require CODES/LOGGED_ARRIVALS agreement. No field-wide no-recent-logging assertion is introduced.
6. The mutable RDAP survey is expressly omitted. No new vendor-status, contemporary market-rate or legal claim needs current verification in this addition.
 
Exact primary-source URLs fetched/read on 2026-10-08 UTC:
- https://www.usenix.org/conference/usenixsecurity25/presentation/so — web open; publication identity and abstract read.
- https://www.usenix.org/system/files/usenixsecurity25-so.pdf — web click/open/find; sections 4.4 and 9 read.
- https://petsymposium.org/popets/2026/popets-2026-0112.php — web open; title/authors/year/issue/DOI and abstract read.
- https://petsymposium.org/popets/2026/popets-2026-0112.pdf — web click initially returned 17-page PDF metadata; subsequent web find/open returned internal errors/timeouts. Same official URL freshly fetched successfully with curl, then Appendix A read using pypdf extraction. No cached local corpus text substituted for this external check.
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lauinger — web open; year/identity and abstract result read.
- https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-lauinger.pdf — web open; paper fetched and historical result/context checked. The initial venue-page PDF click failed internally; direct official URL succeeded.
 
Rejected sources: none. No secondary/listicle sources sought or relied upon. Failed web fetches above were transport/tool failures, not rejected evidence. No current RDAP requests or unrelated external legal/venue-policy checks performed.

review-generic.txt

Generic review, 2026-10-08
 
Scope: current page.txt and provenance.txt, report_ethics_registration.mjs, ethreg_codes.mjs, registration-output.txt, adjacent exported domain-abuse page, proposed bibliography. Independent generic review after the three focused reviews; no content or code edits.
 
Publication-blocking issue
 
G1. The provenance final figures recheck contradicts its current real output. At provenance.txt:1373 it says “for all 5/19”; the embedded current report and a fresh rerun say “for all 6 of 19”. Five is the registered-domain some-disposition count (5/15), not the all-resources complete-disposition count (6/19). This is a provenance prose defect only: the new section does not use the latter figure. Correct or explicitly annotate that review sentence before publication. Its preceding blanket warning only supersedes earlier six registered-domain dispositions and does not clearly cure this reversed stale value in the later “final recheck”.
 
Optional improvements / adjacent consistency
 
G2. The linked live security:domain_abuse page still contains the open-question WRAP saying Ethics has no receiving-traffic section, blanket “2 IRB approval / 2 IRB exemption” labels, and Kaleli’s “visit counts only”. The current Ethics addition fixes all three issues in its own account. Replacing the stale question with a section pointer and aligning the short source descriptions would make the linked reading path coherent. This is outside the proposed Ethics page itself; do it if the authorized adjacent-page scope permits.
 
G3. The code vocabulary still defines inert-record as “a harmless record”, while the reader-facing section correctly says loopback changes resolution and is not automatically harmless. Use “limited identifying or loopback record” in the audit definition to keep the published codebook as careful as the prose. No numerical impact.
 
Checks and judgment
 
- Fresh node scripts/report_ethics_registration.mjs run succeeded; empty diff against registration-output.txt. All 91 spans exact; no failed localization. 48/19/15/6 with overlap 2, seven arrival loggers, four content versus three metadata, current review aggregation, five domain dispositions and year counts match the section. Quote localization is correctly distinguished from semantic validation and independent coding.
- Read the whole proposed section, source-code definitions and added provenance. Need, keep, answer, after and review defaults are concrete and explicitly recommendations; named contrary designs remain visible. Proof, passive availability, testbed and reception variants are distinguished. TTL/windows are author choices, not certified safe thresholds. Historical drop-market evidence and selected-population recent absence are appropriately bounded. No MDN/textbook detour.
- Corpus scope, fixed hand selection, provisional years, single coder, lack of double coding and unknown recall outside selection are stated plainly. The report and codebook are fully embedded, with dependency selection on the linked domain-abuse provenance; the published audit can be reproduced against the named corpus mount. No figure relies on an unreported string fold.
- Read-only JSON-RPC getPage of security:domain_abuse succeeded and found the exact “Registering names to measure them” heading. The new provenance heading exists in the proposed document. All 20 distinct section citekeys occur in bibliography-new.txt, including Chen. Final save/render/link verification remains the publisher’s completion step.
- Review-body statements are appropriately limited: unspecified Saric approval, Kaleli not-human-subjects determination, Pauley separate CISO plan, Li partner supervision. Chen’s intermediate release/repurchase is not counted as final disposal. No additional substantive overclaim identified.
 
Conclusion: publish after G1 is corrected/annotated and normal post-save verification succeeds. G2 and G3 are useful coherence improvements, not reasons to block this section.
 
Correction recheck, 2026-10-08
 
G1 resolved: original figures reviewer corrected its final recheck to some 9/19, all 6/19, none 10/19, with registered-domain dispositions still 5/15. Current provenance embeds that corrected review and the agreeing report. Fresh registration-report rerun succeeded with empty diff against registration-output.txt and 91 exact spans.
 
G2 resolved in proposed domain-new.txt: inspected full diff against live export. Obsolete open-question WRAP replaced with explicit namespaced link to the exact new Ethics heading; 19-paper approval labels and full-cohort category descriptions now permit unspecified ethics approval and not-human-subjects determinations; Kaleli now distinguishes client IP/header collection from visit-count results. No numerical changes or unrelated modifications in the diff. Parent will record this adjacent correction in its existing provenance page.
 
G3 resolved: current ethreg_codes.mjs and embedded provenance codebook describe a minimally interactive record and explicitly warn that changes can still affect clients. No numerical effect.
 
Final judgment: no remaining publication-blocking or optional review findings. Proposed source is ready to publish with its bibliography and provenance; normal post-save equality/render/link verification remains required.

Publication completed using guarded JSON-RPC saves with each read revision and summaries containing the user-required “Authored by Claude”. Both existing pages were extended, not replaced with parallel pages. The shared bibliography received only Chen's new entry; the source page received the scoped pointer/attribution corrections described above.

Post-save verification: each of five raw pages matched its exact saved file. Playwright's own Chromium rendered the four content/provenance pages; citation markers and reference lists resolved, and new link targets and headings exist. The section screenshot was visually inspected: heading, paragraphs, citations and table layout are readable. Initial rendered checking encountered two issues: a no-citation sibling provenance page legitimately had no reference list (explicit source citations were then added for its new label claims), and Chen's new shared entry was absent from the plugin's stale bibliography cache. Purging the bibliography before purging the pages resolved Chen; the verification script now rejects displayed missing-key errors as well as unrendered syntax. No missing citation remained.

The following output is from the successful verification pass immediately before this completion note was saved; revisions identify that snapshot rather than a future revision of this note. Final raw/DOM checking is repeated after saving the note.

RAW practices:ethics: MATCH; revision 1791454869
RAW provenance:practices:ethics: MATCH; revision 1791454867
RAW security:domain_abuse: MATCH; revision 1791454874
RAW provenance:security:domain_abuse: MATCH; revision 1791454965
RAW literature:bibliography: MATCH; revision 1791454864
DOM practices:ethics: HTTP 200 {"citekeys":162,"refs":43,"unrendered":[],"heads":[{"id":"registering_or_claiming_names_to_receive_misdirected_traffic","text":"Registering or claiming names to receive misdirected traffic"}],"errors":[],"brokenNewLinks":[]}
DOM provenance:practices:ethics: HTTP 200 {"citekeys":26,"refs":13,"unrendered":[],"heads":[{"id":"registration_and_claiming_section_2026_10_08","text":"Registration and claiming section 2026 10 08"}],"errors":[],"brokenNewLinks":[]}
DOM security:domain_abuse: HTTP 200 {"citekeys":282,"refs":52,"unrendered":[],"heads":[{"id":"where_registrations_come_from_and_what_each_source_misses","text":"Where registrations come from, and what each source misses"},{"id":"registering_names_to_measure_them","text":"Registering names to measure them"}],"errors":[],"brokenNewLinks":[]}
DOM provenance:security:domain_abuse: HTTP 200 {"citekeys":4,"refs":2,"unrendered":[],"heads":[],"errors":[],"brokenNewLinks":[]}

1. Read OVERVIEW.md and README.md before querying. Ran node scripts/sitemap.mjs and exported practices:ethics, provenance:practices:ethics, messaging_channels and its provenance via JSON-RPC. Sitemap flags 21 pre-existing namespace-relative link problems elsewhere; no unrelated repairs made.
2. Ran node scripts/report_ethics.mjs > scripts/report_ethics-refresh-20261008-output.txt and node scripts/report_ethics_registration.mjs > scripts/report_ethics_registration-refresh-20261008-output.txt. Both match their previous outputs byte-for-byte (diff empty). Figures reviewer also reran report_interrater.mjs and caught a stale 5.1% related-page annotation figure; that numeric clause was deleted, not recalculated. This verifies the old corpus-derived tables against the current corpus; it does not independently establish every historic external claim. Old time-sensitive material remains explicitly dated August 2026.
3. Initial node scripts/report_ethics_groups.mjs failed at batch_02's empty deciding_quote (cloud/IPFS paper). Source repaired; that large September report contains unreviewed hand ethics codes and was not used for new published ethics percentages.
4. New production query: node scripts/report_ethics_online_groups.mjs > scripts/report_ethics_online_groups-output.txt. Full corpus probe; six vocabulary families; candidate if at least five family mentions, or one first-person collection context plus two mentions, or ten bare-forum mentions after CA/Browser Forum subtraction. Added all messaging CONTEXT/IN recall cases not already candidates. 414 probes + five additions = 419 candidates; every candidate has a verdict.
5. Inclusion: actual analysis of community-member posts or data, including forums, subreddits, imageboards, messenger groups/channels/servers, social groups, community Q&A and actual member discussions on professional lists. Excludes recruitment alone, broadcast feeds, private email/password/device dumps and technical/protocol objects. Minor uses retained because the criterion is use as research data, not main contribution.
6. Denominator 168 adjudicated IN papers: 110 collected, 11 mixed, 43 reuse, three leak, one route unresolved. Platform counts are paper-counted, multi-label, hand-folded: Reddit 75, forums 56, Telegram 24, Discord 10. These are detection counts under this search, not complete field prevalence. Community vocabulary in related work can generate OUT candidates; low-mention or differently named communities can still be missed.
7. Denominator 121 IN papers with collected or mixed route: query extraction ethics.reviewOutcome. Count stated values approved/exempt/not-required/sought-outcome-unstated/explicitly-discussed-no-review; 71 non-sentinel labels. These are not independently verified review decisions: He interaction precautions and Gao masking precautions do not establish the review categories assigned by extraction. None-mentioned 43 plus absent record seven = 50 silent. Paper-wide outcomes, never group-component approvals. No participant-free denominator is assumed: some included papers also interviewed people.
8. Denominator 26 messaging HAND records, separate from broad query: approval 10, exemption one, not-required two, no-board-named two, other-part-only one, silent ten; passive stated seven. Task hint said nine silent; current HAND and report say ten, so ten was used. Silent does not mean no review happened.
9. Years query joins IN/collected keys to extraction year. Page displays 2024 (22 IN / 15 direct or mixed), 2025 (29 / 19) and 2026 (12 / 9); last two explicitly provisional in the table. Entire year-by-year series is in real output. No method was dated superseded from this series. Local and hosted LLM use coexist in 2025–2026 examples.

Free-text names were not aggregated as exact strings. Probe family regexes are printed in the report and source below. Final platform families and route/verdict codes were read from papers and adjudicated; original spelling remains in deciding quotes. Different names for forums map to forum; Reddit/subreddit/Pushshift cases to reddit only when community data was actually used; Telegram/WhatsApp/Discord stay separate. Other messenger groups, mailing lists and community Q&A have explicit families. All 41 CONTEXT and 210 OUT candidates and four missing-text records are printed in full in the ledger below, along with the IN entries, so neither exclusions nor uncertain source evidence disappear.

A route could not be established for the climate-activism paper; it is IN/not-stated and excluded from the collection denominator. Vendor-supplied harassment data is conservatively reuse absent evidence of a commissioned collection. API queries through a service count as collection; downloading an existing archive counts as reuse. This boundary can change route counts without changing overall inclusion. Auditors' notes record the cases.

Main checked 12 load-bearing corpus spans directly in paper.cols.txt; exact patterns and surrounding source text follow. These cover entry restrictions, interaction, consent arguments, payload omission, local/hosted LLMs and group expectations. Statements on the content page are paraphrases, not invented verbatim quotations. The broad extraction review count was spot-checked separately below.

The report also checks every candidate deciding quote as a contiguous whitespace/dehyphenation-normalized cols span and prints nonmatches. This is a locator check, not validation of all original hand codes: nonmatches include PDF column damage and paraphrases. Auditors read methodology/source PDFs for included and disputed papers; two contaminated cols files (no-easy-way-out and mind-your-blocks) required their own PDFs. Citation reviewer independently confirmed no-easy-way-out approval in its original paper.pdf and primary arXiv v7 §3.6 (“formally approved” by institutional ERB for data collection/analysis); its mismatched extraction quote remains unverified as a quotation. Existing unused consent/minimisation/LLM hand codes have NOT received comprehensive re-audit and do not support published shares.

Recommendations are deliberate defaults, not majority practice: no deceptive/paid/vouched entry; justify collection without consent; minimisation before storage; controlled recipients; paraphrased/aggregate release. Marjanov's advertised-invite private Telegram channels do not make a small trusted WhatsApp group public. Arunasalam's abusive outsider example establishes expectations/distress in that incident, not causal harm from silent research observation. Avoid phone-number hash anonymity claims: small enumerable identifier domains permit guessing. File caps reduce collection volume, not exposure guarantees. Local inference reduces third-party disclosure, not terms/licensing restrictions.

No SEO/listicle source used. Rejected the blanket “the platform's terms forbid all collection” framing from the neighbour: WhatsApp wording concerns unauthorised collection and Discord distinguishes bot routes. Rejected treating published papers as platform permissions. Did not add training/retention claims about any hosted LLM vendor; they do not decide whether disclosure is acceptable. DOI browser lookup for Beadle returned an internal tool error; bibliography DOI generated from the corpus index and title/authors checked in its primary paper. No claim of successful live DOI resolution. Currency reviewer followed WhatsApp EEA/UK regional links; the EEA terms effective 2026-08-17 retain the relevant clause. The previously present-tense missing WWW2027-CFP note was corrected: its primary research CFP now exists, with the ethics-data/informed-consent paragraph checked on 2026-10-08.

The script is retained under scripts/ in this workspace. This workspace has no .git repository, so a git commit is unavailable; files and all used output are retained and published here. Its dependencies are grp_probes.mjs, grp_codes.mjs, msgch_fold.mjs and existing shared lib.mjs; reviewed JSONL inputs remain under grp/codes. Ledger below exposes every used verdict/route/platform key, including excluded candidates. Shared bibliography adds only three new keys (Beadle, Barbosa–Milan, AoIR), collision-checked; existing messaging citations reused. This provenance page has no separate bibliography entries.

node scripts/report_ethics_online_groups.mjs — source:

report_ethics_online_groups.mjs

// Audit surface for practices:ethics / Entering and recording online groups.
// Run: node scripts/report_ethics_online_groups.mjs
// Uses whole-corpus probes and reviewed candidate codes; does NOT reuse unreviewed
// hand-coded ethics/minimisation fields from the unfinished September run.
import fs from 'node:fs';
import path from 'node:path';
import {loadExtractions, dataRoot} from './lib.mjs';
import {probePaper, isCandidate, FAMILIES} from './grp_probes.mjs';
import {loadCodes} from './grp_codes.mjs';
import {VERDICTS, HAND} from './msgch_fold.mjs';
const rows=loadExtractions(), key=p=>`${p.venue}/${p.year}/${p.slug}`;
const byKey=new Map(rows.map(p=>[key(p),p]));
const probes=rows.map(probePaper), present=probes.filter(Boolean);
const candidates=new Set(present.filter(isCandidate).map(p=>p.key));
const recall=VERDICTS.filter(v=>v[1]!=='OUT'&&!candidates.has(v[0])).map(v=>v[0]);
recall.forEach(k=>candidates.add(k));
const codes=loadCodes();
const missing=[...candidates].filter(k=>!codes.has(k)), stray=[...codes.keys()].filter(k=>!candidates.has(k));
if(missing.length||stray.length) throw Error(`Missing ${missing.join(', ')}; stray ${stray.join(', ')}`);
const all=[...codes.values()], included=all.filter(r=>r.verdict==='IN');
const collected=included.filter(r=>['collected','mixed'].includes(r.route));
const tally=(rs,get)=>{const m=new Map();for(const r of rs) for(const v of new Set([get(r)].flat())) m.set(v,(m.get(v)||0)+1);return [...m].sort((a,b)=>b[1]-a[1]||a[0].localeCompare(b[0]));};
const show=(title,rs,get)=>{console.log(`\n${title}; denominator ${rs.length} papers`);for(const [v,n] of tally(rs,get))console.log(`  ${v}: ${n}`);};
console.log('Run population: extracted security/networking corpus, seven venues, 2010–2026.');
console.log(`Extracted ${rows.length}; paper.cols.txt available ${present.length}; unavailable ${rows.length-present.length}.`);
console.log(`Community vocabulary probes: ${present.filter(isCandidate).length} candidates; messaging recall additions ${recall.length}; candidates audited ${candidates.size}.`);
console.log('Recall additions:');recall.forEach(k=>console.log(`  ${k}`));
console.log('This is a detected and adjudicated population, not exhaustive community-research prevalence.');
console.log('IN: analysis of posts or member data from forums, subreddits, imageboards, messenger groups/channels/servers, social groups or community Q&A/mailing lists.');
console.log('OUT: incidental mentions, recruitment alone, broadcast feeds, private email/password/device dumps, platform/protocol studies without community-member data.');
show('Verdicts',all,r=>r.verdict);
show('IN route',included,r=>r.route);
show('IN platform families (multi-label)',included,r=>r.platforms);
show('IN role',included,r=>r.role);
console.log('\nYear-by-year counts; 2025 and 2026 PROVISIONAL, not a complete trend');
for(let y=2010;y<=2026;y++) console.log(`${y}${y>=2025?' provisional':''}: IN ${included.filter(r=>byKey.get(r.key).year===y).length}; directly collected or mixed ${collected.filter(r=>byKey.get(r.key).year===y).length}`);
const stated=new Set(['approved','exempt','not-required','sought-outcome-unstated','explicitly-discussed-no-review']);
const outcome=r=>byKey.get(r.key).ethics?.reviewOutcome??'no-ethics-record';
show('Extraction review outcome, DIRECTLY COLLECTED OR MIXED (paper-wide, not proof of group-collection approval)',collected,outcome);
console.log(`Of ${collected.length} directly collected or mixed papers, non-sentinel paper-wide review labels ${collected.filter(r=>stated.has(outcome(r))).length}; silent ${collected.filter(r=>!stated.has(outcome(r))).length}.`);
show('Messaging HAND review (separate older route codes rerun; not broad-population review)',Object.entries(HAND),r=>r[1].irb);
console.log(`Of ${Object.keys(HAND).length} messaging HAND papers, passive explicitly stated ${Object.values(HAND).filter(r=>r.passive==='stated').length}.`);
console.log('\nFolding rules: probes use the six regex families below; final platform families are hand-coded, not exact-string aggregation. Q&A and actual member discussion on professional mailing lists map to other/mailing-list. Sentinels never count as stated review.');
for(const [n,re] of Object.entries(FAMILIES))console.log(`${n}: ${re}`);
console.log('\nFull candidate residue: CONTEXT and OUT retained below, with reason and deciding source quote. Missing-text residue:');
rows.filter((p,i)=>!probes[i]).forEach(p=>console.log(key(p)));
const norm=s=>s.normalize('NFKC').replace(/(\w)-\s+(\w)/g,'$1$2').replace(/\s+/g,' ').toLowerCase().trim();
let exact=0,notFound=0;
console.log('\nFull candidate ledger (IN included too, for rejecting the boundary):');
for(const r of all.sort((a,b)=>a.key.localeCompare(b.key))){
 const p=byKey.get(r.key),f=path.join(dataRoot(),'fulltext',String(p.year),p.venue,p.slug,'paper.cols.txt');
 const t=fs.existsSync(f)?norm(fs.readFileSync(f,'utf8')):'';
 const found=t.includes(norm(r.deciding_quote));if(found)exact++;else notFound++;
 console.log(`${r.key} | ${r.verdict}/${r.code} | ${r.route} | ${r.platforms.join(', ')} | deciding quote ${found?'cols located':'NOT LOCATED as contiguous normalized span'}\n  ${r.deciding_quote}`);
}
console.log(`\nDeciding-quote checks across ${all.length} candidate papers: ${exact} contiguous normalized cols spans; ${notFound} not located. A nonmatch can be column damage or a paraphrase; it is not certified evidence. See human audit logs. No unverified quote is quoted verbatim on the content page.`);

grp_probes.mjs

// grp_probes.mjs — candidate probes for the practices:ethics section "Entering and recording
// online groups" (2026-09-28). Nothing here is a population: every probe produces a CANDIDATE
// set, and the population is the hand verdict in grp_codes.mjs.
//
// The object is an online COMMUNITY SPACE — a forum, a subreddit, an imageboard board, a
// Telegram/WhatsApp/Discord group, channel or server, a Facebook group, another messenger's
// group — as a source of the members' own content. Broadcast feeds (a Twitter timeline, a
// YouTube channel's uploads) are not the object, so the bare platform names of those are not
// probed.
//
// Texts are read one at a time from paper.cols.txt with whitespace collapsed (a PDF line break
// inside "underground forum" otherwise undercounts).
import { loadExtractions } from './lib.mjs';
import { readCollapsed, key, count } from './msgch_probes.mjs';
 
// Families. Case-sensitive where the lowercase form is an English word or another thing:
// "Discord", "Gab", "Nulled", "Dread", "Reddit" (a verb in no English, but keep the rule uniform).
export const FAMILIES = {
  forum: new RegExp([
    String.raw`\b(underground|hack(ing|er)|cyber-?crim(e|inal)|criminal|dark ?(web|net)|darknet|carding|extremist|jihadist|incel|hate|fringe|online|discussion|web|internet|public|private|closed|cheat(ing)?|black ?hat|piracy|warez|drug|vendor|seller|hobbyist|support|health|developer|security) forums?\b`,
    String.raw`\bforum (posts?|threads?|members?|users?|data|dataset|messages?|content|crawl(er|ing)?|scrap(e|ed|ing|er))\b`,
    String.raw`\b(Hack ?Forums|HackForums|CrimeBB|Nulled\.to|Exploit\.in|XSS\.is|BlackHatWorld|Stormfront|Kiwi ?Farms|incels\.(is|co|me)|RaidForums|BreachForums|OGUsers|Antichat|MPGH|Sinister\.ly|Cracked\.to|Dread|Hidden Answers|Lolzteam|Club2CRD|Crdclub|Verified\.(ru|cm))\b`,
    String.raw`\b(message|bulletin|discussion) boards?\b`,
  ].join('|'), 'gi'),
  reddit: new RegExp([String.raw`\bsubreddits?\b`, String.raw`(^|[\s(])/?r/[A-Za-z0-9_]{3,}`, String.raw`\bReddit\b`, String.raw`\bPushshift\b`, String.raw`\bPRAW\b`].join('|'), 'g'),
  imageboard: new RegExp([String.raw`\b4chan\b`, String.raw`/pol/`, String.raw`\b8(chan|kun)\b`, String.raw`\bimage ?boards?\b`, String.raw`\bGab\b`, String.raw`\bParler\b`, String.raw`\bVoat\b`, String.raw`\bThe_Donald\b`].join('|'), 'g'),
  messaging: new RegExp([
    String.raw`\b(Telegram|WhatsApp|Discord|Signal|Viber|WeChat|LINE|Slack|Kik|GroupMe|QQ|KakaoTalk|IRC|Matrix) (groups?|channels?|servers?|chats?|chat ?rooms?|communities|supergroups?)\b`,
    String.raw`\bTelethon\b`, String.raw`\bTGStat\b`, String.raw`\bTelemetr(io)?\b`, String.raw`\bDisboard\b`, String.raw`chat\.whatsapp\.com`, String.raw`discord\.gg\b`,
  ].join('|'), 'g'),
  social_group: new RegExp([String.raw`\bFacebook groups?\b`, String.raw`\b(Mastodon|Fediverse) (instances?|servers?|communities)\b`, String.raw`\bVK (groups?|communities)\b`, String.raw`\bgroup chats?\b`, String.raw`\bchat ?rooms?\b`, String.raw`\bmailing lists?\b`].join('|'), 'gi'),
  generic: /\bonline communit(y|ies)\b/gi,
};
 
// First-person collection near community vocabulary: the verb within ~120 characters of a
// family hit. A recall aid for low-mention papers, not a threshold.
export const COLLECT_RE = new RegExp(
  String.raw`\bwe (crawl(ed)?|scrap(e|ed)|collect(ed)?|gather(ed)?|join(ed)?|monitor(ed)?|download(ed)?|archiv(e|ed)|harvest(ed)?|subscrib(e|ed)|obtain(ed)?|retriev(e|ed)|record(ed)?|lurk(ed)?|observ(e|ed)|infiltrat(e|ed)|register(ed)?|sampl(e|ed)|extract(ed)?|analy[sz](e|ed))\b.{0,120}?\b(forums?|subreddits?|boards?|groups?|channels?|servers?|communit(y|ies)|threads?|chat ?rooms?|4chan|Reddit|Telegram|WhatsApp|Discord|Gab|Parler)\b`,
  'gi');
 
export const THRESH = 5; // total community-vocabulary mentions to enter on volume alone
 
// Bare "forum(s)", minus the CA/Browser Forum (a TLS standards body, dozens of mentions in
// certificate papers). Counted apart from FAMILIES because it is a homograph-heavy word: a paper
// enters on it only at >= BARE_FORUM_THRESH, which added 16 papers the families missed
// (Hack for Hire, the Shadow Brokers paper) when first run.
export const BARE_FORUM = /\bforums?\b/gi;
export const CAB_FORUM = /\bCA\/?B(rowser)? Forums?\b|\bCAB ?Forums?\b/gi;
export const BARE_FORUM_THRESH = 10;
 
export function probePaper(p) {
  const t = readCollapsed(p);
  if (t === null) return null;
  const fam = {};
  let total = 0;
  for (const [k, re] of Object.entries(FAMILIES)) { fam[k] = count(t, re); total += fam[k]; }
  const collect = count(t, COLLECT_RE);
  const bareForum = count(t, BARE_FORUM) - count(t, CAB_FORUM);
  return { key: key(p), p, fam, total, collect, bareForum };
}
 
// Candidate: >= THRESH community mentions, or >= 1 first-person collection sentence plus >= 2
// mentions. Printed with both counts so the boundary stays visible.
export const isCandidate = (r) => r.total >= THRESH || (r.collect >= 1 && r.total >= 2) || r.bareForum >= BARE_FORUM_THRESH;
 
if (import.meta.url === `file://${process.argv[1]}`) {
  const rows = loadExtractions();
  let missing = 0;
  const res = [];
  for (const p of rows) {
    const r = probePaper(p);
    if (r === null) { missing += 1; continue; }
    res.push(r);
  }
  console.log(`papers ${rows.length}, with text ${res.length}, missing text ${missing}`);
  for (const k of Object.keys(FAMILIES)) {
    for (const th of [1, 3, 5, 10]) console.log(`  ${k.padEnd(13)} >=${String(th).padStart(2)}: ${res.filter((r) => r.fam[k] >= th).length}`);
  }
  for (const th of [3, 5, 10, 20]) console.log(`total >=${th}: ${res.filter((r) => r.total >= th).length}`);
  console.log(`collect>=1 & total>=2: ${res.filter((r) => r.collect >= 1 && r.total >= 2).length}`);
  console.log(`bare forum >=${BARE_FORUM_THRESH} (CA/B Forum removed): ${res.filter((r) => r.bareForum >= BARE_FORUM_THRESH).length}`);
  const cand = res.filter(isCandidate);
  console.log(`CANDIDATES: ${cand.length}`);
  if (process.argv.includes('--tsv')) {
    for (const r of cand.sort((a, b) => b.total - a.total)) {
      console.log([r.key, r.total, r.collect, r.bareForum, ...Object.values(r.fam), r.p.title].join('\t'));
    }
  }
}

grp_codes.mjs

// grp_codes.mjs — hand verdicts and codes behind the practices:ethics section "Entering and
// recording online groups" (2026-09-28). Imported by report_ethics_groups.mjs. Nothing here is
// computed: it loads the readers' JSONL (grp/codes/batch_*.jsonl, one line per candidate, made by
// sonnet readers under notes/grp_reader_brief.md) and applies the main session's OVERRIDES on top.
//
// The loader is strict: a line missing a field, a value outside its enum, or a candidate coded
// twice or not at all throws. A missing field is a broken reader contract, and the fix is to the
// JSONL, not a default here.
import fs from 'node:fs';
import path from 'node:path';
 
const HERE = path.dirname(new URL(import.meta.url).pathname);
export const CODES_DIR = path.join(HERE, '..', 'grp', 'codes');
 
export const FIELDS = ['key', 'verdict', 'code', 'deciding_quote', 'route', 'role', 'dataset', 'platforms', 'object',
  'vulnerable', 'vulnerable_quote', 'access', 'access_quote', 'interaction', 'interaction_quote', 'review',
  'review_body', 'review_quote', 'consent', 'waiver_reason', 'consent_quote', 'privacy_expectation', 'privacy_quote',
  'minimise', 'minimise_quotes', 'quotes_policy', 'quotes_policy_quote', 'third_party', 'terms', 'terms_quote', 'notes'];
 
export const ENUMS = {
  verdict: ['IN', 'CONTEXT', 'OUT'],
  route: ['collected', 'reuse', 'leak', 'mixed', 'not-stated', ''],
  role: ['main', 'one-of-several', 'minor', ''],
  platforms: ['forum', 'reddit', 'imageboard', 'gab-parler-voat', 'telegram', 'whatsapp', 'discord', 'facebook-group',
    'other-messenger', 'chat-irc', 'mailing-list', 'fediverse', 'other'],
  vulnerable: ['yes', 'no'],
  access: ['public-no-account', 'account-open', 'invite-or-approval', 'paid-or-vouched', 'mixed', 'not-stated', 'n/a-reuse'],
  interaction: ['passive-stated', 'interacted', 'deceptive', 'not-stated'],
  review: ['approved', 'exempt', 'not-required', 'no-board-named', 'other-part-only', 'not-stated'],
  consent: ['waiver-argued', 'obtained-members', 'permission-admins', 'not-discussed'],
  privacy_expectation: ['discussed', 'not-discussed'],
  minimise: ['pseudonymise-usernames', 'hash-identifiers', 'no-media-download', 'file-type-or-size-cap', 'aggregate-only',
    'paraphrased-quotes', 'no-verbatim-quotes', 'removed-pii', 'deletion-retention', 'secure-storage-access-control',
    'restricted-release', 'no-deanonymisation', 'other'],
  quotes_policy: ['paraphrased', 'verbatim-deidentified', 'verbatim', 'no-quotes', 'not-stated'],
  third_party_kind: ['hosted-llm', 'hosted-api', 'local-model', 'human-crowd'],
  terms: ['discussed', 'not-stated'],
};
export const CONTEXT_CODES = ['user-study', 'declined', 'links-only', 'own-community', 'operator', 'bots'];
export const OUT_CODES = ['recruitment', 'mention', 'homograph', 'broadcast', 'attack', 'app-or-protocol', 'other'];
 
// Main-session corrections, applied after loading. [key, field, new value, why]. Every one of
// these was decided by reading the paper; the report prints them all.
export const OVERRIDES = [];
 
function check(rec, where) {
  for (const f of FIELDS) if (!(f in rec)) throw new Error(`${where}: ${rec.key}: missing field ${f}`);
  const one = (f) => { if (!ENUMS[f].includes(rec[f])) throw new Error(`${where}: ${rec.key}: ${f}=${JSON.stringify(rec[f])} not in enum`); };
  one('verdict');
  if (rec.verdict === 'IN') {
    for (const f of ['route', 'role', 'vulnerable', 'access', 'interaction', 'review', 'consent', 'privacy_expectation', 'quotes_policy', 'terms']) one(f);
    if (rec.route === '' || rec.role === '') throw new Error(`${where}: ${rec.key}: IN without route/role`);
    if (rec.code !== rec.route) throw new Error(`${where}: ${rec.key}: IN code ${rec.code} != route ${rec.route}`);
    if (!Array.isArray(rec.platforms) || rec.platforms.length === 0) throw new Error(`${where}: ${rec.key}: IN with no platforms`);
    for (const x of rec.platforms) if (!ENUMS.platforms.includes(x)) throw new Error(`${where}: ${rec.key}: platform ${x}`);
    for (const x of rec.minimise) if (!ENUMS.minimise.includes(x)) throw new Error(`${where}: ${rec.key}: minimise ${x}`);
    if (rec.minimise.length !== rec.minimise_quotes.length) throw new Error(`${where}: ${rec.key}: minimise/minimise_quotes length differ`);
    for (const t of rec.third_party) {
      for (const f of ['service', 'kind', 'why_local', 'quote']) if (!(f in t)) throw new Error(`${where}: ${rec.key}: third_party missing ${f}`);
      if (!ENUMS.third_party_kind.includes(t.kind)) throw new Error(`${where}: ${rec.key}: third_party kind ${t.kind}`);
    }
  } else if (rec.verdict === 'CONTEXT') {
    if (!CONTEXT_CODES.includes(rec.code)) throw new Error(`${where}: ${rec.key}: CONTEXT code ${rec.code}`);
  } else if (!OUT_CODES.includes(rec.code)) throw new Error(`${where}: ${rec.key}: OUT code ${rec.code}`);
  if (typeof rec.deciding_quote !== 'string' || rec.deciding_quote.trim().length === 0) throw new Error(`${where}: ${rec.key}: empty deciding_quote`);
}
 
export function loadCodes() {
  const files = fs.readdirSync(CODES_DIR).filter((f) => /^batch_\d\d\.jsonl$/.test(f)).sort();
  if (files.length === 0) throw new Error(`no batch files in ${CODES_DIR}`);
  const byKey = new Map();
  for (const f of files) {
    const lines = fs.readFileSync(path.join(CODES_DIR, f), 'utf8').split('\n').filter((l) => l.trim().length > 0);
    lines.forEach((l, i) => {
      const where = `${f}:${i + 1}`;
      const rec = JSON.parse(l);
      if (byKey.has(rec.key)) throw new Error(`${where}: ${rec.key} coded twice (also ${byKey.get(rec.key).__where})`);
      rec.__where = where;
      rec.__overridden = [];
      byKey.set(rec.key, rec);
    });
  }
  for (const [k, field, value, why] of OVERRIDES) {
    if (!byKey.has(k)) throw new Error(`override for uncoded ${k}`);
    const rec = byKey.get(k);
    if (!(field in rec)) throw new Error(`override of unknown field ${field} on ${k}`);
    rec.__overridden.push({ field, from: rec[field], to: value, why });
    rec[field] = value;
  }
  for (const rec of byKey.values()) check(rec, rec.__where);
  return byKey;
}

Unedited production output:

report_ethics_online_groups-output.txt

Run population: extracted security/networking corpus, seven venues, 2010–2026.
Extracted 5859; paper.cols.txt available 5855; unavailable 4.
Community vocabulary probes: 414 candidates; messaging recall additions 5; candidates audited 419.
Recall additions:
  WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms
  WWW/2023/a-prompt-log-analysis-of-text-to-image-generation-systems
  IMC/2022/exploring-the-security-and-privacy-risks-of-chatbots-in-messaging-services
  USENIX/2023/token-spammers-rug-pulls-and-sniper-bots-an-analysis-of-the-ecosystem-of-tokens
  WWW/2025/detecting-and-understanding-the-promotion-of-illicit-goods-and-services-on-twitt
This is a detected and adjudicated population, not exhaustive community-research prevalence.
IN: analysis of posts or member data from forums, subreddits, imageboards, messenger groups/channels/servers, social groups or community Q&A/mailing lists.
OUT: incidental mentions, recruitment alone, broadcast feeds, private email/password/device dumps, platform/protocol studies without community-member data.
 
Verdicts; denominator 419 papers
  OUT: 210
  IN: 168
  CONTEXT: 41
 
IN route; denominator 168 papers
  collected: 110
  reuse: 43
  mixed: 11
  leak: 3
  not-stated: 1
 
IN platform families (multi-label); denominator 168 papers
  reddit: 75
  forum: 56
  telegram: 24
  discord: 10
  mailing-list: 9
  imageboard: 7
  other: 7
  facebook-group: 4
  gab-parler-voat: 3
  other-messenger: 3
  whatsapp: 3
  fediverse: 2
  chat-irc: 1
 
IN role; denominator 168 papers
  main: 89
  one-of-several: 48
  minor: 31
 
Year-by-year counts; 2025 and 2026 PROVISIONAL, not a complete trend
2010: IN 5; directly collected or mixed 5
2011: IN 2; directly collected or mixed 1
2012: IN 0; directly collected or mixed 0
2013: IN 1; directly collected or mixed 1
2014: IN 2; directly collected or mixed 1
2015: IN 3; directly collected or mixed 2
2016: IN 3; directly collected or mixed 3
2017: IN 7; directly collected or mixed 7
2018: IN 7; directly collected or mixed 7
2019: IN 21; directly collected or mixed 12
2020: IN 10; directly collected or mixed 8
2021: IN 8; directly collected or mixed 7
2022: IN 14; directly collected or mixed 6
2023: IN 22; directly collected or mixed 18
2024: IN 22; directly collected or mixed 15
2025 provisional: IN 29; directly collected or mixed 19
2026 provisional: IN 12; directly collected or mixed 9
 
Extraction review outcome, DIRECTLY COLLECTED OR MIXED (paper-wide, not proof of group-collection approval); denominator 121 papers
  approved: 43
  none-mentioned: 43
  not-required: 13
  exempt: 8
  no-ethics-record: 7
  explicitly-discussed-no-review: 4
  sought-outcome-unstated: 3
Of 121 directly collected or mixed papers, non-sentinel paper-wide review labels 71; silent 50.
 
Messaging HAND review (separate older route codes rerun; not broad-population review); denominator 26 papers
  approved: 10
  not-stated: 10
  no-board-named: 2
  not-required: 2
  exempt: 1
  other-part-only: 1
Of 26 messaging HAND papers, passive explicitly stated 7.
 
Folding rules: probes use the six regex families below; final platform families are hand-coded, not exact-string aggregation. Q&A and actual member discussion on professional mailing lists map to other/mailing-list. Sentinels never count as stated review.
forum: /\b(underground|hack(ing|er)|cyber-?crim(e|inal)|criminal|dark ?(web|net)|darknet|carding|extremist|jihadist|incel|hate|fringe|online|discussion|web|internet|public|private|closed|cheat(ing)?|black ?hat|piracy|warez|drug|vendor|seller|hobbyist|support|health|developer|security) forums?\b|\bforum (posts?|threads?|members?|users?|data|dataset|messages?|content|crawl(er|ing)?|scrap(e|ed|ing|er))\b|\b(Hack ?Forums|HackForums|CrimeBB|Nulled\.to|Exploit\.in|XSS\.is|BlackHatWorld|Stormfront|Kiwi ?Farms|incels\.(is|co|me)|RaidForums|BreachForums|OGUsers|Antichat|MPGH|Sinister\.ly|Cracked\.to|Dread|Hidden Answers|Lolzteam|Club2CRD|Crdclub|Verified\.(ru|cm))\b|\b(message|bulletin|discussion) boards?\b/gi
reddit: /\bsubreddits?\b|(^|[\s(])\/?r\/[A-Za-z0-9_]{3,}|\bReddit\b|\bPushshift\b|\bPRAW\b/g
imageboard: /\b4chan\b|\/pol\/|\b8(chan|kun)\b|\bimage ?boards?\b|\bGab\b|\bParler\b|\bVoat\b|\bThe_Donald\b/g
messaging: /\b(Telegram|WhatsApp|Discord|Signal|Viber|WeChat|LINE|Slack|Kik|GroupMe|QQ|KakaoTalk|IRC|Matrix) (groups?|channels?|servers?|chats?|chat ?rooms?|communities|supergroups?)\b|\bTelethon\b|\bTGStat\b|\bTelemetr(io)?\b|\bDisboard\b|chat\.whatsapp\.com|discord\.gg\b/g
social_group: /\bFacebook groups?\b|\b(Mastodon|Fediverse) (instances?|servers?|communities)\b|\bVK (groups?|communities)\b|\bgroup chats?\b|\bchat ?rooms?\b|\bmailing lists?\b/gi
generic: /\bonline communit(y|ies)\b/gi
 
Full candidate residue: CONTEXT and OUT retained below, with reason and deciding source quote. Missing-text residue:
USENIX/2010/idle-port-scanning-and-non-interference-analysis-of-network-protocol-stacks-usin
CCS/2014/beware-your-hands-reveal-your-secrets
IMC/2020/bgp-beacons-network-tomography-and-bayesian-computation-to-locate-route-flap-dam
IEEE-SP/2020/burglars-iot-paradise-understanding-and-mitigating-security-risks-of-general-mes
 
Full candidate ledger (IN included too, for rejecting the boundary):
CCS/2010/dissecting-one-click-frauds | IN/collected | collected | forum | deciding quote cols located
  We collect data from three public forums: 2 Channel BBS [5]: The largest bulletin board in Japan, which provides discussion threads on various topics ranging from Japanese anime to sports. Several ongoing threads are dedicated to exposing One Click Frauds.
CCS/2010/testing-metrics-for-password-creation-policies-by-attacking-large-sets-of-reveal | OUT/other |  |  | deciding quote cols located
  The majority of tests in this paper use passwords collected from the RockYou password list [6].
CCS/2011/an-efficient-user-verification-system-via-mouse-movements | OUT/other |  |  | deciding quote cols located
  For the field set, more than 1,000 unique forum users' • Angle of Curvature.
CCS/2011/text-based-captcha-strengths-and-weaknesses | OUT/homograph |  |  | deciding quote cols located
  the machine learning community's best practices
CCS/2013/rethinking-ssl-development-in-an-appified-world | IN/collected | collected | forum | deciding quote cols located
  We used stackoverflow.com, a popular online forum for software developers, to search for results that contained text such as "android/ios allow all certificates" and "android/ios trust all certificates"
CCS/2014/dialing-back-abuse-on-phone-verified-accounts | IN/collected | collected | forum | deciding quote NOT LOCATED as contiguous normalized span
  we purchase 4,695 Google PVA... accounts purchased from a cross-section of 14 account merchants selling Google PVA on blackmarket forums and storefronts
CCS/2014/shadowcrypt-encrypted-web-applications-for-everyone | OUT/app-or-protocol |  |  | deciding quote cols located
  We also tested publishing applications, namely WordPress, Reddit, Blogger, Tumblr, and Pinterest. For all these applications, ShadowCrypt was able to support encrypted post-titles, posts, and comments.
CCS/2015/drops-for-stuff-an-analysis-of-reshipping-mule-scams | OUT/other |  |  | deciding quote cols located
  We have collaborated closely with the Federal Bureau of Investigation (FBI) and the United States Postal Investigation Service (USPIS)
CCS/2015/leakage-abuse-attacks-against-searchable-encryption | IN/reuse | reuse | mailing-list | deciding quote cols located
  The second dataset we used is a subset of the Apache mailing list archives. Specifically, we used the "java-user" mailing list from the lucene project for the years 2005-2011.
CCS/2016/chainsaw-chained-automated-workflow-based-exploit-generation | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  all messages stored in the geccBB_forum table are retrieved and rendered to users without sanitization
CCS/2016/cspautogen-black-box-enforcement-of-content-security-policy-upon-real-world-webs | OUT/app-or-protocol |  |  | deciding quote cols located
  the templates of Amazon, CNN, Facebook and Yahoo can work without updating for at least three months; the templates of Google and Reddit can maintain satisfying matching rates for two months.
CCS/2017/a-large-scale-empirical-study-of-security-patches | OUT/mention |  |  | deciding quote cols located
  mailing list archives (e.g., marc.info, openwall.com/lists), other vulnerability database entries (e.g., securityfocus.com, securitytracker.com), and bug reports
CCS/2017/data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials | OUT/other |  |  | deciding quote cols located
  manually collecting credential leaks shared on 11 private, member-only blackhat forums
CCS/2017/economic-factors-of-vulnerability-trade-and-exploitation | IN/collected | collected | forum | deciding quote cols located
  Through market infiltration we collect information on trade of vulnerability exploits spanning from 2010 to 2017, and correlate this data with Symantec data on exploits detected at scale.
CCS/2017/why-do-developers-get-password-storage-wrong-a-qualitative-usability-study | OUT/mention |  |  | deciding quote cols located
  A lot of forums say that is very secure and very up to date and has a high vote in some cryptography website. [...] I find it trust-able, the Stack Overflow and cryptography forums.
CCS/2018/fraud-de-anonymization-for-fun-and-profit | IN/collected | collected | facebook-group | deciding quote cols located
  we identified 44 fraud workers in Facebook groups, Zeerk, Peopleperhour, Freelancer and Upwork that advertised prices ranging from a few cents ($0.56 on average from Zeerk.com) to several dollars per review
CCS/2018/knowledge-seeking-on-the-shadow-brokers | CONTEXT/links-only |  | forum | deciding quote cols located
  Figure 2b is the registration page of 'Hell Forum'[3]
CCS/2019/the-art-and-craft-of-fraudulent-app-promotion-in-google-play | CONTEXT/user-study |  | facebook-group, whatsapp | deciding quote cols located
  The qualitative study of our work is comprised of in-depth interviews with 18 ASO workers. We recruited participants from several Facebook ASO groups, and also Upwork [19], Fiverr [39], Zeerk [21], and Peopleperhour [14], all popular among ASO workers.
CCS/2020/impersonation-as-a-service-characterizing-the-emerging-criminal-infrastructure-f | IN/collected | collected | telegram | deciding quote cols located
  we collected a number of examples provided by users of ImpaaS.ru on a Telegram channel linked to the platform, to which we have gained access through ImpaaS.ru
CCS/2022/ready-raider-one-exploring-the-misuse-of-cloud-gaming-services | OUT/attack |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Another method of injecting malicious URLs is to utilize the Wiki pages, forums, and blogs of computer games. ... Taking advantage of wikis, forums, and blogs, adv[ersaries can inject malicious URLs]
CCS/2022/why-so-toxic-measuring-and-triggering-toxic-behavior-in-open-domain-chatbots | IN/reuse | reuse | reddit, imageboard | deciding quote cols located
  we use the dataset released by Baumgartner et al. [6] by selecting and focusing on four subreddits
CCS/2023/dont-leak-your-keys-understanding-measuring-and-exploiting-the-appsecret-leaks-i | OUT/mention |  |  | deciding quote cols located
  we strictly adhered to community practices to prevent harm to victims or super apps
CCS/2023/pakistani-teens-and-privacy-how-gender-disparities-religion-and-family-values-im | CONTEXT/user-study |  | whatsapp, facebook-group | deciding quote cols located
  almost all male participants said they were part of some closed gender-specific group, while 9 women elaborated on using gender segregated spaces such as private group chats or closed groups.
CCS/2023/unsafe-diffusion-on-the-generation-of-unsafe-images-and-hateful-memes-from-text | IN/reuse | reuse | imageboard, reddit | deciding quote cols located
  We use the dataset from Papasavva et al. [47], containing 134M posts, from which we sample 13M posts spanning from June 30, 2016, to July 31, 2017
CCS/2024/detecting-broken-object-level-authorization-vulnerabilities-in-database-backed-a | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Figure 1 illustrates CVE-2022-31295, a BOLA vulnerability in the application Odfs-1.0 (Online Discussion Forum Site).
CCS/2024/do-anything-now-characterizing-and-evaluating-in-the-wild-jailbreak-prompts-on-l | IN/mixed | mixed | reddit, discord | deciding quote cols located
  We gather 168,687 submissions from the selected subreddits from Pushshift [15] until March 2023, after which we transitioned to ArcticShift.
CCS/2024/moderator-moderating-text-to-image-diffusion-models-through-fine-grained-context | IN/collected | collected | reddit | deciding quote cols located
  We collected 153 potentially problematic prompts from social media platforms (e.g., Reddit) and an inappropriate image prompts (I2P) dataset
CCS/2024/modern-problems-require-modern-solutions-community-developed-techniques-for-onli | OUT/broadcast |  |  | deciding quote cols located
  we collected and analyzed data from two popular social media platforms, TikTok and YouTube
CCS/2024/on-the-detectability-of-chatgpt-content-benchmarking-methodology-and-evaluation | IN/reuse | reuse | reddit | deciding quote cols located
  Finance, Medicine, OpenQA, Reddit, and Wikipedia in HC3 [35]; arXiv papers, PeerRead reviews, Reddit, wikiHow manuals, and Wikipedia in M4 [104]
CCS/2024/using-ai-assistants-in-software-development-a-qualitative-study-on-security-prac | IN/collected | collected | reddit | deciding quote cols located
  We also reviewed 190 relevant Reddit posts and comments to gain insights into the current discourse surrounding AI assistants for software development.
CCS/2025/competing-for-attention-an-interview-study-with-participants-of-cryptography-com | CONTEXT/user-study |  | mailing-list | deciding quote NOT LOCATED as contiguous normalized span
  We conducted 20 semi-structured interviews with 20 participants of cryptography competitions between July 2024 and February 2025.
CCS/2025/is-this-a-scam-the-nature-and-quality-of-reddit-discussion-about-scams | IN/reuse | reuse | reddit | deciding quote cols located
  We conducted a multi-stage thematic analysis of 1,525 posts from a set of Reddit communities dedicated to discussing scams.
CCS/2025/security-and-privacy-perceptions-of-pakistani-facebook-matrimony-group-users | CONTEXT/user-study |  | facebook-group | deciding quote NOT LOCATED as contiguous normalized span
  Through 23 semi-structured interviews with Facebook matrimony group users, we explore participants’ security and privacy concerns
CCS/2025/unsafebench-benchmarking-image-safety-classifiers-on-real-world-and-ai-generated | OUT/mention |  |  | deciding quote cols located
  Unsafe images that include inappropriate content, such as violence, self-harm, and hate, are prevalent across Web communities like Reddit [2] and 4chan [1].
IEEE-SP/2010/a-practical-attack-to-de-anonymize-social-network-users | IN/collected | collected | facebook-group, other | deciding quote cols located
  By directing our custom crawler to Xing, we could download the data of 6,574 groups containing more than 1.8 million unique members.
IEEE-SP/2011/click-trajectories-end-to-end-analysis-of-the-spam-value-chain | OUT/mention |  |  | deciding quote cols located
  Some of the earliest such work has aimed to understand the scope of underground markets based on the value of found goods (typically stolen financial credentials), either as seen on IRC chatrooms [10], forums [59], malware "dropzones" [16], or directly by intercepting communications to botnet C&C servers [50].
IEEE-SP/2011/i-still-know-what-you-visited-last-summer-leaking-browsing-history-via-user-inte | OUT/mention |  |  | deciding quote cols located
  This vulnerability was first publicly disclosed by Andrew Clover in a BUGTRAQ mailing list post in February of 2002
IEEE-SP/2013/trawling-for-tor-hidden-services-detection-measurement-deanonymization | OUT/mention |  |  | deciding quote cols located
  In April 2012, an "ask me anything" thread (AMA) on the social news website Reddit appeared in which an anonymous poster, allegedly a malware coder and botnet operator, claimed to be operating a botnet with its command and control center running as a Tor hidden service
IEEE-SP/2014/doppelganger-finder-taking-stylometry-to-the-underground | IN/leak | leak | forum | deciding quote cols located
  For each of these four forums we have a complete SQL dump of their database that includes user registration information, along with public and private messages.
IEEE-SP/2015/vetting-ssl-usage-in-applications-with-sslint | OUT/homograph |  |  | deciding quote cols located
  many of which are community maintained software and have their own upstream projects
IEEE-SP/2016/users-really-do-plug-in-usb-drives-they-find | OUT/mention |  |  | deciding quote cols located
  a user posted on the university sub-Reddit attack's success rate, but we do find that by attaching keys to about finding multiple drives on campus and stated that they the drive, more users return the drives and that by providing reported the incident to an IT group.
IEEE-SP/2017/how-to-learn-klingon-without-a-dictionary-detection-and-measurement-of-black-key | IN/collected | collected | forum, other-messenger | deciding quote cols located
  we queried them on Baidu Tieba (a Chinese forum), QQ groups and Baidu search, three popular communication channels for the underground economy, and examined the posts, chat messages, member information
IEEE-SP/2017/under-the-shadow-of-sunshine-understanding-and-detecting-bulletproof-hosting-on | IN/collected | collected | forum | deciding quote cols located
  we scan underground forums for posts advertising BPH services and contact them for purchasing
IEEE-SP/2018/hackers-vs-testers-a-comparison-of-software-vulnerability-discovery-processes | CONTEXT/user-study |  | forum, mailing-list | deciding quote cols located
  Finally, we asked each participant to describe their interactions with other members of their local community and the vulnerability discovery and software tester community at large.
IEEE-SP/2018/the-spyware-used-in-intimate-partner-violence | IN/collected | collected | forum | deciding quote cols located
  in one forum an (ab)user posts "I'm looking for an app I can install on my wife's phone that is hidden so that I can see where she is or has been via cell towers or gps." In reply, another (ab)user posts, [Install] Cerberus from the market.
IEEE-SP/2018/tracking-certificate-misissuance-in-the-wild | IN/collected | collected | mailing-list | deciding quote cols located
  We crawled the MDSP forum from the beginning of 2015 and searched for links to certificates that were misissued (e.g., a link to crt.sh). We
IEEE-SP/2019/does-certificate-transparency-break-the-web-measuring-adoption-and-error-rate | IN/collected | collected | forum | deciding quote cols located
  we reviewed CT-related posts in the Chrome product help forum6 . We reviewed the 75 public threads matching a search term for the error code that Chrome displays for CT errors (ERR_CERTIFICATE_TRANSPARENCY_REQUIRED). We coded the threads using a general inductive approach [22]. After reviewing all the threads to
IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service | CONTEXT/links-only |  | forum | deciding quote cols located
  We found 17 RESIP services either through search engines decide where the domain name of the target to be resolved, by or from Blackhat SEO forums [31]. Among them, 5 (Table I) the RESIP or the gateway. This is important since the resolver were picked out based upon their claimed scale (> 100K can be observed by the
IEEE-SP/2019/stealthy-porn-understanding-real-world-adversarial-images-for-illicit-online-pro | IN/collected | collected | forum | deciding quote cols located
  More specifically, for Baidu Tieba, we gather images from top 63 most active "bars" (a forum on a certain topic). Considering the relatively short lifespan of porn images, our crawler is designed to iteratively visit the 150 latest posts at each "bar" without sleep.
IEEE-SP/2021/a-first-look-at-zoombombing | IN/collected | collected | imageboard | deciding quote cols located
  We developed a custom crawler following the same methodology of previous research on 4chan [5, 24], and collected all posts between January 1st, 2020, and July 24th, 2020.
IEEE-SP/2021/defensive-technology-use-by-political-activists-during-the-sudanese-revolution | CONTEXT/user-study |  | whatsapp, telegram | deciding quote cols located
  Our insights stem from in-depth interviews with 13 Sudanese activists.
IEEE-SP/2021/hacked-a-pedagogical-analysis-of-online-vulnerability-discovery-exercises | OUT/app-or-protocol |  |  | deciding quote cols located
  we performed a two-phase study: a qualitative review of popular online exercises and interviews with the organizers of these exercises
IEEE-SP/2021/sok-hate-harassment-and-the-changing-landscape-of-online-abuse | OUT/other |  |  | deciding quote cols located
  Our survey asked participants "Have you ever personally experienced any of the following online?" and then listed a fixed set of experiences that participants could select from.
IEEE-SP/2021/they-would-do-better-if-they-worked-together-the-case-of-interaction-problems-be | OUT/broadcast |  |  | deciding quote cols located
  we collected and analyzed both Complaints 3 Authors (N=152) the user reviews and support requests as of 07/16/2020. We Together 6. Group Issues to Interactions collected up to 125 of the most recent reviews and support requests for each PWM browser extension in Table V-C. Interactions 7. Evaluate Interaction
IEEE-SP/2022/deployment-of-source-address-validation-by-network-operators-a-randomized-contro | OUT/other |  |  | deciding quote cols located
  we test private messages to operators versus notifying national CERTs versus using geographically-organized Network Operator Group (NOG) mailing lists. Sending notifications to a public forum (NOG) has not before been tested in an experiment.
IEEE-SP/2022/exposed-infrastructures-discovery-attacks-and-remediation-of-insecure-ics-remote | OUT/attack |  |  | deciding quote NOT LOCATED as contiguous normalized span
  our honeypot was also disclosed at a hacker forum by two posts that were submitted by the same person. We have observed burst accesses to the honeypot after the posts
IEEE-SP/2022/four-attacks-and-a-proof-for-telegram | OUT/app-or-protocol |  |  | deciding quote cols located
  We provide an in-depth study of how Telegram uses symmetric cryptography inside MTProto for cloud chats.
IEEE-SP/2022/how-does-usable-security-not-end-up-in-software-products-results-from-a-qualitat | OUT/recruitment |  |  | deciding quote cols located
  a small number were recruited via online communities and platforms (n = 1 for Twitter, Reddit, and Slack each)
IEEE-SP/2022/sok-social-cybersecurity | OUT/mention |  |  | deciding quote cols located
  colleagues frequently share passwords for shared work resources like mailing lists and digital access to journals
IEEE-SP/2022/sok-the-dual-nature-of-technology-in-sexual-abuse | OUT/mention |  |  | deciding quote cols located
  R. Leitão, "Technology-facilitated intimate partner abuse: a qualitative analysis of data from online domestic abuse forums," Human-Computer Interaction, pp. 1-40, 2019.
IEEE-SP/2022/trollmagnifier-detecting-state-sponsored-troll-accounts-on-reddit | IN/reuse | reuse | reddit | deciding quote cols located
  As ground truth, we use data released by Reddit on troll accounts active between 2015 and 2018 [43]
IEEE-SP/2023/beyond-phish-toward-detecting-fraudulent-e-commerce-websites-at-scale | IN/collected | collected | reddit | deciding quote cols located
  we continuously crawled the /r/Scams subreddit
IEEE-SP/2023/blue-is-the-new-black-market-privacy-leaks-and-re-victimization-from-police-auct | OUT/other |  |  | deciding quote cols located
  Owner was a member of a Telegram group chat that offers paid tutorials for committing fraud.
IEEE-SP/2023/deepfake-text-detection-limitations-and-opportunities | IN/collected | collected | reddit | deciding quote cols located
  We then scraped 112,296 real comments in every forum thread that contained a bot comment.
IEEE-SP/2023/from-5g-sniffing-to-harvesting-leakages-of-privacy-preserving-messengers | OUT/app-or-protocol |  |  | deciding quote cols located
  We analyze privacy-focused messengers Signal and Telegram and identify privacy leaks that enable stealthy exposure of the presence of a user in a given location
IEEE-SP/2023/its-like-flossing-your-teeth-on-the-importance-and-challenges-of-reproducible-bu | CONTEXT/user-study |  | mailing-list | deciding quote NOT LOCATED as contiguous normalized span
  We recruited participants by emailing 100 members of the Reproducible Builds Project website's mailing list "rbgeneral".
IEEE-SP/2023/its-up-to-the-consumer-to-be-smart-understanding-the-security-and-privacy-attitu | IN/reuse | reuse | reddit | deciding quote cols located
  we conducted a qualitative content analysis of 4,957 Reddit comments in 180 security- and privacy-related discussion threads from /r/homeautomation, a major Reddit smart home forum
IEEE-SP/2023/practically-exploitable-cryptographic-vulnerabilities-in-matrix | OUT/app-or-protocol |  |  | deciding quote cols located
  end-to-end encryption is realised using a custom cryptographic protocol called Megolm which extends Olm to support group chat
IEEE-SP/2023/sok-decentralized-finance-defi-attacks | OUT/mention |  |  | deciding quote cols located
  search for auditing histories from the following three when nearly 600 million dollars are lost in a single month. sources: (i) public announcements on a protocol's website; Despite the fact that BSC is a relatively new blockchain, it (ii) a protocol's social media and blog post (e.g., Twitter and experienced 69 DeFi
IEEE-SP/2023/when-and-why-do-people-want-ad-targeting-explanations-evidence-from-a-four-week | OUT/mention |  |  | deciding quote cols located
  when seeing an ad from Reddit about hair loss treatment, P27 explained that Reddit inferred he was bald "because they have access to my subscriptions on Reddit"
IEEE-SP/2024/children-parents-and-misinformation-on-social-media | OUT/broadcast |  |  | deciding quote cols located
  Children revealed they ask Siri whether a social media video or post is true or not
IEEE-SP/2024/combing-for-credentials-active-pattern-extraction-from-smart-reply | IN/reuse | reuse | reddit | deciding quote cols located
  For our Smart Reply scenario, we train GPT-2 [41] and Bert2Bert [52] models on a training set (sampled from Reddit data set [21]) consisting of 100,000 message-response text pairs
IEEE-SP/2024/injection-attacks-against-end-to-end-encrypted-applications | OUT/app-or-protocol |  |  | deciding quote cols located
  Our experiments involved researcher accounts that were not used for other purposes and minimal load on Signal and WhatsApp services
IEEE-SP/2024/no-easy-way-out-the-effectiveness-of-deplatforming-an-extremist-forum-to-suppres | IN/collected | collected | forum, telegram | deciding quote cols located
  We have been scraping the two most active forums associated with online harassment for years due to their increasingly toxic content, as part of the
IEEE-SP/2024/the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking-vu | OUT/app-or-protocol |  |  | deciding quote cols located
  CSRF on PushManager subscriptions in Reddit
IEEE-SP/2024/understanding-parents-perceptions-and-practices-toward-childrens-security-and-pr | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  In July 2023, we advertised our study on VR-related Discord servers, sub-Reddits, LinkedIn, and Facebook groups. Prior to the advertisement, we obtained permission from all the channels' moderators, admins, or...
IEEE-SP/2025/analyzing-the-ios-local-network-permission-from-a-technical-and-user-perspective | IN/collected | collected | reddit, forum | deciding quote cols located
  We limited our search to the most commonly used platforms for tech-related problems: Reddit, StackOverflow, and X
IEEE-SP/2025/characterizing-the-usability-and-usefulness-of-u-s-ad-transparency-systems | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Our eight representative ATSs were from eBay ( EB), Facebook (FB), Google (G), Instagram (IG), LinkedIn (LI), Reddit (R), TikTok (TTK), and X ( X), formerly known as Twitter.
IEEE-SP/2025/exploring-parent-child-perceptions-on-safety-in-generative-ai-concerns-mitigatio | IN/collected | collected | reddit | deciding quote cols located
  We first collected 712 posts and 8,533 comments on April 9, 2024, using the Python Reddit API Wrapper (PRAW)
IEEE-SP/2025/gdpr-in-the-small-a-field-study-of-privacy-and-security-challenges-in-schools | OUT/mention |  |  | deciding quote cols located
  a WhatsApp voice message, instead, belongs to the family of digital data
IEEE-SP/2025/im-pretty-expert-and-i-still-screw-it-up-qualitative-insights-into-experiences-a | OUT/recruitment |  |  | deciding quote cols located
  posts on mailing lists of cryptographic libraries and the IETF cfrg mailing list [57]. Of these strategies, snowball sampling and posts to mailing lists were most successful, recruiting 14 of our 21 participants.
IEEE-SP/2025/learning-from-censored-experiences-social-media-discussions-around-censorship-ci | IN/collected | collected | telegram | deciding quote cols located
  we tracked posts in more than 80 Telegram channels to identify and evaluate desktop and mobile executables, IP configuration files, etc., if they had instances of malicious behaviors.
IEEE-SP/2025/on-the-effectiveness-of-prompt-stealing-attacks-on-in-the-wild-prompts | IN/reuse | reuse | reddit, discord, other | deciding quote cols located
  prompt dataset as described in [45]. This dataset comprises a comprehensive collection of 15,140 prompts, gathered from four distinct platforms, all contributed by real users. These platforms include Reddit [11] and Discord [6], as well as a variety of websites such as AIPRM [1], FlowGPT [7], and JailbreakChat [8].
IEEE-SP/2025/security-perceptions-of-users-in-stablecoins-advantages-and-risks-within-the-cry | IN/collected | collected | reddit | deciding quote cols located
  We examined the top five hundred subreddits on the Reddit platform, subsequently selecting subreddits tagged as "crypto"
IEEE-SP/2025/slap-data-speculation-attacks-via-load-address-prediction-on-apple-silicon | OUT/attack |  |  | deciding quote cols located
  we recover text from a comment on a post which belongs to a subreddit that the user subscribes to
IEEE-SP/2025/sok-a-privacy-framework-for-security-research-using-social-media-data | OUT/other |  |  | deciding quote cols located
  To ensure reliability in the filtering process, three researchers use Rayyan [57], a literature management platform, to collaboratively filter 6,657 papers.
IEEE-SP/2025/study-club-labor-union-or-start-up-characterizing-teams-and-collaboration-in-the | CONTEXT/user-study |  |  | deciding quote NOT LOCATED as contiguous normalized span
  To complement the quantitative perspectives, we conducted 18 semi-structured voice and text interviews... We recruited former and current members of different teams.
IEEE-SP/2025/understanding-users-security-and-privacy-concerns-and-attitudes-towards-conversa | IN/reuse | reuse | reddit | deciding quote cols located
  we gathered all posts from r/ChatGPT from its inception in December 2022 till July 2024, using publicly available Reddit dumps [62]
IEEE-SP/2025/warning-the-timeout-t-cannot-protect-you-from-losing-coins-pipeswap-forcing-the | OUT/mention |  |  | deciding quote cols located
  T. Nolan, "Alt chains and atomic transfers," Bitcoin Forum, 2013, https://bitcointalk.org/index.php?topic=193281.0.
IEEE-SP/2026/behind-the-curtain-how-shared-hosting-providers-respond-to-vulnerability-notific | IN/collected | collected | reddit | deciding quote cols located
  we identified companies by analyzing discussions on relevant Reddit communities (r/VPS, r/agency, r/webhosting, r/Hosting). Posts were selected if they discussed hosting
IEEE-SP/2026/promoguardian-detecting-promotion-abuse-fraud-with-multi-relation-fused-graph-ne | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  group identification (user group chat ID, which is sourced from the group chat in the MEITUAN's app, not external social media.)
IMC/2010/understanding-latent-interactions-in-online-social-networks | IN/collected | collected | other | deciding quote cols located
  As part of our PKU crawls, we gathered all comments generated by users in message board posts, diary entries, photos, and status updates.
IMC/2011/an-analysis-of-underground-forums | IN/leak | leak | forum | deciding quote NOT LOCATED as contiguous normalized span
  Each of these datasets has been acquired by unknown outside parties and made public (“leaked”) via various methods.
IMC/2011/detecting-validating-and-characterizing-computer-infections-in-the-wild | OUT/mention |  |  | deciding quote cols located
  This information originates from several diverse sources such as DNS-lists, website access logs, proxy logs, P2P tracker lists, forums, bulletins, banlists, IRC-lists, etc.
IMC/2014/the-matter-of-heartbleed | OUT/mention |  |  | deciding quote cols located
  both announcements were sent to the OpenSSL mailing list
IMC/2015/detecting-malicious-activity-with-dns-backscatter | OUT/homograph |  |  | deciding quote cols located
  We confirm mail originators by examining over 100 Japanese mailing lists operated by mail ASPs and companies themselves. We see about 300 IP addresses over about three months in 2014.
IMC/2015/leveraging-internet-background-radiation-for-opportunistic-network-analysis | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  A search for "'SRNT''ANNO''NANC'" returns a Chinese message board where students are trying to figure out how to bypass by monitoring software. The forum mentions StudentMain.exe, an executable associated with Classroom Management by Mythware.
IMC/2016/what-happens-after-you-are-pwnd-understanding-the-use-of-leaked-webmail-credenti | IN/collected | collected | forum | deciding quote cols located
  We logged the messages that we received on underground forums, mostly inquiring about obtaining the full dataset, but we did not follow up to them.
IMC/2017/ethical-issues-in-research-using-datasets-of-illicit-origin | OUT/other |  |  | deciding quote cols located
  We extract ethical principles from existing advice and guidance and analyse how they have been applied within more than 20 recent
IMC/2017/fifteen-minutes-of-unwanted-fame-detecting-and-characterizing-doxing | IN/collected | collected | imageboard | deciding quote cols located
  we collected all text files posted to pastebin.com, all postings to the "pol" and "b" forums of 4chan.org, and all postings to the "pol" and "baphomet" forums of 8ch.net during the seven week period of 12/19/2016 to 2/6/2017
IMC/2017/initial-measurements-of-the-cuban-street-network | IN/collected | collected | forum | deciding quote cols located
  As a lower bound on the size of SNET's user base, we consider the WifiNet forums, a general community messaging board hosted Link Destination Fraction of Sites by one of the pillars, which is thought to be one of the network's most popular sites. The forums have 56,000 registered users. At Any off-network site 81% the
IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  On forums seeking instructions for blocking Internet traffic by country (e.g., [47]), we see motivations that range from complying
IMC/2018/an-empirical-analysis-of-the-commercial-vpn-ecosystem | IN/collected | collected | reddit | deciding quote cols located
  In July 2017, we performed a complete crawl of the two main 'mega-threads' about VPN recommendations. In addition we performed a secondary crawl to extract VPN names from regular posts on the VPN subreddit within the past three months.
IMC/2018/how-to-catch-when-proxies-lie-verifying-the-physical-locations-of-network-proxie | OUT/recruitment |  |  | deciding quote cols located
  40 volunteers, recruited from a variety of mailing lists and online forums, and another 150 paid contributors, recruited via Mechanical Turk for 25¢ each, provided us with the approximate physical location of their computers
IMC/2018/on-the-origins-of-memes-by-means-of-fringe-web-communities | IN/mixed | mixed | imageboard, reddit, gab-parler-voat | deciding quote cols located
  We obtain all threads posted on /pol/, between July 1, 2016 and July 31, 2017, using the same methodology of [20].
IMC/2018/when-the-dike-breaks-dissecting-dns-defenses-during-ddos | OUT/mention |  |  | deciding quote cols located
  Reports describe intermittent failure of prominent websites including łTwitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud and The New York Timesž, each a direct or indirect customer of Dyn at the time. Our work helps explain these very different outcomes. The Root DNS saw few or no user-visible problems
IMC/2019/a-first-look-at-the-crypto-mining-malware-ecosystem-a-decade-of-unrestricted-wea | IN/reuse | reuse | forum | deciding quote cols located
  we have analyzed a dataset of posts collected from various underground forums [21]
IMC/2019/booting-the-booters-evaluating-the-effects-of-police-interventions-in-the-market | OUT/mention |  |  | deciding quote cols located
  The closure of HackForums' booter market reduced attacks for 13 weeks globally
IMC/2019/challenges-in-the-decentralised-web-the-mastodon-case | IN/collected | collected | fediverse | deciding quote cols located
  We wrote a multi-threaded crawler to connect with each of these 1.75K instances, via their API, and collected their entire history of toots.
IMC/2019/errors-misunderstandings-and-attacks-analyzing-the-crowdsourcing-process-of-ad-b | IN/collected | collected | forum | deciding quote cols located
  We built a crawler that collected all the available posts on the forum. In total, we have 23,240 topics with at least one report
IMC/2019/measuring-ewhoring | IN/reuse | reuse | forum | deciding quote cols located
  We use the CrimeBB dataset [27] which contains data scraped from 15 different underground forums, and is available from the Cambridge Cybercrime Centre
IMC/2019/profiling-bgp-serial-hijackers-capturing-persistent-misbehavior-in-the-global-ro | IN/collected | collected | mailing-list | deciding quote cols located
  we process 5 years worth of email threads on the NANOG [6] mailing list and extract 23 AS numbers
IMC/2020/demystifying-the-messaging-platforms-ecosystem-through-the-lens-of-twitter | IN/collected | collected | whatsapp, telegram, discord | deciding quote cols located
  we select a set of group URLs uniformly at random and join them using an account for each platform
IMC/2020/reading-in-between-the-lines-an-analysis-of-dissenter | IN/collected | collected | gab-parler-voat | deciding quote cols located
  we crawled Dissenter for URLs that users comment on, the comments they made about those pages, as well as replies to other users' comments
IMC/2020/turning-up-the-dial-the-evolution-of-a-cybercrime-market-through-set-up-stable-a | IN/collected | collected | forum | deciding quote cols located
  We analyse the first dataset, of which we are aware, about the transactions created and completed on a well-known and high-traffic underground marketplace, Hack Forums, along with the associated threads and posts made by its users over two recent years
IMC/2021/a-large-scale-characterization-of-online-incitements-to-harassment-across-platfo | IN/reuse | reuse | imageboard, discord, telegram, forum | deciding quote cols located
  A third-party threat intelligence company collected and provided to us the data sets that we analyzed for this study.
IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n | OUT/homograph |  |  | deciding quote cols located
  we selected a group of popular mainstream and alternative news websites and scraped ads from these sites using crawlers in different locations
IMC/2021/racketstore-measurements-of-aso-deception-in-google-play-via-mobile-and-app-usag | OUT/recruitment |  |  | deciding quote cols located
  We recruited ASO workers from Facebook groups that we found to be dedicated to product promotion
IMC/2022/a-browser-side-view-of-starlink-connectivity | OUT/recruitment |  |  | deciding quote cols located
  The ads were restricted to the USA, EU and Australia, geographies where there were known Starlink users (based on self-reports of users in online discussion forums such as the r/Starlink subreddit and various Facebook groups).
IMC/2022/exploring-the-security-and-privacy-risks-of-chatbots-in-messaging-services | CONTEXT/own-community |  | discord | deciding quote cols located
  For the honeypot environment to appear active and in use, we provide a feed of frequent exchange of messages from multiple (automated) users.
IMC/2023/flocking-to-mastodon-tracking-the-great-twitter-migration | OUT/broadcast |  |  | deciding quote cols located
  We use Twitter's Search API and Mastodon's Account's Statuses Endpoint.3
IMC/2023/rovista-measuring-and-analyzing-the-route-origin-validation-rov-in-rpki | IN/collected | collected | mailing-list, discord | deciding quote cols located
  we utilize the archive of the nanog mailing list and engage with network operators on the RPKI community discord channel [64].
IMC/2023/the-cloud-strikes-back-investigating-the-decentralization-of-ipfs | OUT/other |  |  | deciding quote cols located
  We analyze the topology, the traffic, the content providers and the entry points from the classical Internet.
IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s | OUT/homograph |  |  | deciding quote cols located
  the email community currently lacks a comprehensive understanding of how and why email bounces in the wild.
IMC/2024/poster-twinkle-twinkle-streaming-star-illuminating-cdn-performance-over-starlink | OUT/recruitment |  |  | deciding quote cols located
  Through advertisement campaigns over Reddit and mailing lists, we the end-user experience. https://blog.cloudflare.com/aim-database-for-internetrecruit 21 Starlink users from North America, Europe, Africa and quality/. [2] Allison et al. 2018. 403 Forbidden: A Global View of CDN Geoblocking (IMC '18). Oceania and 35
IMC/2024/whatcha-lookin-at-investigating-third-party-web-content-in-popular-android-apps | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We observed that Snapchat, Twitter, and Reddit did not inject any JS (via evaluateJavascript) or JS Bridge (via addJavascriptInterface) into the WebView.
IMC/2025/exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts | IN/collected | collected | forum | deciding quote cols located
  We analyzed accounts sold on underground markets accessed via the Tor network. Initially, Mario Beluri et al. Table 2: Overview of the social media data collection. In the table, we display social media accounts advertised for sale. The accounts that are listed referencing the social media platform account profile we
IMC/2025/fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by | IN/collected | collected | reddit | deciding quote NOT LOCATED as contiguous normalized span
  we use the Reddit API between January 1, 2017, and September 30, 2023, to search for the exact four identified keywords we use with Twitter. In total, we collect 1,707 image attachments from 1,771 unique submissions that users post on Reddit over 911 subreddits.
IMC/2025/roam-without-a-home-unraveling-the-airalo-ecosystem | OUT/other |  |  | deciding quote cols located
  Specifically, we analyze Airalo, a thick MNA operating in 219 countries.
IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e | IN/collected | collected | telegram | deciding quote cols located
  we joined several related Telegram groups [14, 21, 32, 37, 56], communicated with operators, acquired wallet drainers, and summarized the profit-sharing process
NDSS/2012/guess-who-s-texting-you-evaluating-the-security-of-smartphone-messaging-applicat | OUT/app-or-protocol |  |  | deciding quote cols located
  In this section we present the results of our security eval- WhatsApp server. To exploit this vulnerability, it is possiuation of the application discussed in Section 3 with respect ble set up a SSL proxy and install the proxy's certificates as to the different attacks outlined in section 4. described in Section 4 on
NDSS/2013/behind-the-scenes-of-online-attacks-an-analysis-of-exploitation-behaviors-on-the | CONTEXT/own-community |  | forum | deciding quote NOT LOCATED as contiguous normalized span
  We solved this problem by modifying the source code of the blog and forum applications (namely, Wordpress and Simple Machines Forum) ... A total of 68,201 unique messages were posted on the forum during our study, by 15,753 users using 3,144 unique IP addresses.
NDSS/2013/intention-and-origination-an-inside-look-at-large-scale-bot-queries | OUT/mention |  |  | deciding quote cols located
  category contain keywords that are known to be related to this section. vulnerabilities such as "php", "yabb", "powered", "topic", "forum", "thread", "board", and "vbulletin" [20]. In partic- 4.1 Query Intention Analysis ular, both "powered" and "php" are popular words with a large number of subtrees under each of
NDSS/2013/neighborwatcher-a-content-agnostic-comment-spam-inference-system | OUT/attack |  |  | deciding quote cols located
  To collect spam harbors, we started from 10,000 verified spam links Sstudy (which are collected from our previous work [27]) and collected a dataset containing 38,913 real-world spam harbors, which are represented with unique domain names. Specifically, we searched all these spam links in Google and collected the
NDSS/2013/social-turing-tests-crowdsourcing-sybil-detection | OUT/broadcast |  |  | deciding quote cols located
  Our experimental datasets are collected from two large OSNs: Facebook and Renren. Facebook is the most popular OSN in the world and has more than 1 billion users [8]. Renren is the largest OSN in China, with more than 220 Unknown Suspicious Dataset Facebook Profiles Profiles Google Image Search Friends of Suspicious
NDSS/2014/dspin-detecting-automatically-spun-content-on-the-web | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  To select a service, we browsed underground SEO forums such as BlackHatWorld.com and selected The Best Spinner (TBS).
NDSS/2014/on-the-mismanagement-and-maliciousness-of-networks | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  a large number of best practices for specific services and for organizationally managing security, including ISO 17799, the Information Security Forum, and Network Protection Practices
NDSS/2015/mind-your-blocks-on-the-stealthiness-of-malicious-bgp-hijacks | IN/collected | collected | mailing-list | deciding quote NOT LOCATED as contiguous normalized span
  We check our candidate hijack cases against reported routing incidents in the archives of these two mailing lists
NDSS/2019/cybercriminal-minds-an-investigative-study-of-cryptocurrency-abuses-in-the-dark-web | IN/collected | collected | forum | deciding quote cols located
  The Community category represents Internet forums, where anyone can access and share diverse information.
NDSS/2020/into-the-deep-web-understanding-e-commerce-fraud-from-autonomous-chat-with-cybercriminals | IN/collected | collected | other-messenger, forum | deciding quote cols located
  We ran Aubrey to chat with miscreants identified from 150 underground IM groups we infiltrated.
NDSS/2020/practical-traffic-analysis-attacks-on-secure-messaging-applications | IN/collected | collected | telegram | deciding quote cols located
  we join over 1,000 public Telegram channels and record their communications, based on which we derive a statistical model for IM traffic features
NDSS/2020/withdrawing-the-bgp-re-routing-curtain-understanding-the-security-impact-of-bgp-poisoning-through-real-world-measurements | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we announced to the RIPE and NANOG mailing lists prior to experiments the details of the study, allowing operators the ability to opt out. Over the course of our experiments Finally, we monitor our BGP advertisements propagation we monitored our own emails and the mailing lists. In total, 4 emails were received.
NDSS/2021/all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers | OUT/app-or-protocol |  |  | deciding quote cols located
  We perform random lookups for mobile phone numbers app has customizable settings for the profile picture, About text, in the US and collect statistics about the number of regand Last Seen information. The default for all these settings istered users, as well as the information exposed by them. is Everybody, with the
NDSS/2021/deceptive-deletions-for-protecting-withdrawn-posts-on-social-media-platforms | OUT/broadcast |  |  | deciding quote cols located
  We collected 1% of daily random tweet samples from the Twitter API from Oct 2015 - May 2018.
NDSS/2021/privacyflash-pro-automating-privacy-policy-generation-for-mobile-apps | IN/collected | collected | reddit | deciding quote cols located
  Additional comments were provided on Reddit's r/iOSProgramming [57] where we solicited participants for our study. Neither comment was prompted for.
NDSS/2022/auto-draft-262 | OUT/app-or-protocol |  |  | deciding quote cols located
  We studied 12 popular TACT systems, following the key steps of a third-party app's life cycle
NDSS/2023/folk-models-of-misinformation-on-social-media | CONTEXT/user-study |  | reddit, imageboard, gab-parler-voat | deciding quote cols located
  Our study was approved by the Institutional Review Board (IRB) of our institution before we fielded a survey protocol with semi-structured, open-ended questions
NDSS/2023/hope-of-delivery-extracting-user-locations-from-mobile-instant-messengers | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we conduct a series of experiments in Signal, Threema, and WhatsApp to evaluate and demonstrate to what extent we can classify different message receivers and their respective locations based on delivery notifica[tion timing]
NDSS/2023/synthdb-synthesizing-database-via-program-analysis-for-security-testing-of-web-applications | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  For the online forum category, we select two applications, phpBB [46] and SMF [51], as they have almost the same number of i[nstallations]
NDSS/2023/tactics-threats-targets-modeling-disinformation-and-its-mitigation | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Pan (P16), who studies communities on Facebook and Telegram, explains how actors aimed
NDSS/2024/like-comment-get-scammed-characterizing-comment-scams-on-media-platforms | OUT/broadcast |  |  | deciding quote cols located
  We collect a total of 50 conversations with scammers through WhatsApp and Telegram. By pretending to be unaware victims, we let scammers progress through their scams while recording the conversations. Our study uncovered two major scam activities from the collected conversations: cryptocurrency investment scams and
NDSS/2024/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model | IN/collected | collected | forum, reddit | deciding quote cols located
  We discovered seven forums where abusive dropshipping discussion occurs. We crawled these forums and collected 3,651 relevant discussion threads.
NDSS/2024/understanding-and-analyzing-appraisal-systems-in-the-underground-marketplaces | IN/mixed | mixed | forum | deciding quote cols located
  Our study collected traces (including the initial post and the following replies of a thread [89]) from eight underground marketplaces and forums (Hack Forums [9], Blackhat World [2], V3rmillion [24], MPGH [11], Nulled [12], OGUsers, Evolution, and Raid) from 2006 to 2023 to identify appraisers and appraisal reviews.
NDSS/2025/exploring-user-perceptions-of-security-auditing-in-the-web3-ecosystem | IN/collected | collected | reddit | deciding quote cols located
  we conducted 20 semi-structured interviews with Web3 users and analyzed 905 Reddit posts to supplement and cross-validate the interview findings
NDSS/2025/towards-understanding-unsafe-video-generation | IN/reuse | reuse | imageboard | deciding quote cols located
  4chan is an anonymous platform where people post unsafe content, including sexual, violent, hateful, etc.
NDSS/2025/understanding-miniapp-malware-identification-dissection-and-characterization | OUT/app-or-protocol |  |  | deciding quote cols located
  the miniapps can be and are encouraged to be shared among users' social networks, including friends, group chats, and users' personal timelines
NDSS/2026/chasing-shadows-pitfalls-in-llm-security-research | OUT/mention |  |  | deciding quote cols located
  This risk is particularly high in LLMs, where many datasets overlap with pre-training sources like GitHub, Wikipedia, and Reddit [23], [24].
NDSS/2026/connecting-the-dots-an-investigative-study-on-linking-private-user-data-across-messaging-apps | OUT/app-or-protocol |  |  | deciding quote cols located
  demonstrating concrete attacks exploiting their contact discovery, SSO-based account linking, and nearby user search features to compromise user privacy.
NDSS/2026/from-perception-to-protection-a-developer-centered-study-of-security-and-privacy-threats-in-extended-reality-xr | OUT/mention |  |  | deciding quote cols located
  We need dedicated developer-focused forums, similar to Reddit, to gather feedback from experienced developers.
NDSS/2026/hey-there-you-are-using-whatsapp-enumerating-three-billion-accounts-for-security-and-privacy | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We enumerated the complete space for the other countries as proposed by libphonenumber.
NDSS/2026/loki-proactively-discovering-online-scams-by-mining-toxic-search-queries | OUT/other |  |  | deciding quote cols located
  The dataset is constructed by leveraging user-submitted reports from the popular subreddit /r/scams, which are subsequently verified by security experts who manually inspect and label live websites as scams.
NDSS/2026/mapping-the-cloud-a-mixed-methods-study-of-cloud-security-and-privacy-configuration-challenges | IN/reuse | reuse | forum | deciding quote cols located
  we collected approximately 251,900 cloud-related security and privacy posts from Stack Overflow, spanning from August 2008 to March 2024.
NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles | OUT/homograph |  |  | deciding quote cols located
  The National Arbitration FORUM (FORUM), headquartered in the United States
NDSS/2026/sok-cryptographic-authenticated-dictionaries | OUT/app-or-protocol |  |  | deciding quote cols located
  WhatsApp's key transparency based on Parakeet [107], [101] uses an append-only auditable key directory
PETS/2016/blogs-twitter-feeds-and-reddit-comments-cross-domain-authorship-attribution | IN/collected | collected | reddit | deciding quote NOT LOCATED as contiguous normalized span
  The usernames were collected from users of the subreddit/r/twitter
PETS/2016/listening-to-whispers-of-ripple-linking-wallets-and-deanonymizing-transactions-i | OUT/mention |  |  | deciding quote cols located
  For example, users in XRPTalk forum have tracked down a payment carried out by the Fidor bank using Ripple in a few days [20].
PETS/2016/on-the-in-effectiveness-of-mosaicing-and-blurring-as-tools-for-document-redactio | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  by members of at-risk communities (e.g., Reddit's /r/CreepyPMs) could render those users vulnerable to
PETS/2018/i-never-signed-up-for-this-privacy-implications-of-email-tracking | OUT/homograph |  |  | deciding quote cols located
  Building on the OpenWPM web crawler [17], we created a tool to automatically search for mailing list subscription forms on websites and fill them in. It is challenging to scale such a tool due to numerous idiosyncrasies of websites (Section 3). Our crawler visited 15,700 sites and attempted to sign up for emails on each of these.
PETS/2019/git-blame-who-stylistic-authorship-attribution-of-small-incomplete-source-code-f | OUT/mention |  |  | deciding quote cols located
  This work links authorship between blogs, tweets, and Reddit comments.
PETS/2019/lethe-conceal-content-deletion-from-persistent-observers | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  ReSavr [10] and Uneddit [15] for Reddit, StackPrinter-Deleted [11] for Stack overflow, and YouTomb [42] for Youtube are some of the prominent examples.
PETS/2020/emotional-and-practical-considerations-towards-the-adoption-and-abandonment-of-v | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we posted recruitment posts on a number of Reddit sub-communities about VPN: r/VPN, r/VPNTorrents and r/Privacy.
PETS/2020/explaining-the-technology-use-behavior-of-privacy-enhancing-technologies-the-cas | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  For Tor, we distributed the links to the English and German version over multiple channels on the internet.
PETS/2020/in-depth-evaluation-of-redirect-tracking-and-link-usage | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  discord.gg b 225 207 0 0 100 0 0 100 0 0 0
PETS/2021/i-would-have-to-evaluate-their-objections-privacy-tensions-between-smart-home-de | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We recruited participants through local online forums (Craigslist, Reddit, Nextdoor).
PETS/2022/charting-app-developers-journey-through-privacy-regulation-features-in-ad-networ | OUT/mention |  |  | deciding quote cols located
  Future research may find ways to promote privacy regulations within the developer communities (e.g., Stack Overflow, Reddit, and conferences)
PETS/2022/ctrl-shift-how-privacy-sentiment-changed-from-2019-to-2021 | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  data from users' posts, online activities, and profile characteristics on platforms like Twitter, Facebook, and Reddit to predict mental health issues in users
PETS/2022/increasing-adoption-of-tor-browser-using-informational-and-planning-nudges | OUT/mention |  |  | deciding quote cols located
  REDDIT Using Reddit.
PETS/2022/it-feels-like-whack-a-mole-user-experiences-of-data-removal-from-people-search-w | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We started by posting on Reddit subreddits related to privacy. We also advertised on relevant other subreddits that included previous conversations about data removal.
PETS/2022/towards-improving-code-stylometry-analysis-in-underground-forums | IN/reuse | reuse | forum | deciding quote cols located
  we also use data from the CrimeBB dataset, which contains data scraped from various underground forums
PETS/2022/understanding-privacy-related-advice-on-stack-overflow | IN/collected | collected | forum | deciding quote cols located
  We collected 170 privacy-related posts on Stack Overflow created between April 2016 to April 2021 using Stack Exchange's API
PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations | IN/reuse | reuse | reddit | deciding quote NOT LOCATED as contiguous normalized span
  For each user submission, we first extract the username and all YouTube links posted by this Reddit account.
PETS/2023/detect-your-fingerprint-in-your-photographs-photography-based-multi-feature-sybi | OUT/other |  |  | deciding quote cols located
  We use the public archive of darknet market datasets [51] to analyze the linkability of multiple accounts of the vendors.
PETS/2023/istelan-disclosing-sensitive-user-information-by-mobile-magnetometer-from-finger | OUT/other |  |  | deciding quote cols located
  These apps are similar in their functionality and design to the popular apps found on the Apple store, i.e., 2048 Puzzle game, Chrome browser, Spotify, Whatsapp, Google Maps, Classic Arcade game, and Amazon shopping.
PETS/2023/on-the-role-and-form-of-personal-information-disclosure-in-cyberbullying-inciden | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Online forums or chat rooms 18 (3.1%) 0 (0.0%) 15 (7.9%) 0 (0.0%) 12 (8.2%) 1 (0.9%)
PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part | OUT/mention |  |  | deciding quote cols located
  Online discussion forums (e. g., Reddit, StackOverflow)
PETS/2023/senrev-measurement-of-personal-information-disclosure-in-online-health-communiti | IN/collected | collected | forum | deciding quote cols located
  Datasets. To answer our research questions, we constructed a dataset by collecting publicly available posts and comments from OHCs.
PETS/2023/speculative-privacy-concerns-about-ar-glasses-data-collection | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We recruited participants with varied prior AR experiences through posts to Reddit forums and an email listserv related to new media (e.g., AR), seeking permission from forum moderators to post our recruitment text.
PETS/2024/privacy-policies-on-the-fediverse-a-case-study-of-mastodon-instances | CONTEXT/user-study |  | fediverse | deciding quote cols located
  We did not collect any non-administrator user data for this project.
PETS/2024/those-things-are-written-by-lawyers-and-programmers-are-reading-that-mapping-the | OUT/mention |  |  | deciding quote cols located
  Further challenges were identified by analyzing general compliance to the legislation of apps [7, 70] and monitoring conversations on privacy in online developer forums [63, 84].
PETS/2025/can-social-media-privacy-and-safety-features-protect-targets-of-interpersonal-at | OUT/app-or-protocol |  |  | deciding quote cols located
  Through active information gathering [31, 36], we identified 100 different privacy- and safety-related features, which can be grouped into eight categories
PETS/2025/evaluating-a-data-fiduciary-standard-for-privacy-developer-and-end-user-perspect | OUT/recruitment |  |  | deciding quote cols located
  To recruit participants, we made posts on subreddits relevant to app development-r/AppDevelopers, r/mAndroidDev, and r/iosdev-with information about the study and a link to a screening survey.
PETS/2025/if-you-want-to-encrypt-it-really-really-hardcore-user-perceptions-of-key-transpa | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  as well as through university mailing lists and flyers ... posted to several university-related Facebook and WhatsApp groups
PETS/2025/more-and-scammier-ads-the-perils-of-youtubes-ad-privacy-settings | OUT/mention |  |  | deciding quote cols located
  Raters were instructed to visit the advertiser's website and perform a Google search for consumer reviews on sites such as Better Business Bureau, Reddit, or Trustpilot.
PETS/2025/real-world-deniability-in-messaging | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We analyze 140 Swiss court cases that use WhatsApp chats as evidence and find no case that considers deniability.
PETS/2025/the-impact-of-default-mobile-sdk-usage-on-privacy-and-data-protection | OUT/mention |  |  | deciding quote cols located
  We had to investigate the Amplitude support forum discussions to understand this difference.
PETS/2025/understanding-regional-filter-lists-efficacy-and-impact | OUT/other |  |  | deciding quote cols located
  Regarding the size of the individual community, we see the largest community in Scandinavia (62 people with 16,323 commits) and the smallest in Bulgarian (two authors with 146 commits).
PETS/2025/understanding-user-privacy-perceptions-in-video-conferencing-insights-from-a-fea | OUT/mention |  |  | deciding quote cols located
  as exemplified by several controversial online discussions on the privacy concerns of these specific features; see the Reddit threads on the pinning feature
PETS/2025/what-are-they-gonna-do-with-my-data-privacy-expectations-concerns-and-behaviors | CONTEXT/user-study |  | reddit, facebook-group, discord, other | deciding quote cols located
  We conducted semi-structured interviews with the participants to qualitatively elicit their privacy expectations, concerns, and behaviors
PETS/2025/what-wechat-knows-pervasive-first-party-tracking-in-a-billion-user-super-app-eco | OUT/app-or-protocol |  |  | deciding quote cols located
  This work studies the analytics and first-party tracking ecosystem of WeChat Mini Programs.
PETS/2026/bot-among-us-exploring-user-awareness-and-privacy-concerns-about-chatbots-in-gro | CONTEXT/user-study |  | whatsapp, discord, telegram, other-messenger | deciding quote cols located
  we conducted an online survey (N=374) across five popular messaging platforms-WhatsApp, Discord, Telegram, Viber, and LINE-to evaluate user awareness, understanding of chatbot access, privacy concerns, and behavioral responses.
PETS/2026/cryptographically-secured-domain-validation | OUT/homograph |  |  | deciding quote cols located
  we led a successful standardization effort for mandatory use of secure DNS by CAs at the CA/Browser Forum.
PETS/2026/lendlocked-privacy-transparency-for-digital-library-lending | OUT/mention |  |  | deciding quote cols located
  a domain with pressing needs thus far underexplored by our research community
PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri | IN/collected | collected | reddit | deciding quote cols located
  identified seven core subreddits: r/military, r/army, r/USMC, r/navy, r/airforce, r/spaceforce, and r/uscg. We leveraged the PRAW API
PETS/2026/precarious-but-active-a-look-at-privacy-behaviors-in-chinese-transformative-fand | CONTEXT/user-study |  | forum, other-messenger, other | deciding quote cols located
  we interviewed 10 overseas members of Chinese transformative fandom about their experiences with privacy and censorship, and we supplemented this with 153 social media comments from Weibo and Xiaohongshu (RedNote) on the same topic
PETS/2026/privacy-bias-in-language-models-a-contextual-integrity-based-auditing-metric | OUT/mention |  |  | deciding quote cols located
  We conjecture that the source of privacy bias stems from the LLMs' training datasets (e.g., news articles, blog posts, arXiv, PubMed), and public forums (e.g., Reddit, Stack-Overflow), scraped from the Internet.
PETS/2026/privacy-by-voice-designing-usable-privacy-notices-for-the-voice-interface | OUT/recruitment |  |  | deciding quote cols located
  we advertised our study on voice assistant-specific subreddits (e.g., r/VoiceAssistants, r/alexa, r/Alexa_ Skills, r/AlexaDevs, r/amazonalexa, r/googlehome), LinkedIn groups (e.g., Amazon Alexa, Google Home Professional Group), and Discord servers
PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms | OUT/other |  |  | deciding quote cols located
  we focus on a 10-site subset from our RealHuman corpus, including Amazon, Britannica, CNN, Fandom, Fox News, NFL, Pinterest, Reddit, TikTok, YouTube.
PETS/2026/reportor-facilitating-user-reporting-of-issues-encountered-in-naturalistic-web-b | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  one or more burdensome external tools, such as GitLab, Tor support forum, Tor mailing list, Internet Relay Chat (IRC), Signal, Telegram, etc.
PETS/2026/sanitization-or-deception-rethinking-privacy-protection-in-large-language-models | OUT/other |  |  | deciding quote cols located
  Our evaluation uses a synthetic Reddit dataset from [39], which was carefully curated to resemble real Reddit conversations. Although this dataset captures key linguistic patterns from actual user discussions, it is still synthetic.
PETS/2026/the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas | IN/collected | collected | reddit | deciding quote cols located
  We collected posts related to privacy and software development from the r/gdpr and r/europrivacy subreddits using the Python Reddit API Wrapper [5] in April 2025.
PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks | OUT/app-or-protocol |  |  | deciding quote cols located
  Given the instruction "Disable the option to autoplay reddit videos in my account.", the agent unchecks the relevant checkbox, but does not scroll down and save the changes.
USENIX/2010/re-captchas-understanding-captcha-solving-services-in-an-economic-context | IN/collected | collected | forum | deciding quote cols located
  our informal survey of several freelancer forums
USENIX/2010/scantegrity-ii-municipal-election-at-takoma-park-the-first-e2e-binding-governmen | OUT/homograph |  |  | deciding quote cols located
  This workshop was held at the Takoma Park Community Center
USENIX/2010/searching-the-searchers-with-searchaudit | OUT/attack |  |  | deciding quote cols located
  SearchAudit identifies a large number of queries belonging to a different type of attack-forum spamming.
USENIX/2010/toward-automated-detection-of-logic-vulnerabilities-in-web-applications | OUT/app-or-protocol |  |  | deciding quote cols located
  Easy JSP Forum application, a community forum written in JSP. Using Waler, we found that any authenticated user can edit or delete any post in a forum.
USENIX/2011/measuring-and-analyzing-search-redirection-attacks-in-the-illicit-online-prescri | OUT/attack |  |  | deciding quote cols located
  blog and forum spam captures the frequent occurrence where websites that allow user-generated content are abused by users posting drug advertisements
USENIX/2011/show-me-the-money-characterizing-spam-advertised-revenue | IN/collected | collected | forum | deciding quote cols located
  we were able to capture several pur-Note that this data contains an innate time bias since chase order numbers via forum scraping. This opportuthe date of complaint inevitably came a while later than nity arose because affiliate programs typically sponsor the time of purchase (unlike our own purchases). For this
USENIX/2012/enemy-of-the-state-a-state-aware-black-box-web-vulnerability-scanner | OUT/app-or-protocol |  |  | deciding quote cols located
  PhpBB v2 is an open-source forum software. It allows B Scanner Configuration registered users to perform many actions such as create new threads, comment on threads, and message other The following describes the exact settings that were used users. Version 2 is notorious for the amount of security to run each of the
USENIX/2012/pharmaleaks-understanding-the-business-of-online-pharmaceutical-affiliate-progra | OUT/other |  |  | deciding quote cols located
  We also relied on instant message chat logs of the operators of GlavMed and SpamIt to aid our understanding and validate our hypotheses about the meaning and use of various tables. However, the GlavMed and SpamIt databases are fundamentally operational in nature, and not naturally designed for the kind of broad
USENIX/2014/password-managers-attacks-and-defenses | OUT/mention |  |  | deciding quote cols located
  if any page on the victim site supports a public discussion forum, an attacker can cause the secure filling mechanism to submit the password to the forum page and have the password posted publicly
USENIX/2014/targeted-threat-index-characterizing-and-quantifying-politically-motivated-targe | OUT/mention |  |  | deciding quote cols located
  the e-mail text appears to repurpose legitimate e-mail messages that may have been collected from public mailing lists or from compromised accounts
USENIX/2015/in-the-compression-hornet-s-nest-a-security-study-of-data-compression-in-network | OUT/homograph |  |  | deciding quote cols located
  various members of the standardization and software development groups for fruitful discussions
USENIX/2015/vulnerability-disclosure-in-the-age-of-social-media-exploiting-twitter-for-predi | OUT/broadcast |  |  | deciding quote cols located
  Specifically, we analyze the Twitter stream, which exemplifies the information available from social media feeds. On Twitter, a community of hackers, security vendors and system administrators discuss security vulnerabilities.
USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa | IN/collected | collected | forum | deciding quote cols located
  We tracked these conversations on blackhatworld.com and pay-per-install.com, enumerating over 50 commercial PPI affiliate programs that exclusively deal with Windows installs.
USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  The infrastructure built upon wildcard DNS domains is called spider pool in China ("蛜蛛池" in Kanji) and has been broadly discussed in underground forums.
USENIX/2016/youve-got-vulnerability-exploring-effective-vulnerability-notifications | OUT/homograph |  |  | deciding quote cols located
  the security community to more deeply investigate ways to improve the effectiveness of vulnerability notifications.
USENIX/2017/understanding-the-mirai-botnet | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Another significant event in this timeline is the public release of Mirai's source code on hackforums.net
USENIX/2018/how-do-tor-users-interact-with-onion-services | CONTEXT/user-study |  | reddit | deciding quote cols located
  we advertised our survey in a blog post on The Tor Project's blog [37], on its corresponding Twitter account, the CITP blog at Princeton, and on three Reddit subforums.
USENIX/2018/plug-and-prey-measuring-the-commoditization-of-cybercrime-via-online-anonymous-m | CONTEXT/declined |  | forum | deciding quote cols located
  Since we did not study these forms of trade, our picture of commoditization is incomplete. To some extent, the same holds for underground hacker forums, though we would argue that many of the transactions on those forums are not actually commoditized, but forms of contracting
USENIX/2018/reading-thieves-cant-automatically-identifying-and-understanding-dark-jargons-fr | IN/mixed | mixed | forum, reddit | deciding quote cols located
  we parsed the underground forum snapshots collected by the darknet marketplace archives programs and other research projects
USENIX/2018/return-of-bleichenbacher-s-oracle-threat-robot | OUT/mention |  |  | deciding quote cols located
  erlang-questions mailing list, Nov. 2017
USENIX/2018/schrodinger-s-rat-profiling-the-stakeholders-in-the-remote-access-trojan-ecosyst | OUT/mention |  |  | deciding quote cols located
  This address space belongs to Relakks VPN [42], a Swedish company 1058 27th USENIX Security Symposium that provides free VPN services and is likewise recommended by RAT instruction videos [50] and HackForums members. VPS providers. In addition to using VPN's, we found the use of VPS instances from prominent services
USENIX/2018/understanding-the-reproducibility-of-crowd-reported-security-vulnerabilities | OUT/other |  |  | deciding quote cols located
  individual vulnerability reports from popular security forums have an extremely low success rate of reproduction (4.5% - 43.8%) caused by missing information.
USENIX/2019/detecting-and-characterizing-lateral-phishing-at-scale | OUT/other |  |  | deciding quote cols located
  employee accounts from 33 organizations. 1,694 of 1 The number of mailboxes is an upper bound on the number of employees these emails were reported by users, with the remainder found due to the use of mailing lists and aliases. 1276 28th USENIX Security Symposium solely by our detector (§ 4); our detector also finds
USENIX/2019/protecting-accounts-from-credential-stuffing-with-password-breach-alerting | OUT/mention |  |  | deciding quote cols located
  like Antipublic (450 million credentials), Exploit.in steal usernames and passwords from our service) and an ad- (600 million credentials), and Collection 1-5 (2.2 billion cre- versarial server (e.g., an attacker harvesting usernames and dentials) have steadily grown as their creators aggregated passwords sent to the
USENIX/2019/the-anatomy-of-a-cryptocurrency-pump-and-dump-scheme | IN/collected | collected | telegram | deciding quote cols located
  we trace the message history of over 300 Telegram channels from June 17, 2018 to February 26, 2019, and identify 412 pump events orchestrated through those channels
USENIX/2019/towards-the-detection-of-inconsistencies-in-public-security-vulnerability-report | IN/collected | collected | mailing-list | deciding quote cols located
  SecurityFocus Forum (also called Bugtraq Mailing List) mainly contains "unstructured" articles and discussion threads between vulnerability reporters and software developers
USENIX/2019/understanding-ios-based-crowdturfing-through-hidden-ui-analysis | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Actually, from the underground forum, we find that some intermediaries seek experienced developers to build apps capable of infiltrating the Apple store, by hiding their crowdturfing UIs
USENIX/2020/an-observational-investigation-of-reverse-engineers-processes | OUT/recruitment |  |  | deciding quote cols located
  We posted recruitment notices on a number of RE forums, including forums for popular RE tools such as IDAPro and BinaryNinja. We also posted ads on online communities like Reddit.
USENIX/2020/composition-kills-a-case-study-of-email-sender-authentication | OUT/other |  |  | deciding quote cols located
  We conducted a preliminary assessment of this problem by collecting emails from wikileaks.org, IETF mailing lists, and our personal emails. We find that many sites are not aware of this attack. Among the 10 email providers we tested, Zoho.com includes the vulnerable "l=" tag for its outgoing messages. Popular sites
USENIX/2020/i-have-too-much-respect-for-my-elders-understanding-south-african-mobile-users-p | CONTEXT/user-study |  | whatsapp, facebook-group | deciding quote cols located
  P18 said that he stopped using Facebook after old pictures that he had posted on Facebook were 'stolen' and then shared in a WhatsApp group to 'mock' him.
USENIX/2020/the-tools-and-tactics-used-in-intimate-partner-surveillance-an-analysis-of-onlin | IN/mixed | mixed | forum, reddit | deciding quote cols located
  We collected data from Forums A, B, D and E via custom crawlers built using Scrapy, an open-source, Python-based framework for web scraping.
USENIX/2021/catching-phishers-by-their-bait-investigating-the-dutch-phishing-landscape-throu | IN/collected | collected | telegram | deciding quote NOT LOCATED as contiguous normalized span
  First, we collect phishing kits on public Telegram channels employing a so-called 'snowball sampling' approach.
USENIX/2021/collective-information-security-in-large-scale-urban-protests-the-case-of-hong-k | CONTEXT/user-study |  | telegram, whatsapp, forum | deciding quote NOT LOCATED as contiguous normalized span
  We conducted indepth, semi-structured interviews with 11 participants of these protests.
USENIX/2021/extracting-training-data-from-large-language-models | OUT/app-or-protocol |  |  | deciding quote cols located
  The authors collected a dataset by following outbound links from the social media website Reddit. The webpages were cleaned of HTML, with only the document text retained, and then de-duplicated at the document level.
USENIX/2021/having-your-cake-and-eating-it-an-analysis-of-concession-abuse-as-a-service | IN/mixed | mixed | forum, telegram | deciding quote cols located
  we performed an in-depth analysis of criminal communications on four popular underground forums, where we discovered 2,251 service providers of CAaaS scams
USENIX/2021/prisec-a-privacy-settings-enforcement-controller | IN/collected | collected | reddit | deciding quote cols located
  We followed a similar methodology for Reddit, and we searched within threads located in subreddits corresponding to the domains in our PCP dataset. This process resulted Goodreads in 101 queries. An example from the Twitter subreddit is: Medium "Anyone know how to make it so people gotta request to follow and see my
USENIX/2021/socialheisting-understanding-stolen-facebook-accounts | OUT/other |  |  | deciding quote cols located
  First, we used accounts that were isolated from the regular Facebook social graph to avoid harming legitimate Facebook users.
USENIX/2021/swiped-analyzing-ground-truth-data-of-a-marketplace-for-stolen-debit-and-credit | OUT/other |  |  | deciding quote cols located
  Our analysis of four years of leaked transactional data allows us to characterize
USENIX/2021/the-hijackers-guide-to-the-galaxy-off-path-taking-over-internet-resources | OUT/mention |  |  | deciding quote cols located
  The accounts can be used for managing Internet resources (high privileged) as well as for registering for events or mailing lists (low privileged).
USENIX/2021/why-older-adults-dont-use-password-managers | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  While Pearman et al. recruited through online venues such as Facebook, Craigslist and Reddit, combined with offline strategies such as posting flyers on bulletin boards without adopting snowball sampling methods, we recruited participants fro[m]...
USENIX/2022/attacks-on-deidentifications-defenses | IN/reuse | reuse | forum | deciding quote cols located
  Xed also includes information about students' activities in courses including how many forum posts they made.
USENIX/2022/behind-the-tube-exploitative-monetization-of-content-on-youtube | IN/collected | collected | forum | deciding quote cols located
  The discussion board dataset is composed of comments and posts from 11 different forums, shown in Table 1.
USENIX/2022/creating-a-secure-underlay-for-the-internet | OUT/homograph |  |  | deciding quote cols located
  Using an SBAS-defined BGP community tag, the customer can instruct the PoPs to only redistribute the announcement internally
USENIX/2022/frameshifter-security-implications-of-http-2-to-http-1-conversion-anomalies | OUT/homograph |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we make FRAMESHIFTER publicly available in the hopes that the security community expands on it
USENIX/2022/helping-hands-measuring-the-impact-of-a-large-threat-intelligence-sharing-commun | IN/collected | collected | other-messenger | deciding quote NOT LOCATED as contiguous normalized span
  We also joined and revealed ourselves as researchers interested in learning more about how the community was functioning.
USENIX/2022/like-lesbians-walking-the-perimeter-experiences-of-u-s-lgbtq-folks-with-online-s | CONTEXT/user-study |  |  | deciding quote cols located
  We conducted qualitative semi-structured interviews with 14 queer participants diverse across race, age, gender, sexuality, and socioeconomic status.
USENIX/2022/targeted-deanonymization-via-the-cache-side-channel-attacks-and-defenses | OUT/app-or-protocol |  |  | deciding quote cols located
  Reddit. The SD-URL for the leaky resource points to a private subreddit page. The attack uses the private sharing-based approach. The attacker creates a private subreddit and approves the victim to the private subreddit.
USENIX/2022/where-to-recruit-for-security-development-studies-comparing-six-software-develop | OUT/recruitment |  |  | deciding quote cols located
  Online Forums/Blogs (33): Strategies relying on discussion platforms such as Reddit (8), online forums (8), mailing lists (15), and blogs (2) dedicated to computer science topics.
USENIX/2023/a-two-decade-retrospective-analysis-of-a-universitys-vulnerability-to-attacks-ex | CONTEXT/declined |  | forum | deciding quote NOT LOCATED as contiguous normalized span
  we did not sign up for any private leak forums, pay any money, redistribute any data, or use any method of downloading that would facilitate others obtaining the data
USENIX/2023/abuse-vectors-a-framework-for-conceptualizing-iot-enabled-interpersonal-abuse | IN/collected | collected | reddit, forum | deciding quote cols located
  we performed a separate analysis of web pages we had collected from Reddit and Quora. We selected these two forums because they were the top two general-purpose forums which appeared in our dataset
USENIX/2023/account-verification-on-social-media-user-perceptions-and-paid-enrollment | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  On Reddit, for instance, the announcement of a popular AMA (“ask me anything”) session is often accompanied by a “proof” post
USENIX/2023/all-of-them-claim-to-be-the-best-multi-perspective-study-of-vpn-users-and-vpn-pr | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We ask VPN users to participate in our survey by distributing the recruitment message in Consumer Reports’ tech-focused mailing list, subreddits such as r/VPN, r/asknetsec, r/samplesize, and on Twitter using the research team’s own personal accounts.
USENIX/2023/anatomy-of-a-high-profile-data-breach-dissecting-the-aftermath-of-a-crypto-walle | IN/collected | collected | reddit | deciding quote cols located
  The process of designing a survey instrument was informed by multiple posts from affected victims on a dedicated Reddit discussion forum, which emerged after this incident. A non-systematic exploratory review of the posted messages revealed a set of attack vectors, response actions, and reported examples of harm,
USENIX/2023/beyond-the-gates-an-empirical-analysis-of-http-managed-password-stealers-and-ope | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  analyze the source code of leaked Stealer kits and document their features and offerings as advertised in underground forums
USENIX/2023/cryptographic-deniability-a-multi-perspective-study-of-user-perceptions-and-expe | IN/collected | collected | mailing-list | deciding quote NOT LOCATED as contiguous normalized span
  we analyzed a thread [9] from moderncrypto.org—public forums for discussing modern cryptographic practice
USENIX/2023/improving-logging-to-reduce-permission-over-granting-mistakes | IN/collected | collected | forum, mailing-list | deciding quote cols located
  We crawled the real-world problems related to the software from sysadmin forums (e.g., stackexchange, stackoverflow) and the software's administration mailing list, and further filtered the access control related cases with keywords filtering.
USENIX/2023/know-your-cybercriminal-evaluating-attacker-preferences-by-measuring-profile-sal | OUT/other |  |  | deciding quote cols located
  The sales activity indicates a remunerative business model, especially considering IMPaaS.ru is a single-vendor market (as opposed to a market platform [37]).
USENIX/2023/lost-at-c-a-user-study-on-the-security-implications-of-large-language-model-code | OUT/recruitment |  |  | deciding quote cols located
  with a range of experience from three sources: (1) an undergraduate junior "operating systems" software class, (2) a senior- and MS-level "application security" software class, and (3) an informal student "software chat group" which operates over Discord app.
USENIX/2023/multiview-finding-blind-spots-in-access-deny-issues-diagnosis | IN/collected | collected | forum, mailing-list | deciding quote NOT LOCATED as contiguous normalized span
  issues from mailing lists [2, 8, 10, 11] and sysadmin online forums [1, 3, 4, 6, 7, 9].
USENIX/2023/strategies-and-vulnerabilities-of-participants-in-venezuelan-influence-operation | IN/collected | collected | telegram | deciding quote cols located
  During participant recruitment, we have identified and joined six Telegram groups (Tuiteros-DeChavez, Tuiteros Patriotas, TuiterosActivos, Twiteros Patriotas, Twiteros Activos, Bonos de la Patria) used by participants to communicate and coordinate activities.
USENIX/2023/to-cloud-or-not-to-cloud-a-qualitative-study-on-self-hosters-motivation-operatio | CONTEXT/user-study |  | forum | deciding quote NOT LOCATED as contiguous normalized span
  Our study consists of two parts: (1) a Nextcloud community online survey (NS=994) covering demographic information about the instance, as well as motivations, use cases, and a coarse security assessment. (2) semi-structured interviews (NI=41) with selected participants of the Nextcloud community survey
USENIX/2023/token-spammers-rug-pulls-and-sniper-bots-an-analysis-of-the-ecosystem-of-tokens | IN/collected | collected | telegram | deciding quote cols located
  We find evidence of this technique in the smart contract's code and then inspect the groups on Telegram.
USENIX/2023/un-equal-online-safety-a-gender-analysis-of-security-and-privacy-protection-advi | OUT/mention |  |  | deciding quote cols located
  Online forums: general mentions of online forums, technology related forums or Reddit in particular.
USENIX/2024/a-mixed-methods-study-on-user-experiences-and-challenges-of-recovery-codes-for-a | IN/collected | collected | reddit | deciding quote cols located
  we conducted a qualitative analysis of related online discussions in the Tuta's support forum on Reddit. We choose Reddit threads, as analyzing users' support requests directly would break data protection policies, especially as it is not transparent which of those users consented to data collection. Tuta only offers
USENIX/2024/bridging-barriers-a-survey-of-challenges-and-priorities-in-the-censorship-circum | CONTEXT/user-study |  | mailing-list, forum | deciding quote cols located
  Through semi-structured interviews, we gathered insights from providers on the technical, operational, and usability issues that drive or impede CT growth, and with inductive thematic analysis, we identified recurring themes that emerged across different phases of CT operation/usage, including: Discovery &
USENIX/2024/does-online-anonymous-market-vendor-reputation-matter | IN/mixed | mixed | forum, reddit | deciding quote cols located
  We complement market data with social network features extracted from a OAM forum, and by qualitatively coding reputation signals from over 15,000 posts and comments across two subreddits.
USENIX/2024/dont-listen-to-me-understanding-and-exploring-jailbreak-prompts-of-large-languag | IN/collected | collected | forum, reddit, discord | deciding quote cols located
  our primary sources were websites and forums related to LLM jailbreaking, including FlowGPT [12], Jailbreak Chat [1], GitHub repositories [14, 36], Reddit (with topics of r/ChatGPT, r/ChatGPTJailbreak, and r/OpenAI), and Discord (with channels of ChatGPT and ChatGPT Prompt Engineering).
USENIX/2024/enabling-developers-protecting-users-investigating-harassment-and-safety-in-vr | CONTEXT/user-study |  | discord, reddit, facebook-group, other | deciding quote cols located
  For Study-I, we advertised the study in VR-specific online forums.
USENIX/2024/engaging-company-developers-in-security-research-studies-a-comprehensive-literat | OUT/mention |  |  | deciding quote cols located
  The least frequently used channels were snowball sampling (29/163), online forums/blogs (29/163), networking platforms (21/163) (e.g., LinkedIn), freelancer and crowdsourcing platforms (16/163) (e.g., Upwork, Clickworker)
USENIX/2024/exploring-digital-security-and-privacy-in-relative-poverty-in-germany-through-qu | CONTEXT/user-study |  | facebook-group, mailing-list | deciding quote cols located
  In addition to participants recruited offline, we re- cruited through a varied set of online spaces like second hand goods mailing lists, Facebook groups, and twitter 2 The full interview guide can be found at https://osf.io/TJA6H/. USENIX Association hashtags related to low income, poverty activism, and Intro the
USENIX/2024/from-the-childhood-past-views-of-young-adults-on-parental-sharing-of-childrens-p | OUT/recruitment |  |  | deciding quote cols located
  advertising on Reddit (in r/PaidStudies5 and r/paidstudy6 filters in series, we were left with 382 valid responses in total subreddits), in online classifieds at Indiana University, and (238 from AMT and 144 from other sources), all of which at physical locations in/around Bloomington, Indiana. We were from IP
USENIX/2024/i-chose-to-fight-be-brave-and-to-deal-with-it-threat-experiences-and-security-pr | CONTEXT/user-study |  | reddit | deciding quote cols located
  Participant W7 had synthetically-created pictures of her shared in an online community forum: "I think to me the most unpleasant experience was the Reddit picture [...] where someone did something really weird on my picture. That was uncomfortable for me because that was more of a sexual nature. [...] I was 16. [...]
USENIX/2024/i-feel-physically-safe-but-not-politically-safe-understanding-the-digital-threat | CONTEXT/user-study |  | reddit | deciding quote cols located
  We conducted 43 semi-structured interviews with OnlyFans creators in two cohorts
USENIX/2024/i-really-just-leaned-on-my-community-for-support-barriers-challenges-and-coping | CONTEXT/user-study |  | facebook-group, whatsapp | deciding quote cols located
  some participants faced physical isolation and contacted their friends over WhatsApp, Facebook Messenger, SMS, and Facebook Groups to seek support.
USENIX/2024/investigating-moderation-challenges-to-combating-hate-and-harassment-the-case-of | IN/reuse | reuse | reddit | deciding quote cols located
  We downloaded a publicly available datset of all available threads2 from these subreddits from inception to December 2022.
USENIX/2024/malla-demystifying-real-world-large-language-model-integrated-malicious-services | IN/collected | collected | forum | deciding quote cols located
  we collected 13,353 listings from nine underground marketplaces and forums (i.e., Abacus Market, Kerberos Market, Kingdom Market, WeTheNorth Market, MGM Grand Market, Hack Forums, XSS.is, BreachForums, and BlackHatWorld)
USENIX/2024/moderating-illicit-online-image-promotion-for-unsafe-user-generated-content-game | IN/collected | collected | reddit, discord | deciding quote cols located
  This platform enabled our entry into a variety of Roblox game servers on Discord, leading to the discovery of 210 instances for
USENIX/2024/the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor | IN/collected | collected | telegram | deciding quote cols located
  Using API services [10, 11, 54, 55, 78], we collected data related to social media profiles (e.g., name, description, profile picture, date of creation, account status, etc.) between May 2023 and October 2023.
USENIX/2024/understanding-help-seeking-and-help-giving-on-social-media-for-image-based-sexua | IN/collected | collected | reddit | deciding quote NOT LOCATED as contiguous normalized span
  we rely on data shared publicly by users on social media.
USENIX/2024/understanding-the-security-and-privacy-implications-of-online-toxic-content-on-r | CONTEXT/user-study |  | whatsapp, telegram | deciding quote cols located
  with refugee liaisons (n=12), focus groups (n=9, lation to the center of many conversations on social media, 27 participants), and an online survey (n=29) with refugees, which can be neutral or positive in nature. However, toxic conwe discover unique attack contexts (e.g., participants are tartent about/against
USENIX/2024/why-arent-we-using-passkeys-obstacles-companies-face-deploying-fido2-passwordles | OUT/mention |  |  | deciding quote cols located
  am et al. [4] briefly outlined some conceptual limitations of developers implementing WebAuthn by analyzing discussions in the WebAuthn developer community.
USENIX/2024/you-have-to-read-50-different-rfcs-that-contradict-each-other-an-interview-study | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we recruited interviewees using snowball sampling and through cryptographic mailing lists and forums such as the NIST pqc-forum and the IETF SAAG mailing list.
USENIX/2025/a-mixed-methods-study-of-open-source-software-maintainers-on-vulnerability-manag | OUT/mention |  |  | deciding quote cols located
  Using a form of a security contact email or mailing list consisting of project maintainers was the most listed form of current vulnerability management practices (L = 50, I = 11).
USENIX/2025/abusability-of-automation-apps-in-intimate-partner-violence | OUT/mention |  |  | deciding quote cols located
  This research involves two primary activities: (1) evaluating publicly available mobile automation applications, and (2) col- Open Science lecting and analyzing publicly shared automation "recipes" or scripts. Our goal is to understand the abuse potential of these We commit to openly sharing our research artifacts. In
USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s | IN/collected | collected | forum, telegram, discord | deciding quote cols located
  In total, our snapshot includes 1 704 relevant posts made by 714 active forum users.
USENIX/2025/bots-can-snoop-uncovering-and-mitigating-privacy-risks-of-bots-in-group-chats | IN/reuse | reuse | discord, telegram | deciding quote cols located
  Our case studies used two datasets: DISCO [63] and Pushshift [10]. DISCO contains 1.5M Discord messages from 323.6K users across four groups
USENIX/2025/characterizing-and-detecting-propaganda-spreading-accounts-on-telegram | IN/collected | collected | telegram | deciding quote cols located
  we developed a simple custom Telegram client application using the telethon library [40], which we officially registered as such on the Telegram website and received the required API key. The client application is deployed on the full-time running and protected server and operates in the following way: after an
USENIX/2025/characterizing-the-mrdeepfakes-sexual-deepfake-marketplace | IN/collected | collected | forum | deciding quote cols located
  specifically collected public forum posts and replies, metadata demonstrates the promise of mitigations informed by mea- attached to public videos, and public user profile information surements of underground forums and markets; we employ in October and November of 2023. We created an account similar approaches to
USENIX/2025/context-matters-qualitative-insights-into-developers-approaches-and-challenges-w | OUT/recruitment |  |  | deciding quote cols located
  We selected 10 online communities with appropriate channels for us to recruit participants and invited members to participate in our interview study.
USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram | IN/collected | collected | telegram | deciding quote cols located
  Telegram API [78] to collect 64,801 posts between February 21st and May 29th, 2024. Each channel was queried at 10-minute intervals to capture new posts while adhering to the API rate limits. We also monitored metrics such as subscriber count, post views, and forwards at 10-minute intervals. Telegram channels, by
USENIX/2025/double-edged-shield-on-the-fingerprintability-of-customized-ad-blockers | IN/collected | collected | forum | deciding quote cols located
  We scrape ad-blocker forums, where users post feedback and requests to ad-blocker and filter-list maintainers, to gather user ad-blocker configurations at scale.
USENIX/2025/expert-insights-into-advanced-persistent-threats-analysis-attribution-and-challe | OUT/mention |  |  | deciding quote cols located
  Analysts consult these public forums to identify any existing intelligence that can aid in their investigation.
USENIX/2025/from-meme-to-threat-on-the-hateful-meme-understanding-and-induced-hateful-conten | IN/collected | collected | reddit | deciding quote cols located
  we manually select newly published and trending ones from Know Your Meme (KYM) [4] website and subreddit Bad Memes [3] by checking out the latest updates
USENIX/2025/gpuhammer-rowhammer-attacks-on-gpu-memories-are-practical | OUT/mention |  |  | deciding quote cols located
  NVIDIA Developer Forums. Ecc on vs ecc off.
USENIX/2025/hatebench-benchmarking-hate-speech-detectors-on-llm-generated-content-and-hate-c | IN/reuse | reuse | gab-parler-voat, reddit | deciding quote cols located
  hate speech datasets: HateXplain [41], HateCheck [55], Dy-Generated Hate Speech. In Conference on Empirical Methods naHate [70], MHS [56], Gab (GabHateCorpus) [8], Tweetin Natural Language Processing (EMNLP), pages 4699-4705. ACL, 2021. BLM [37], HateEmoji [34], Civil Comments (CC) [16], CovidHate [85], Wikipedia
USENIX/2025/i-cannot-write-this-because-it-violates-our-content-policy-understanding-content | IN/collected | collected | reddit | deciding quote cols located
  We performed a keyword-based search in GAI online tool-related subreddits and then manually filtered out irrelevant posts, creating the final Reddit dataset for analysis.
USENIX/2025/investigating-the-impact-of-online-community-involvement-on-safety-practices-and | IN/collected | collected | reddit | deciding quote NOT LOCATED as contiguous normalized span
  we analyzed discussion from 8 drug-related subreddits to examine how their involvement in online communities influences their safety practices
USENIX/2025/on-the-virtues-of-information-security-in-the-uk-climate-movement | CONTEXT/user-study |  | telegram, whatsapp, other-messenger | deciding quote cols located
  We report on an ethnographic study with members of the climate movement in the United Kingdom (UK). We conducted participant observation and interviews at protests and in various activist settings.
USENIX/2025/practically-secure-honey-password-vaults-new-design-and-new-evaluation-against-o | OUT/other |  |  | deciding quote cols located
  This dataset is a compilation of password datasets distributed on RaidForums [34], a black-hat hacking forum. Various data breaches were shared on RaidForums, with many of them available for just a few dollars.
USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f | CONTEXT/user-study |  | other-messenger | deciding quote cols located
  Through our personal networks, we joined five WeChat groups with names such as "App Privacy Compliance Discussion Group". These groups are composed of a total of 1,600 members who have worked on privacy compliance from different industries and companies.
USENIX/2025/s-mine-collecting-and-analyzing-s-mime-certificates-at-scale | OUT/other |  |  | deciding quote cols located
  tests against the 2024 archive of the IETF's Some PKIX and SMIME (SPASM) mailing list
USENIX/2025/thats-my-perspective-from-30-years-of-doing-this-an-interview-study-on-practices | OUT/mention |  |  | deciding quote cols located
  A few exchanged experiences and engaged in discussions in "developer discussion forums or other places [like] Reddit [or] StackOverflow" (P15), not necessarily to discuss implementation details.
USENIX/2025/understanding-how-users-prepare-for-and-react-to-smartphone-theft | CONTEXT/user-study |  | reddit | deciding quote cols located
  To reach potential participants, we advertised our study on relevant forums that discuss phone theft, including r/LostMyPhone and r/iphonehelp among others. Our advertisement post outlined the participation requirements, specifically that individuals must have personally experienced phone theft, as well as details
USENIX/2026/assessing-llm-response-quality-in-the-context-of-technology-facilitated-abuse | IN/collected | collected | reddit | deciding quote cols located
  On Reddit, we extracted post titles and descriptions using the Reddit API
USENIX/2026/chameleon-channels-measuring-youtube-accounts-repurposed-for-deception-and-profi | OUT/mention |  |  | deciding quote cols located
  In addition to the platforms described in these studies, we note that a substantial amount of trade occurs in other platforms that are not described, such as the forum OGUser (similar to SWAPD) and Telegram channels.
USENIX/2026/cracks-in-the-walled-garden-dissecting-the-gray-market-of-unauthorized-ios-app-d | OUT/broadcast |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We selected RedNote (Xiaohongshu) [38] as our primary data source for identifying self-signing service providers, as it is one of the most active text-based social media platforms in China. Using keywords such as “iOS certificate” and “customized V (WeChat)”, we manually inspected posts and comments to extract publicly...
USENIX/2026/digital-risks-and-coping-practices-among-roblox-game-creators | CONTEXT/user-study |  | reddit, discord | deciding quote cols located
  we conducted a semistructured interview study with 20 RCs from diverse backgrounds. We then performed a thematic analysis of the interview data.
USENIX/2026/end-to-end-encrypted-collaborative-documents | OUT/app-or-protocol |  |  | deciding quote cols located
  SignalCD is an E2EE-CD solution built on top of the Signal group messaging protcol and platform that fulfills deployment requirements specific to investigative journalists.
USENIX/2026/from-mirai-to-gorilla-deep-dive-into-a-long-lasting-ddos-for-hire-botnet | IN/collected | collected | telegram | deciding quote cols located
  Telegram Channels: We monitor Telegram channels to gain insights into the botnet's operations and marketing.
USENIX/2026/membership-inference-attacks-on-tokenizers-of-large-language-models | OUT/mention |  |  | deciding quote cols located
  OpenAI claims that its tokenizers were trained on models' pretraining corpus, which includes Reddit data
USENIX/2026/stayin-alive-how-global-stolen-data-markets-thrive-on-telegram | IN/collected | collected | telegram | deciding quote cols located
  We collect data about the channels and their users, as well as messages and files shared within the channels.
USENIX/2026/window-based-membership-inference-attacks-against-fine-tuned-large-language-mode | IN/reuse | reuse | reddit | deciding quote cols located
  supplemented by Amazon Reviews [59], CC-News [28], and Reddit [70] to extend evaluation across diverse domains at similar scales
WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod | IN/collected | collected | forum | deciding quote cols located
  The malware forum dataset. We collected 202 malicious scripts that were published or discussed in several forums, such as malwaredomainlist.com and milw0rm.com.
WWW/2011/heat-seeking-honeypots-design-and-experience | CONTEXT/own-community |  | forum | deciding quote cols located
  The software honeypot mainly sees two types of attacks: attackers trying to register accounts and post in the forums !$ and comments (COMMENT), and attackers trying to access +,-$.,/0,/$ 1234,/5-3,$.6785/,$ 9,5:;.,,<=4>$ the administrator console on these Web applications (AD- ?64,@A6:$ MIN). The reason the
WWW/2012/branded-with-a-scarlet-c-cheaters-in-a-gaming-social-network | OUT/other |  |  | deciding quote cols located
  we crawled the Steam Community and collected data for more than 12 million users. Our analysis targets the position of cheaters in the network
WWW/2012/serf-and-turf-crowdturfing-for-fun-and-profit | OUT/attack |  |  | deciding quote cols located
  For QQ campaigns, messages are calculated as the number of users in all QQ groups that received spam from our workers.
WWW/2012/winner-takes-all-competing-viruses-or-ideas-on-fair-play-networks | OUT/other |  |  | deciding quote cols located
  This allows us to use the data as a proxy for product sales/adoption for each product. We used the following pairs of rival products: 1. Reddit and Digg
WWW/2013/group-chats-on-twitter | OUT/broadcast |  |  | deciding quote cols located
  The groups and the members of these groups are not explicitly known. Rather, members agree on a hashtag and a meeting time (e.g., 3pm Pacific Time every Wednesday) to discuss a subject of interest.
WWW/2013/no-country-for-old-members-user-lifecycle-and-linguistic-change-in-online-commun | OUT/broadcast |  |  | deciding quote cols located
  large beer review communities (BeerAdvocate and RateBeer)
WWW/2013/on-participation-in-group-chats-on-twitter | OUT/broadcast |  |  | deciding quote cols located
  we identify all tweets in each chat by capturing tweets with the corresponding hashtag.
WWW/2013/the-role-of-web-hosting-providers-in-detecting-compromised-websites | OUT/other |  |  | deciding quote cols located
  During our experiments, we evaluated the security measures put in place by web hosting providers to detect malicious activities, compromised websites, and prevent abuse of their services.
WWW/2015/opinion-spam-detection-in-web-forum-a-real-case-study | IN/mixed | mixed | forum | deciding quote cols located
  we conduct a real case study based on a set of internal records of opinion spams leaked from a shady marketing campaign. We explore the characteristics of opinion spams and spammers in a web forum
WWW/2015/supporting-ethical-web-research-a-new-research-ethics-review | OUT/other |  |  | deciding quote cols located
  a discussion forum hosted by CMT is activated to allow researchers to discuss each proposal assigned.
WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  In addition of using Meanpath to retrieve the pages that include a certain resource, we also query Google to collect how many times the candidate indicator together with certain security related keywords such as “hacked”, “malware”, “compromised”, and “antivirus”.
WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells | OUT/attack |  |  | deciding quote NOT LOCATED as contiguous normalized span
  During our manual code analysis, we found 18 web shells that implement an IRC bot in PHP in order to connect to an IRC server and become part of a bot network (i.e., a network of compromised machines under the control of an attacker).
WWW/2016/stress-testing-the-booters-understanding-and-undermining-the-business-of-ddos-se | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Absent a centralized location for finding booters, we found services via search engines and advertisements on hacker forums. We selected 15 booter services that received the most positive feedback on underground forums for our attack infrastructure characterization.
WWW/2017/an-army-of-me-sockpuppets-in-online-discussion-communities | CONTEXT/operator |  | forum | deciding quote NOT LOCATED as contiguous normalized span
  Disqus, a commenting platform that hosted these discussions, provided us with a complete trace of user activity across nine communities
WWW/2017/ex-machina-personal-attacks-seen-at-scale | IN/collected | collected | other | deciding quote cols located
  We apply our methodology to English Wikipedia, generating a corpus of over 100k high quality human-labeled comments and 63M machine-labeled ones
WWW/2017/tools-for-automated-analysis-of-cybercriminal-markets | IN/mixed | mixed | forum | deciding quote cols located
  We collected the forum data in two ways: partial scraping (Darkode, Hack Forums, Hell) and complete publicly leaked database dumps that contain all public posts and metadata prior to the leak (Blackhat World, Nulled, Antichat, Carders and L33tCrew).
WWW/2017/who-controls-the-internet-analyzing-global-threats-using-property-graph-traversa | OUT/mention |  |  | deciding quote cols located
  Dyn.com customers, including Amazon, Netflix, Twitter, Reddit, and Spotify, experienced outages on the name resolution.
WWW/2018/a-structured-approach-to-understanding-recovery-and-relapse-in-aa | OUT/broadcast |  |  | deciding quote NOT LOCATED as contiguous normalized span
  In order to collect information about AA members on Twitter, we extract tweets that mention "first AA meeting" over a four year window from January 1, 2013 to February 1, 2017.
WWW/2018/crimebb-enabling-cybercrime-research-on-underground-forums-at-scale | IN/collected | collected | forum | deciding quote NOT LOCATED as contiguous normalized span
  CrimeBot manages manually registered accounts and session cookies to access the different forums.
WWW/2019/are-all-successful-communities-alike-characterizing-and-predicting-the-success-o | IN/reuse | reuse | reddit | deciding quote cols located
  We obtained all posts and comments from subreddits created in 2014 [4, 5].
WWW/2019/bootstrapping-domain-specific-content-discovery-on-the-web | OUT/other |  |  | deciding quote cols located
  Weapon Forums (Forum): discussion forums about firearms and weapons.
WWW/2019/characterizing-speed-and-scale-of-cryptocurrency-discussion-spread-on-reddit | IN/reuse | reuse | reddit | deciding quote NOT LOCATED as contiguous normalized span
  An archive of Reddit posts and comments is publicly available at https://files.pushshift.
WWW/2019/citation-needed-a-taxonomy-and-algorithmic-assessment-of-wikipedias-verifiabilit | OUT/recruitment |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We recruited participants through mailing lists, social media and the English Wikipedia's Village pump (the general discussion forum of the English Wikipedia volunteer community).
WWW/2019/doppelgangers-on-the-dark-web-a-large-scale-assessment-on-phishing-hidden-web-se | OUT/homograph |  |  | deciding quote cols located
  We employ a carefully designed content grouping algorithm that classifies onion domains into content-wise distinct website groups based on the text and the title in each Tor onion domain's homepage.
WWW/2019/generalists-and-specialists-using-community-embeddings-to-quantify-activity-dive | IN/reuse | reuse | reddit | deciding quote cols located
  The data we used is publicly available and can be downloaded from pushshift.io
WWW/2019/hack-for-hire-exploring-the-emerging-market-for-account-hijacking | IN/collected | collected | forum | deciding quote cols located
  Posing as buyers, we interacted with 27 English, Russian, and Chinese blackmarket services, only five of which succeeded in attacking synthetic (though realistic) identities we controlled.
WWW/2019/knowledge-aware-assessment-of-severity-of-suicide-risk-for-early-intervention | IN/collected | collected | reddit | deciding quote cols located
  We used 93K users who actively participated in the SuicideWatch subreddit providing 587466 posts.
WWW/2019/listening-between-the-lines-learning-personal-attributes-from-conversations | IN/reuse | reuse | reddit | deciding quote cols located
  We used a publicly available crawl4 spanning the years from 2006 to 2017. Specifically, we tapped into two subforums on Reddit: "iama" where anyone can ask questions to a particular person, and "askreddit" with more general conversations.
WWW/2019/mis-information-dissemination-in-whatsapp-gathering-analyzing-and-countermeasure | IN/collected | collected | whatsapp | deciding quote cols located
  We joined those groups and gathered the content shared within them for time periods corresponding to two major social mobilization events in Brazil
WWW/2019/sarcasm-detection-with-self-matching-networks-and-low-rank-bilinear-pooling | IN/reuse | reuse | reddit | deciding quote cols located
  we follow previous studies and evaluate our model on two datasets collected from Reddit
WWW/2019/self-and-cross-excitation-in-stack-exchange-question-answer-communities | IN/reuse | reuse | forum | deciding quote NOT LOCATED as contiguous normalized span
  Stack Exchange encompasses several Q&A communities, termed Stack Exchange instances, with each dedicated to Q&A on
WWW/2019/semi-supervised-graph-classification-a-hierarchical-graph-perspective | OUT/mention |  |  | deciding quote cols located
  in a social network, a group of people with shared interests forms a user group, whereas a number of user groups are interconnected via interactions or common members
WWW/2019/to-return-or-to-explore-modelling-human-mobility-and-dynamics-in-cyberspace | IN/reuse | reuse | reddit | deciding quote cols located
  We first download all the user posts on Reddit from 2012 July to 2014 Dec.
WWW/2019/trajectories-of-blocked-community-members-redemption-recidivism-and-departure | IN/mixed | mixed | other | deciding quote cols located
  In this work we use the complete conversational history between English Wikipedia editors on both article and user talk pages.
WWW/2019/web-experience-in-mobile-networks-lessons-from-two-million-page-visits | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  We observe results from Reddit web experiments performed in Sweden.
WWW/2020/dark-matter-uncovering-the-darkcomet-rat-ecosystem | OUT/other |  |  | deciding quote cols located
  To supplement our data set of downloaded DarkComet databases, we downloaded DarkComet hack packs from a combination of hacking forums and VirusTotal.
WWW/2020/de-kodi-understanding-the-kodi-ecosystem | CONTEXT/links-only |  | reddit | deciding quote cols located
  we built a simple Web crawler which looks for Kodi-related terms (e.g., Kodi, XBMC, etc) on both GitHub and Reddit. These links are expected to point either directly to Kodi addons or collections of addons
WWW/2020/edarkfind-unsupervised-multi-view-learning-for-sybil-account-detection | OUT/other |  |  | deciding quote cols located
  The dataset was obtained using eDarkTrends, a semi-automated platform, to extract posts about fentanyl, fentanyl analogs and other non-pharmaceutical synthetic opioids in the crypto market. Data sources include three different crypto markets
WWW/2020/frozen-binomials-on-the-web-word-ordering-and-language-conventions-in-online-tex | IN/reuse | reuse | reddit | deciding quote cols located
  We gather text data from comments made by users in discussion threads.
WWW/2020/go-see-a-specialist-predicting-cybercrime-sales-on-online-anonymous-markets-from | OUT/other |  |  | deciding quote cols located
  using measurements from AlphaBay (2015-2017), comprising of 126,934 feedbacks, 7,543 listings and 1,339 vendors related to B2B cybercrime offerings
WWW/2020/ten-social-dimensions-of-conversations-and-relationships | IN/reuse | reuse | reddit | deciding quote cols located
  A dataset containing the vast majority of the submissions and comments published on Reddit since 2007 is publicly available
WWW/2020/the-chameleon-attack-manipulating-content-display-in-online-social-media | OUT/attack |  |  | deciding quote cols located
  In particular, we did not access or store any information about the profiles we contacted during the experiment. We only recorded the status of the requests to join their Facebook groups.
WWW/2020/the-pod-people-understanding-manipulation-of-social-media-popularity-via-recipro | IN/collected | collected | telegram | deciding quote cols located
  We then used the Telegram API to download the group metadata and all the messages from these public Telegram groups
WWW/2021/chinese-wall-or-swiss-cheese-keyword-filtering-in-the-great-firewall-of-china | OUT/app-or-protocol |  |  | deciding quote NOT LOCATED as contiguous normalized span
  telnet and IRC are still used for bulletin boards and chat rooms, no Keyword censorship of traffic is within mainland China
WWW/2021/deepfake-videos-in-the-wild-analysis-and-detection | IN/collected | collected | reddit | deciding quote NOT LOCATED as contiguous normalized span
  Reddit.com hosts two popular deepfake discussion subforums, 'GIF Fakes' and 'SFWDeepFakes'. In these sub-forums, we found posts that linked to videos or channels, either created by the authors themselves, or by another content creator. We scraped all posts for URLs, and obtained 1,491 URLs.
WWW/2021/short-is-the-road-that-leads-from-fear-to-hate-fear-speech-in-indian-whatsapp-gr | IN/collected | collected | whatsapp | deciding quote cols located
  we joined and monitored over 5,000 political groups discussing politics. From these groups, we obtained all the text messages, images, video and audio shared in the groups
WWW/2021/twiti-social-listening-for-threat-intelligence | OUT/broadcast |  |  | deciding quote cols located
  There are two ways to collect data from Twitter - (i) keyword tracking and (ii) user tracking.
WWW/2022/beyond-bot-detection-combating-fraudulent-online-survey-takers | OUT/recruitment |  |  | deciding quote cols located
  The first survey recruits Rust programmers on public online forums and social media networks.
WWW/2022/characterizing-detecting-and-predicting-online-ban-evasion | IN/collected | collected | other | deciding quote cols located
  we curated a new dataset based on Wikipedia's sockpuppet group data.
WWW/2022/conspiracy-brokers-understanding-the-monetization-of-youtube-conspiracy-theories | OUT/mention |  |  | deciding quote cols located
  Alternative social networks such as Parler, Telegram, and Gab were more common in the conspiracy set. Discord was more common in control. However, since these social networks are not often directly used for monetization, we excluded them from this analysis.
WWW/2022/duet-a-generic-framework-for-finding-special-quadratic-elements-in-data-streams | IN/reuse | reuse | reddit, forum | deciding quote cols located
  We use the data set from the social network - Reddit Hyperlink Network [46] and name it Reddit. This subredditto-subreddit hyperlink network is extracted from the posts that create hyperlinks from one subreddit to another, which has 286,561 records in total, including 27,777 distinct items and 137,805 distinct
WWW/2022/early-identification-of-depression-severity-levels-on-reddit-using-ordinal-class | IN/reuse | reuse | reddit | deciding quote NOT LOCATED as contiguous normalized span
  we used 2 real-world Reddit datasets with a different number of posts to identify depression severity levels. We constructed one of the depression severity detection datasets (D1) ... and used eRISK [26] as our second dataset (D2)
WWW/2022/graphnli-a-graph-based-natural-language-inference-model-for-polarity-prediction | IN/collected | collected | forum | deciding quote cols located
  We collected data continuously until a change in the Kialo backend in January 2020 which made our crawler obsolete.
WWW/2022/how-do-mothers-and-fathers-talk-about-parenting-to-different-audiences-stereotyp | IN/reuse | reuse | reddit | deciding quote cols located
  Reddit comments were collected using Pushshift's API1 [2]
WWW/2022/identification-of-disease-or-symptom-terms-in-reddit-to-improve-health-mention-c | IN/collected | collected | reddit | deciding quote cols located
  we selected categories of subreddits where members are likely to discuss topics related to disease or symptom terms. We included 15 subreddits from the 3 domains of Daily, Fun, and Health. Using the PRAW API, we retrieved all available posts from these subreddits
WWW/2022/massive-text-normalization-via-an-efficient-randomized-algorithm | IN/reuse | reuse | reddit | deciding quote NOT LOCATED as contiguous normalized span
  the Reddit dataset is constructed from Reddit's comments dump5 .
WWW/2022/revisiting-email-forwarding-security-under-the-authenticated-received-chain-prot | OUT/app-or-protocol |  |  | deciding quote cols located
  Mailing lists are based on email forwarding, and thus we investigate open-source Mailing List Managers to explore their ARC integration.
WWW/2022/understanding-conflicts-in-online-conversations | CONTEXT/operator |  | facebook-group | deciding quote cols located
  Our sample of conflict comments consists of de-identified comments from public groups (any size) and large private groups (>32 members) written in English from 05/29/2021 to 08/15/2021 that were reported by a member as containing conflict. Because our goal is to understand the differences between conflict and
WWW/2023/a-prompt-log-analysis-of-text-to-image-generation-systems | IN/reuse | reuse | discord | deciding quote NOT LOCATED as contiguous normalized span
  The Midjourney dataset [39] is obtained by crawling message records from the Midjourney Discord community over a period of four weeks (June 20
WWW/2023/automated-content-moderation-increases-adherence-to-community-guidelines | OUT/broadcast |  |  | deciding quote NOT LOCATED as contiguous normalized span
  in a large study of Facebook comments (? = 412M), we used a fuzzy regression discontinuity design to measure the impact of automated content moderation on subsequent rule-breaking behavior
WWW/2023/cashing-in-on-contacts-characterizing-the-onlyfans-ecosystem | OUT/broadcast |  |  | deciding quote cols located
  We group the creators into four bins based on the subscription prices.
WWW/2023/contrastfaux-sparse-semi-supervised-fauxtography-detection-on-the-web-using-mult | IN/collected | collected | reddit | deciding quote cols located
  Using the obtained URLs, we crawl the texts of the posts from the Twitter API [49] and Reddit API [50].
WWW/2023/evidence-of-demographic-rather-than-ideological-segregation-in-news-discussion-o | IN/collected | collected | reddit | deciding quote cols located
  We collect public data from Reddit by using Pushift [6].
WWW/2023/gateway-entities-in-problematic-trajectories | IN/collected | collected | facebook-group | deciding quote NOT LOCATED as contiguous normalized span
  We present an offine evaluation of our gateway entity scores conducted using Facebook Groups. ... We identify three different types of public target sets H1, H2, and BF, two of which correspond to problematic content, and the last one corresponding to benign content.
WWW/2023/improving-health-mention-classification-through-emphasising-literal-meanings-a-s | IN/collected | collected | forum | deciding quote cols located
  we crawled the Nairaland website using Beautiful Soup6 (see section 6 for ethical considerations). We select forums where health-related topics are likely to be discussed, i.e. Health and Politics forums.
WWW/2023/mental-health-coping-stories-on-social-media-a-causal-inference-study-of-papagen | OUT/broadcast |  |  | deciding quote cols located
  We collect data from two populations on Twitter: 787K posts from 2,468 individuals who reply to Twitter posts containing coping stories and 1.4M posts from 8,465 individuals in a control group.
WWW/2023/misbehavior-and-account-suspension-in-an-online-financial-communication-platform | IN/collected | collected | other | deciding quote cols located
  with their corresponding social graphs, 4.2M historical article posts, and 5.3M comments, including information on nearly 4 000 suspended accounts and 17 000 removed comments.
WWW/2023/sedition-hunters-a-quantitative-study-of-the-crowdsourced-investigation-into-the | OUT/broadcast |  |  | deciding quote cols located
  Using the Twitter API 2.0 search endpoints, we used the hashtag #Seditionhunters as query to collect all the tweets
WWW/2023/understanding-the-behaviors-of-toxic-accounts-on-reddit | IN/collected | collected | reddit | deciding quote cols located
  We collected a total of 2.2 billion comments via Pushshift, a third-party API that aggregates Reddit comments and posts
WWW/2023/will-admins-cope-decentralized-moderation-in-the-fediverse | IN/collected | collected | fediverse | deciding quote cols located
  We collect a large-scale dataset covering 10 months: this includes 1,740 instances, 133.8k users, 29.9m posts, associated metadata, and importantly, the policies setup by the administrators.
WWW/2024/deliberate-exposure-to-opposing-views-and-its-association-with-behavior-and-rewa | IN/collected | collected | reddit | deciding quote cols located
  using the Pushshift API [3]. CTH and TD were banned in 2020 for Reddit rule violations
WWW/2024/getting-bored-of-cyberwar-exploring-the-role-of-low-level-cybercrime-actors-in-t | IN/collected | collected | telegram, forum | deciding quote cols located
  1 764 posts made by 372 users on Hack Forums mentioning the two countries, and 441 Telegram announcements (with 58k replies) of a volunteer hacking group
WWW/2024/identifying-risky-vendors-in-cryptocurrency-p2p-marketplaces | OUT/mention |  |  | deciding quote NOT LOCATED as contiguous normalized span
  we observed users place posting reviews on Reddit (e.g., /r/Paxful), Telegram (e.g., LCS Telegram channel), or even leaving negative reviews in app stores
WWW/2024/mentallama-interpretable-mental-health-analysis-on-social-media-with-large-langu | IN/reuse | reuse | reddit | deciding quote cols located
  The raw data is collected from 10 existing mental health analysis datasets from multiple social media data sources, including Reddit
WWW/2024/navigating-multidimensional-ideologies-with-reddits-political-compass-economic-c | IN/reuse | reuse | reddit | deciding quote cols located
  PushShift API
WWW/2024/navigating-the-post-api-dilemma | IN/reuse | reuse | reddit | deciding quote cols located
  We collected data from Pushshift2 up until March of 2023.
WWW/2024/triage-of-messages-and-conversations-in-a-large-scale-child-victimization-corpus | IN/leak | leak | chat-irc | deciding quote cols located
  We obtained authorization to access to the dataset through our law enforcement partners after the platform was shut down, survivors were rescued, and the investigation ended.
WWW/2025/behavioral-homophily-in-social-media-via-inverse-reinforcement-learning-a-reddit | IN/reuse | reuse | reddit | deciding quote cols located
  This data was collected using the pushshift Reddit API [3].
WWW/2025/causal-insights-into-parlers-content-moderation-shift-effects-on-toxicity-and-fa | OUT/broadcast |  |  | deciding quote cols located
  Developing our custom build crawler, we collected about 17M parleys of a subset of 432K users who were active from February 2021 to January 2022. We labeled our dataset as a post-policy policy change dataset. To the best of our knowledge, ours is the first dataset that was collected after Parler came back online. To
WWW/2025/causal-modeling-of-climate-activism-on-reddit | IN/not-stated | not-stated | reddit | deciding quote cols located
  our approach uses large-scale and fine-grained longitudinal data (2016 to 2022) to jointly model the roles of sociodemographic makeup, experience of extreme weather events, exposure to climate-related news, and social influence through online interactions
WWW/2025/detecting-and-understanding-the-promotion-of-illicit-goods-and-services-on-twitt | CONTEXT/links-only |  | telegram, whatsapp, other-messenger | deciding quote cols located
  we have extracted from PIPs over 37K accounts of five instant messaging platforms including Telegram, WeChat, QQ, WhatsApp, and LINE
WWW/2025/dynamic-graph-unlearning-a-general-and-efficient-post-processing-method-via-grad | OUT/homograph |  |  | deciding quote cols located
  We evaluated our method on six commonly used datasets for dynamic link prediction [33], including Wikipedia, Reddit, MOOC, LastFM [23], UCI [31], and Enron [37].
WWW/2025/exposing-cross-platform-coordinated-inauthentic-activity-in-the-run-up-to-the-20 | IN/collected | collected | telegram, facebook-group | deciding quote cols located
  Finally, Telegram data was gathered using the Telegram API, allowing the extraction of public chats' details, metadata, messages, and message attachments.
WWW/2025/fact-based-counter-narrative-generation-to-combat-hate-speech | OUT/mention |  |  | deciding quote cols located
  We use the Multi-Target CONAN (MTCo) [10] dataset for our analysis.
WWW/2025/figurative-cum-commonsense-knowledge-infusion-for-multimodal-mental-health-meme | IN/mixed | mixed | reddit | deciding quote cols located
  We gather data from various online sources, including Reddit and Instagram.
WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms | IN/collected | collected | telegram | deciding quote cols located
  we gathered data across X, Instagram, Facebook, Telegram, and YouTube using the formulated keywords.
WWW/2025/the-agenda-setting-function-of-social-media | IN/reuse | reuse | reddit | deciding quote cols located
  We begin with a dataset of all Reddit submissions from June 2005 until June 2021.
WWW/2025/thematic-lm-a-llm-based-multi-agent-system-for-large-scale-thematic-analysis | IN/reuse | reuse | reddit | deciding quote cols located
  We applied Thematic-LM to the Dreaddit dataset and the Reddit climate change dataset to analyse themes related to social media stress and online opinions on climate change.
WWW/2026/anomaly-detection-of-interaction-behaviors-in-streaming-graphs | IN/reuse | reuse | reddit | deciding quote cols located
  Two existing datasets (Wikipedia and Reddit [36]) are used to evaluate the detection performance of counter-type anomalies. Wikipedia records users' Wikipedia pageediting behaviors: an editing behavior is labeled anomalous if the user is banned after performing it. Reddit captures users' posting behaviors: a post is
WWW/2026/deepfakes-in-the-2025-canadian-election-prevalence-partisanship-and-platform-dyn | IN/collected | collected | reddit | deciding quote cols located
  Similar election-related queries were applied to Bluesky and Reddit using their respective public APIs, again filtering for posts that included attached media (for Reddit, using a set of subreddits).
WWW/2026/doxing-as-a-service-demystifying-the-chinese-online-doxing-ecosystem | IN/collected | collected | telegram | deciding quote NOT LOCATED as contiguous normalized span
  Analyzing 25,972 messages and 13.22 million subscriber links from 100 major channels on Telegram, we demystify its organization, operations, and user engagement.
WWW/2026/how-social-media-peer-comments-influence-privacy-decisions-in-photo-sharing-cont | OUT/other |  |  | deciding quote NOT LOCATED as contiguous normalized span
  Meme stimuli were collected from social media and contained at least one person and a text caption of 50 words or fewer.
WWW/2026/pathways-of-thoughts-multi-directional-thinking-for-long-form-personalized-quest | OUT/mention |  |  | deciding quote cols located
  We conduct our experiments on the LaMP-QA benchmark [31]-a recent large-scale benchmark designed for evaluating personalized
WWW/2026/privsniffer-graph-based-contextual-privacy-leakage-detection-for-user-generated | IN/collected | collected | reddit | deciding quote cols located
  To analyze the distribution of privacy leakages in real-world online forums, we sample 500 threads from Reddit, a popular social media platform.
WWW/2026/question-the-questions-auditing-representation-in-online-deliberative-processes | CONTEXT/operator |  | other | deciding quote cols located
  We consider datasets based on sessions from 3 deliberations: "America in One Room: Democratic Reform" (June 2023), the "Meta Community Forum on AI chatbots" (two sessions from October 2023), and the "Meta Community Forum on AI agents" (two sessions from October 2024).
 
Deciding-quote checks across 419 candidate papers: 339 contiguous normalized cols spans; 80 not located. A nonmatch can be column damage or a paraphrase; it is not certified evidence. See human audit logs. No unverified quote is quoted verbatim on the content page.

Main corpus source spot-checks:

ethics_groups_spotchecks.txt

USENIX/2026/stayin-alive-how-global-stolen-data-markets-thrive-on-telegram
Pattern: We do not lie
LOCATED cols: rivate channels whose invite links are advertised on forums or another channel. We do not lie or pretend to be an interested buyer to be admitted into groups. We also do not attempt to join any groups that require payments or vouching by an existing member. We do not buy anything and only act as neutral observers, minimizing any interaction with the community. We could not obtain informed consent from all members of the observed communities. According to the British Society of Criminology's ethical guidelines [6], informed consent may be waived for research examining publicly accessible online communities, particularly when the focus is on collective patterns of behavior rather than individual actions. In the United States, publicly available data without personal identifiers generally does not qualify as human subject research and are therefore exempt from IRB review, unless multiple data sources are combined to inf
 
USENIX/2026/stayin-alive-how-global-stolen-data-markets-thrive-on-telegram
Pattern: For ethical reasons, we use local
LOCATED cols: sified as other. Among the six data types, the most com-Model (LLM) classifier. For ethical reasons, we use local monly occurring is credentials (22%), followed by its close models instead of cloud-based LLMs to avoid sending stolen relative infostealer logs (21%). Next are carding (19%) and and potentially sensitive data to third-party servers. Gemma databases (18%), followed by personal information (14%). 3 [31] offers the best balance between accuracy and speed The least common are personal documents, appearing in 4% among various locally run LLMs we have tested. We use of classifications. Gemma 3 27B with GGUF Q4_0 quantization and a context Beyond aggregate statistics, we further examine how each 14While leads may come from legitimate sources and be used for legitimate data type evolves over time. Figure 2 displays the number purposes (e.g., an individual expresses interest in a specific service through of chann
 
USENIX/2026/stayin-alive-how-global-stolen-data-markets-thrive-on-telegram
Pattern: Files. We retrieve
LOCATED cols: nal creator. Finally, we store the names of any files contained in the message. Files. We retrieve metadata of any file present in a message, namely its name, format, size, and description. We also download a subset of files and images. Specifically, we collect JPG images and files in TXT, CSV, and SQL formats. To reduce the strain on the ecosystem and ensure timely data collection, we record metadata but do not download files larger than 100MB. We compute and store a SHA-512 hash of each downloaded file and store a single copy of a file corresponding to a given hash to avoid duplicate storage of identical files. 4.1 Users. We only collect minimal information about users to allow inference about user numbers and membership networks. We collect user identifier7 and, where available, their username, first name, and last name.8 For each observed user, we also record their channel membership.9 5 A candidate corresponds t
 
IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e
Pattern: communicated with operators
LOCATED cols: anding of DaaS, we joined several related Telegram groups [14, 21, 32, 37, 56], communicated with operators, acquired wallet drainers, and summarized the profit-sharing process. These groups can be discovered by searching for keywords like "wallet drainer" on platforms such as Twitter, Github, and Telegram. In this section, we will first describe the operational pipeline of DaaS (Section 4.1). Following that, we will analyze the profitsharing process of DaaS (Section 4.2). Lastly, we will present an overview of profit-sharing transactions on Ethereum (Section 4.3). These efforts serve as a foundation for detecting DaaS accounts. 4.1 Operational Pipeline of DaaS As depicted in Figure 2, the complete DaaS workflow consists of four steps. Operator promotes the DaaS revenue model. To attract prospective affiliates, the operator introduces the wallet drainer and its potential profits on social media [55]. Subsequently, th
 
USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s
Pattern: We did not seek the consent
LOCATED cols: cs committee. We only scraped public forums and channels, which is lawful [82]. We did not seek the consent of individuals on these forums and channels, as sending thousands of messages could be regarded as spamming. We expect users to be aware that their public postings are visible to all. Our analyses were conducted collectively to avoid individuals being identified, which accords with the British Society of Criminology's Statement on Ethics [83]. All quotes were paraphrased to prevent attribution. No domains of seized, functioning, or deceptive booters are disclosed to avoid attracting users, driving artificial traffic that confuses future collection, or causing potential harm to involved actors. B Open Science For the N ETSCOUT and A MP P OT datasets, please contact the providers. Datasets provided by the Cambridge Cybercrime Centre can be shared with researchers for appropriate projects through a license agreeme
 
USENIX/2025/investigating-the-impact-of-online-community-involvement-on-safety-practices-and
Pattern: Although PWUD
LOCATED cols: ussions facilitate systematic data collection and qualitative analysis [14,78]. Although PWUD is also active in other online communities such as Telegram groups and self- constructed forums, for ethical reasons, we limited our online data collection to publicly accessible platforms. We collected discussions among PWUD within their online communities and the rules governing these communities. Specifically, our initial step involved retrieving the subreddit r/Drugs, identified by directly searching for the keyword 'Drugs'. We compiled a list of relevant subreddits linked by r/Drugs, excluding those not pertinent to drug use. These subreddits were then ranked based on their member count, and the top 30 were selected for potential data collection. Before collecting user discussion data, we sent private messages to moderators of these 30 subreddits, explaining our research topic, purpose, and how the collected data would 
 
USENIX/2021/collective-information-security-in-large-scale-urban-protests-the-case-of-hong-k
Pattern: all participants in our study also assumed
LOCATED cols:  example, "where to go next" (P10) often received several thousand votes. While all participants in our study also assumed police monitoring of the public Telegram groups, the speed with which collective decisions could be executed made police infiltration less of a concern. Forums were, on the other hand, generally seen to be slow and not suitable for live protest action. One participant explained how the voting worked best when only a few options were given, enabling protesters to make a "simple choice between A or B" (P3). However, based on our data, we see that the option with the most votes is rarely followed by everyone. Given the anonymous nature of these groups and of the polls - and since anonymity was a key security need for Anti-ELAB protesters - it is unclear who votes in these polls. The scale of these groups was, however, critical for the success of the protests for two main reasons: it established a st
 
USENIX/2024/understanding-the-security-and-privacy-implications-of-online-toxic-content-on-r
Pattern: joined via invitation
LOCATED cols: e focus group reported an incident where their WhatsApp group (that can only be joined via invitation) had been "hacked [infiltrated], and they 33rd USENIX Security Symposium 4379 started receiving offensive images targeting refugees." We posit this resulted from an unintentional leak of the group's "invite link", as speculated by participants. This experience of infiltration was the first of its kind for FG3, whose participants reported "feeling very uneasy and worried about this attack." 6.2.2 Profiling Attackers In profiling attackers, participants highlight the following three factors: (a) affiliation with refugees, (b) association with organizations/ideology, and (c) demographics. For affiliations, a majority of attacks against participants stem from strangers, people who have no prior affiliation with the refugee (e.g., FG1-9, 57% of surveyed participants had never met their attacker before). However, similar t
 
IMC/2020/demystifying-the-messaging-platforms-ecosystem-through-the-lens-of-twitter
Pattern: We only store the hash
LOCATED cols: one number of the group's creator; and (4) phone number of the group's creator. We only store the hash of the phone number, although it is available to anyone with access to the group URL. Telegram. Similar to the method for WhatsApp, we use Telegram's Web client to obtain basic information about Telegram groups without joining them. We implement a custom scraper that obtains and parses the web page for each group to gather several details: (1) title of the group; (2) size of the group and number of members online (at the time of visiting the group's web page); and (3) whether the "chat room" is a channel or a group. Discord. For obtaining metadata about Discord groups we use the platform's REST API [22]. For each group we collect the (1) title of the group, (2) number of members-both in total and online-in the group, and (3) group creator and group creation date. We follow the aforementioned techniques to gather met
 
USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram
Pattern: we did not download or read
LOCATED cols: or ethical reasons, due to the presence of personally identifiable information, we did not download or read the payload files. Instead, our proceeding statistical analysis is solely based on the information provided in the post text and the payload file names. It was also essential to distinguish between posts sharing user credentials and those sharing session cookies, as these may require different handling and mitigation strategies from a security vendor's point of view [83]. We utilized spaCy's [5] tokenization to identify key phrases and patterns in the post content and filenames. This approach USENIX Association was chosen over simple word frequency as spaCy systematically breaks down text into meaningful components while capturing contextual patterns and semantic relationships. This was particularly valuable in cases where posts lacked descriptive text and relied solely on filenames of attached files to infer t
 
USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram
Pattern: we utilized the GPT-4 API
LOCATED cols: ftware categorization across all the 11,800 posts identified by the classifier, we utilized the GPT-4 API [1] to automatically classify files based on the post text and the filename (when an attachment was present) within the existing 15 categories, with the potential to identify additional categories. We include the prompt used for this categorization in Section 11.1 in the Appendix. Using this approach, GPT-4 added four new categories, bringing the total number of categories to 19. Our coders validated the post category and description for a random sample of 1,000 such posts and found 994 to be accurate. Figure 3 illustrates the ten most common categories of software that appeared in these channels. Using GPT-4, we also identified that the 11,800 posts shared 6,154 applications, with 4,201 being for Android and 1,953 for Windows. In the majority of the posts (93.8%, 11,074), the software was shared directly as a fi
 
IEEE-SP/2025/sok-a-privacy-framework-for-security-research-using-social-media-data
Pattern: The recommended privacy-preserving practices
LOCATED cols: vailable data [15], [63], or, specifically, social media data [42], [52], [91]. The recommended privacy-preserving practices include aggregating findings and anonymizing data to prevent reverse identification [8], [14], [49]; paraphrasing quotes [10]; receiving prior consent when spotlighting or spotlighting public figures if consent is impossible [42]; and keeping original links instead of downloading artifacts to preserve data subjects' right to edit or remove their content [12]. On the ethical implications of collecting social media data, Fiesler et al. prompted researchers to make individual judgments based on specific circumstances rather than solely relying on platforms' terms of services [21]. Drawing from interviews with social computing researchers, Vitak et al. recommend researchers be transparent with participants, have ethical deliberations with colleagues, and exercise caution in sharing results [82]. Ot

Boundary audit a:

ethics_groups_audit_a.md

# Group population boundary audit A
2026-10-08; GPT-6.1-sol subagent. Owned batch_00 through batch_05 only. Source: paper.cols.txt; all source excerpts below whitespace-collapsed for searching. This is a prioritised boundary audit, not a second full ethics coding pass. No new ethics claims were inferred.
 
## USENIX/2021/swiped-analyzing-ground-truth-data-of-a-marketplace-for-stolen-debit-and-credit
Changed {"route": "leak", "role": "main", "dataset": "leaked backend database of an unnamed underground carding shop", "platforms": ["other"], "object": "underground carding-shop marketplace: sellers, customers and admin customer-support tickets (stolen card marketplace)", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "exempt", "review_body": "NYU's Institutional Review Board (IRB)", "review_quote": "We submitted our protocol to NYU’s Institutional Review Board (IRB) and our study was deemed to not be human subjects research and it was exempted.", "consent": "waiver-argued", "waiver_reason": "criminal actors; utilitarian argument", "consent_quote": "The first concern is whether it is acceptable to analyze thirdparty data likely obtained through unlawful means, and without the usual standard of “informed consent.” We make a utilitarian argument in line with prior studies of criminal backends", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": ["aggregate-only", "removed-pii", "hash-identifiers", "restricted-release"], "minimise_quotes": ["Thirdly, we only report aggregate or pseudonymous data.", "Personally identifiable information was either removed from the dataset before it was shared with us, or hashed to allow detection of duplicates while avoiding identification of involved parties.", "the analyzed database contained no identifying information about cardholders, as names had been removed, and account numbers had been hashed, except for the first six digits identifying the bank.", "we do not name the shop in order not to provide any validation or benefit to the perpetrator of the hack."], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "IN", "code": "leak"} to {"route": "", "role": "", "dataset": "", "platforms": [], "object": "", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "OUT", "code": "other"}.
Leaked card-shop transactional/inventory database, not a member community dataset. Forums only prior-work context.
Checked source span: erground economy operates, despite it causing fraud losses estimated at billions of dollars a year. Our analysis of four years of leaked transactional data allows us to characterize this shop's business model, sellers, customers, and finances. The shop earned close to $104 M in gross revenue, and listed over 19 M unique card numbers for sale. Around 97% of the inventory was stolen magnetic stripe d
 
## WWW/2025/fact-based-counter-narrative-generation-to-combat-hate-speech
Changed {"route": "collected", "role": "one-of-several", "dataset": "", "platforms": ["reddit"], "object": "r/ChangeMyView subreddit posts/comments retrieved as a fact-based knowledge repository (alongside the Newsroom news-article dataset) to ground GPT-4o-generated counter-narratives against hate speech", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "exempt", "review_body": "Institutional Review Board", "review_quote": "Our study was determined to not involve direct human subjects research and was granted an exemption by the Institutional Review Board.", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [{"service": "GPT-4o (OpenAI)", "kind": "hosted-llm", "why_local": "", "quote": "We use GPT4o with the following prompt."}], "terms": "not-stated", "terms_quote": "", "verdict": "IN", "code": "collected"} to {"route": "", "role": "", "dataset": "", "platforms": [], "object": "", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "OUT", "code": "mention"}.
ChangeMyView knowledge repository is Jiang et al. related work, not authors' data. Own material MTCo and news knowledge base.
Checked source span: resting observations between the original hate speech and our constructed CNs. 4.1 Set up Datasets. We use the Multi-Target CONAN (MTCo) [10] dataset for our analysis. This dataset has hate speech and counter narrative pairs in English, targeting multiple groups. It has been collected using a Human-in-the-Loop approach to ensure quality and relevance. The dataset contains 5,003 hate s
 
## CCS/2017/data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials
Changed {"route": "collected", "role": "one-of-several", "dataset": "", "platforms": ["forum"], "object": "public and private blackhat/underground forums trading stolen-credential leaks", "vulnerable": "no", "vulnerable_quote": "", "access": "mixed", "access_quote": "We leverage Google's crawler to monitor activity on five public blackhat subforums1 that deal exclusively with stolen credentials, along with 115 paste sites.", "interaction": "passive-stated", "interaction_quote": "We emphasize that we never trade or purchase credential dumps-our activity on these sites is strictly passive.", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "IN", "code": "collected"} to {"route": "", "role": "", "dataset": "", "platforms": [], "object": "", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "OUT", "code": "other"}.
Research object is password dumps, expressly excluded by tightened population rule; forum-monitoring method remains a useful contextual ethics example outside counted population.
Checked source span:  2, based on a snapshot of the search index in June, 2016. We supplement this automated pipeline by manually collecting credential leaks shared on 11 private, member-only blackhat forums where we have access. Over the course of June, 2016-May, 20172 , we periodically monitored new forum threads and obtained 258 large credential leaks containing a combined 1.79 billion non-unique usernames and passwords.
 
## USENIX/2025/s-mine-collecting-and-analyzing-s-mime-certificates-at-scale
Changed {"route": "", "role": "", "dataset": "", "platforms": ["mailing-list"], "object": "IETF SPASM mailing list archive, considered as a source of S/MIME-signed emails/certificates and rejected for low yield", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "CONTEXT", "code": "declined"} to {"route": "", "role": "", "dataset": "", "platforms": [], "object": "", "vulnerable": "no", "vulnerable_quote": "", "access": "not-stated", "access_quote": "", "interaction": "not-stated", "interaction_quote": "", "review": "not-stated", "review_body": "", "review_quote": "", "consent": "not-discussed", "waiver_reason": "", "consent_quote": "", "privacy_expectation": "not-discussed", "privacy_quote": "", "minimise": [], "minimise_quotes": [], "quotes_policy": "not-stated", "quotes_policy_quote": "", "third_party": [], "terms": "not-stated", "terms_quote": "", "verdict": "OUT", "code": "other"}.
Collection target certificates, not member community content. Declined archive route due to 22-certificate yield, not an ethical refusal.
Checked source span: uch as collecting certificates from signed emails in the archives of public mailing lists. However, tests against the 2024 archive of the IETF's Some PKIX and SMIME (SPASM) mailing list, which is responsible for the standardization of S/MIME, have yielded only 22 leaf certificates. Therefore, we decided against this approach. The DANE record S/MIMEA was considered another promising source for certifica
 
## USENIX/2024/investigating-moderation-challenges-to-combating-hate-and-harassment-the-case-of
Changed {"route": "collected", "code": "collected", "dataset": ""} to {"route": "reuse", "code": "reuse", "dataset": "Pushshift Reddit archive"}.
Downloaded third-party archive, not first-party Reddit collection.
Checked source span: ril 2024. Both are very active with over ten daily threads, providing a rich dataset for our study. We downloaded a publicly available datset of all available threads2 from these subreddits from inception to December 2022. We used pushshift.io, a platform that is used to maintain an up-to-date public archive for Reddit to download the threads3 . We omitted threads where the posts were empty, deleted by the poster, or removed by moderators
 
## WWW/2022/how-do-mothers-and-fathers-talk-about-parenting-to-different-audiences-stereotyp
Changed {"route": "collected", "code": "collected", "dataset": ""} to {"route": "reuse", "code": "reuse", "dataset": "Pushshift Reddit archive"}.
Data retrieved from third-party archive; route consistent with post-API paper already reuse.
Checked source span: udience and if there are gender differences in relation to gender stereotypes. 3 METHOD 3.1 Dataset Reddit comments were collected using Pushshift's API1 [2], a social media data collection, analysis, and archiving platform updated in real-time. Two sets of comments were collected: (a) all the comments published in 2020 on r/Daddit and r/Parenting by authors who published on
 
## WWW/2024/navigating-multidimensional-ideologies-with-reddits-political-compass-economic-c
Changed {"route": "collected", "code": "collected", "dataset": ""} to {"route": "reuse", "code": "reuse", "dataset": "Pushshift Reddit archive"}.
Archive API route; deciding source span inspected, full sentence spliced in cols.
Checked source span: gure 1: economical (left, center, right) and social (libertarian, center, authoritarian). Using the PushShift API,2 we collect comments and posts from /r/PC and /r/PCM. Henceforth, we analyze a dataset covering the period from 2020 to 2022, which is the most active one, see Figure A.1 in the Appendix. The dataset comprises 79 368 p
 
## CCS/2024/do-anything-now-characterizing-and-evaluating-in-the-wild-jailbreak-prompts-on-l
Changed {"route": "collected", "code": "collected", "dataset": ""} to {"route": "mixed", "code": "mixed", "dataset": "Pushshift and ArcticShift archives plus direct Discord collection"}.
Reddit third-party archives plus Discord collection; retain Discord access/ethics codes without new inference.
Checked source span: ), and r/ChatGPTJailbreak (a subreddit aiming to share jailbreak prompts with 13.5K user accounts). We gather 168,687 submissions from the selected subreddits from Pushshift [15] until March 2023, after which we transitioned to ArcticShift.2 The collection spans from the creation dates of the subreddits to November 30th, 2023. Since these submissions include user feedback, shared prompts, community rules, news, etc., we manually check the flairs among each
 
## IMC/2019/profiling-bgp-serial-hijackers-capturing-persistent-misbehavior-in-the-global-ro
Changed {"role": "main"} to {"role": "minor"}.
Professional member-discussion list included by fixed rule; community data supplies ground-truth labels, not main routing dataset.
Checked source span: ivity. Serial Hijacker ASes: Finding ground truth on serial hijacker ASes is a more difficult task: we process 5 years worth of email threads on the NANOG [6] mailing list and extract 23 AS numbers for which network operators repeatedly disclosed hijacking events. We note that for each of these ASes the email threads included several address blocks that had recently been (or were being) hijacked. Furthermore, in 4
 
## IEEE-SP/2023/beyond-phish-toward-detecting-fraudulent-e-commerce-websites-at-scale
Changed {"role": "main"} to {"role": "one-of-several"}.
Reddit yields fraudulent-site examples in a wider website-detection study, rather than entire main dataset.
Checked source span: ing comments based on a subreddit dedicated to discussing FCWs. As a preliminary step in our study, we continuously crawled the /r/Scams subreddit from December 2019 to October 2021. This subreddit has 354, 000 members and users discuss if sus- # Samples Targeted Domain 1,263 Phishing 10,800 Spam 1,284,664 Spam 15,000 Phishing and spam 20,000 Phishing and spam 32,
 
## WWW/2022/characterizing-detecting-and-predicting-online-ban-evasion
Changed {"verdict": "OUT", "code": "other", "route": "", "role": "", "platforms": [], "object": "", "dataset": ""} to {"verdict": "IN", "code": "collected", "route": "collected", "role": "main", "platforms": ["other"], "object": "Wikipedia sockpuppet moderation records and member account histories", "dataset": ""}.
Member profiles and moderation records of collaborative Wikipedia community are included under fixed member-data rule; other ethical fields kept sentinel, not newly coded.
Checked source span: comparative analyses. 4.2 4.1 Ban Evasion Dataset Since there are no existing ban evasion datasets, we curated a new dataset based on Wikipedia's sockpuppet group data.3 A sockpuppet is defined as an account that is controlled by a user that also controls at least one other account. Wikipedia records data regarding instances of sockpuppeteering that have been identified (using a combin
 
## IMC/2023/the-cloud-strikes-back-investigating-the-decentralization-of-ipfs
Changed {} to {}.
Fill previously empty OUT deciding quote: network measurement, no member-post analysis.
Checked source span: he web. In this paper, we present a large-scale, multi-modal measurement study of the IPFS network. We analyze the topology, the traffic, the content providers and the entry points from the classical Internet. Our measurements show significant centralization in the IPFS network and a high share of nodes hosted in the cloud. We also shed light on the main stakeholders in the ecosystem. We discuss key challenges that might disr
 
## Retained: NDSS/2021/privacyflash-pro-automating-privacy-policy-generation-for-mobile-apps
IN/collected; role=minor
Checked span: nity We received the following comments from study participants via the Upwork chat [72] or e-mail. Additional comments were provided on Reddit's r/iOSProgramming [57] where we solicited participants for our study. Neither comment was prompted for. (1) "Thanks for this awesome application, very helpful" (2) "As a developer, I am very pleased to use PrivacyFlash Pro." (3) "It is great. Awesome work I am really impressed." (4) "I found [PrivacyFlash Pro] very us
 
## Retained: IMC/2016/what-happens-after-you-are-pwnd-understanding-the-use-of-leaked-webmail-credenti
IN/collected; role=minor
Checked span: m to show that the accounts are real, and promise to provide additional data in exchange for a fee. We logged the messages that we received on underground forums, mostly inquiring about obtaining the full dataset, but we did not follow up to them. Finally, to study the activity of criminals obtaining credentials through information-stealing malware in honey accounts, we leaked access credentials of 20 accoun
 
## Retained: WWW/2013/no-country-for-old-members-user-lifecycle-and-linguistic-change-in-online-commun
OUT/broadcast; role=
Checked span: is study we will employ data from two Figure 2: Change in user base: Breakdown of active users each large beer review communities (BeerAdvocate and RateBeer).1 In year. From bottom up: users that joined the community that both communities users provide ratings accompanied by short texyear (and did not abandon the same year), users that joined and tual reviews of more than 60,000 different types of beer. 
 
## Retained: WWW/2018/a-structured-approach-to-understanding-recovery-and-relapse-in-aa
OUT/broadcast; role=
Checked span: ng observations from the data that we use in the later sections to construct our prediction models. In order to collect information about AA members on Twitter, we extract tweets that mention "first AA meeting" over a four year WWW 2018, April 23-27, 2018, Lyon, France window from January 1, 2013 to February 1, 2017. From this set, we eliminate jokes and people attending to support an alcoholic friend or f
 
## Retained: WWW/2023/mental-health-coping-stories-on-social-media-a-causal-inference-study-of-papagen
OUT/broadcast; role=
Checked span: ct. Among them, we manually verify the accuracy of the classifer on a sampled coping story dataset. We collect data from two populations on Twitter: 787K posts from 2,468 individuals who reply to Twitter posts containing coping stories and 1.4M posts from 8,465 individuals in a control group. After applying stratifed propensity score matching, we aggregate psychosocial outcomes as afective, beh
 
## Retained: IMC/2023/flocking-to-mastodon-tracking-the-great-twitter-migration
OUT/broadcast; role=
Checked span: CTION migrated users identified in the previous section. We use Twitter's Search API and Mastodon's Account's Statuses Endpoint.3 For each 3.1 Mastodon Accounts from Twitter user, we crawl all their tweets/statuses from October 01, 2022 to We use an indexing website, instances.social, to identify November 30, 2022. In total, we gather Twitter timelines for 94.88% a comprehen
 
## Retained: IEEE-SP/2023/deepfake-text-detection-limitations-and-opportunities
IN/collected; role=one-of-several
Checked span:  length greater than 192 tokens (we discard synthetic comments that are too short in interactions). We then scraped 112,296 real comments in every forum thread that contained a bot comment. To create a balanced dataset, we use a random sample of 887 real comments (with at least 192 tokens). Linguistic quality of synthetic text in the wild We use the GRUEN metric to evaluate linguistic quality. We observe that synthetic data in the wild
 
## Retained: USENIX/2022/behind-the-tube-exploitative-monetization-of-content-on-youtube
IN/collected; role=main
Checked span: dditionally, we identify software tools used to perpetrate illicit behaviour. Discussion Board Data The discussion board dataset is composed of comments and posts from 11 different forums, shown in Table 1. To holistically survey the landscape of illicit YouTube monetization, we collected data from the most popular online communities from ten different countries that cover each global region. We considered only sites publicly accessi
 
## Retained: IMC/2010/understanding-latent-interactions-in-online-social-networks
IN/collected; role=one-of-several
Checked span: provides overall network coverage similar to other studies that crawled OSN regional networks [29]. As part of our PKU crawls, we gathered all comments generated by users in message board posts, diary entries, photos, and status updates. This data forms the basis of our experiments involving visible interactions. Our dataset represents the complete record of public visible interactions between users in the PKU network. In total, 19,782,140 comments were collected, with 1,218,911 of 
 
## Retained: USENIX/2019/towards-the-detection-of-inconsistencies-in-public-security-vulnerability-report
IN/collected; role=minor
Checked span:  SecurityFocus Forum (also called Bugtraq Mailing List) mainly contains "unstructured" articles and discussion threads between vulnerability reporters and software developers. Regarding the other three websites, SecurityTracker also contains well-structured information, while Openwall and ExploitDB3 contain unstructured information. In total, we obtain 70,569 vulnerability reports associated with 56,642 CVE IDs. These CV
 
## Retained: USENIX/2025/privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f
CONTEXT/user-study; role=
Checked span: icipants who have been involved in SPRCs on WeChat [67] - one of the largest social media in China. Through our personal networks, we joined five WeChat groups with names such as "App Privacy Compliance Discussion Group". These groups are composed of a total of 1,600 members who have worked on privacy compliance from different industries and companies. The group members discuss a variety of privacy complia
 
## Retained: USENIX/2010/re-captchas-understanding-captcha-solving-services-in-an-economic-context
IN/collected; role=minor
Checked span: inue to decline, suggesting that this is a demand-limited market; an assertion further supported by our informal survey of several freelancer forums where workers in search of CAPTCHAsolving work greatly outnumber CAPTCHA-solving service recruitments. One may well ask: Do CAPTCHAs actually work? The answer depends on what it is that we expect CAPTCHAs to do. Telling computers and humans apart. T
 
## Limits and remaining doubt
- Checked all IN deciding quotes mechanically against whitespace-normalised cols text; several are absent due to spliced columns, ligatures, or paraphrase. This audit does not assert all remaining quotes are verified. Parent quote checker should treat mismatches individually.
- PrivacyFlash has unsolicited Reddit comments alongside participant feedback in an appendix: retained IN/minor because comments are reproduced as research feedback, though recruitment-adjacent.
- What-happens-after-pwnd records forum-member direct replies to researchers' bait rather than scraping forum posts: retained IN/minor, an interaction-end case.
- Flocking-to-Mastodon is per-account feed collection, not instance local-timeline collection; retained OUT/broadcast. No automatic inclusion simply from Mastodon platform.
- No-country BeerAdvocate/RateBeer data are product reviews even though paper calls them communities: retained OUT/broadcast under explicit review exclusion. Recovery/relapse AA and mental-health coping are Twitter-only; retained OUT/broadcast.
- Helping-hands cols heavily interleaves columns. Slack joining is stated but main research analysis is CTC blocklist/OTX contribution data; retained IN pending parent boundary decision on TI-sharing community member contributions.
- Shadow Brokers poster links forum registration pages and identifiers, not clear member content; retained provisional IN requires parent decision, likely CONTEXT/links-only.
- edX deidentification dataset includes forum-post counts, not payload; retained IN/reuse/minor under member-data rule, pending parent decision whether educational operational metadata should be excluded.
 
## Resolved last boundary: CCS/2018/knowledge-seeking-on-the-shadow-brokers
IN/collected/one-of-several -> CONTEXT/links-only. Checked exact source: essional Hack Group. Similarly, TSB made a transaction sending 0.1 BTC to Bitcoin address '16EgQ*'. Figure 2b is the registration page of 'Hell Forum'[3], and can be seen that the address is used to collect membership 2250 Poster Presentation CCS'18, October 15-19, 2018, Toronto, ON, Canada WordPress. The common feature was the fact that the companies used WordPress for their homepages, and an entity was able to hack WordPress based homepages. We could conclude the existence of a hacking group behind the identifier 'extraTorrent', and that they
The measured forum evidence is registration-page/payment identifiers, not members' communication. This supersedes the earlier provisional retained note.

Boundary audit b:

ethics_groups_audit_b.md

# Group population audit B (2026-10-08)
 
Model: GPT-6.1-based Codex agent; owned batches 06–10 only. Audit prioritises IN decisions and boundaries; not an exhaustive reread of all ethics fields. Read paper.cols.txt, never paper.norm.txt. Source quote checks collapse whitespace for lookup; no PDF fallback was required for the deciding spans below. No ethics codes added.
 
Rule: actual forum/member posts, profiles, interactions or community Q&A qualify; recruitment, protocol/header metadata, one-to-one sting messages, operational financial/private-email logs, broadcast feeds do not. Pushshift API queried by authors = collected; downloaded existing dump = reuse.
 
## Retained IN WWW/2020/frozen-binomials-on-the-web-word-ordering-and-language-conventions-in-online-tex
Deciding span verified in whitespace-collapsed cols: We gather text data from comments made by users in discussion threads.
 
## Retained IN CCS/2022/why-so-toxic-measuring-and-triggering-toxic-behavior-in-open-domain-chatbots
Deciding span verified in whitespace-collapsed cols: we use the dataset released by Baumgartner et al. [6] by selecting and focusing on four subreddits
 
## Retained IN IEEE-SP/2025/exploring-parent-child-perceptions-on-safety-in-generative-ai-concerns-mitigatio
Deciding span verified in whitespace-collapsed cols: We first collected 712 posts and 8,533 comments on April 9, 2024, using the Python Reddit API Wrapper (PRAW)
 
## Changed IMC/2021/a-large-scale-characterization-of-online-incitements-to-harassment-across-platfo
Before: ('IN', 'collected', 'main', ['imageboard', 'discord', 'telegram', 'gab-parler-voat', 'forum']); after: ('IN', 'reuse', 'main', ['imageboard', 'discord', 'telegram', 'forum'])
Company collected and provided raw data; no evidence authors commissioned/paid crawler. Conservative reuse, not authors collected. Gab microblogs excluded from qualifying platform list; forum included for identified Daily Stormer.
Checked deciding source span: A third-party threat intelligence company collected and provided to us the data sets that we analyzed for this study.
 
## Retained IN WWW/2019/sarcasm-detection-with-self-matching-networks-and-low-rank-bilinear-pooling
Deciding span verified in whitespace-collapsed cols: we follow previous studies and evaluate our model on two datasets collected from Reddit
 
## Changed USENIX/2025/characterizing-the-mrdeepfakes-sexual-deepfake-marketplace
Before: ('IN', 'collected', 'main', ['forum']); after: ('IN', 'collected', 'main', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: specifically collected public forum posts and replies, metadata demonstrates the promise of mitigations informed by mea- attached to public videos, and public user profile information surements of underground forums and markets; we employ in October and November of 2023. We created an account similar approaches to
 
## Retained IN WWW/2025/figurative-cum-commonsense-knowledge-infusion-for-multimodal-mental-health-meme
Deciding span verified in whitespace-collapsed cols: We gather data from various online sources, including Reddit and Instagram.
 
## Retained IN IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e
Deciding span verified in whitespace-collapsed cols: we joined several related Telegram groups [14, 21, 32, 37, 56], communicated with operators, acquired wallet drainers, and summarized the profit-sharing process
 
## Changed CCS/2024/moderator-moderating-text-to-image-diffusion-models-through-fine-grained-context
Before: ('IN', 'collected', 'one-of-several', ['reddit']); after: ('IN', 'collected', 'minor', ['reddit'])
Retain real curated forum/Reddit member material but mark minor: prompt/problem/exploit examples or formative survey instrument design rather than main community corpus.
Checked deciding source span: We collected 153 potentially problematic prompts from social media platforms (e.g., Reddit) and an inappropriate image prompts (I2P) dataset
 
UNRESOLVED deciding quote exactness: WWW/2022/beyond-bot-detection-combating-fraudulent-online-survey-takers; original retained, not independently verified.
 
## Changed IMC/2017/initial-measurements-of-the-cuban-street-network
Before: ('IN', 'collected', 'one-of-several', ['forum', 'chat-irc']); after: ('IN', 'collected', 'minor', ['forum'])
Retain IN: authors observe registered/active WifiNet forum members and Netlab per-hour usage. This is actual member/community usage data, albeit a minor component of network study. No IRC collection evidence: remove chat-irc. Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: As a lower bound on the size of SNET's user base, we consider the WifiNet forums, a general community messaging board hosted Link Destination Fraction of Sites by one of the pillars, which is thought to be one of the network's most popular sites. The forums have 56,000 registered users. At Any off-network site 81% the
 
## Changed USENIX/2020/composition-kills-a-case-study-of-email-sender-authentication
Before: ('IN', 'collected', 'minor', ['mailing-list']); after: ('OUT', '', '', [])
Email-header DKIM vulnerability corpus; IETF list archive is used as protocol evidence, not member-community content analysis.
Checked deciding source span: We conducted a preliminary assessment of this problem by collecting emails from wikileaks.org, IETF mailing lists, and our personal emails. We find that many sites are not aware of this attack. Among the 10 email providers we tested, Zoho.com includes the vulnerable "l=" tag for its outgoing messages. Popular sites
 
## Changed WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod
Before: ('IN', 'collected', 'one-of-several', ['forum']); after: ('IN', 'collected', 'minor', ['forum'])
Retain real curated forum/Reddit member material but mark minor: prompt/problem/exploit examples or formative survey instrument design rather than main community corpus.
Checked deciding source span: The malware forum dataset. We collected 202 malicious scripts that were published or discussed in several forums, such as malwaredomainlist.com and milw0rm.com.
 
## Changed IMC/2018/when-the-dike-breaks-dissecting-dns-defenses-during-ddos
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Reports describe intermittent failure of prominent websites including łTwitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud and The New York Timesž, each a direct or indirect customer of Dyn at the time. Our work helps explain these very different outcomes. The Root DNS saw few or no user-visible problems
 
## Changed IEEE-SP/2021/they-would-do-better-if-they-worked-together-the-case-of-interaction-problems-be
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: we collected and analyzed both Complaints 3 Authors (N=152) the user reviews and support requests as of 07/16/2020. We Together 6. Group Issues to Interactions collected up to 125 of the most recent reviews and support requests for each PWM browser extension in Table V-C. Interactions 7. Evaluate Interaction
 
## Changed WWW/2025/causal-insights-into-parlers-content-moderation-shift-effects-on-toxicity-and-fa
Before: ('IN', 'collected', 'main', ['gab-parler-voat']); after: ('OUT', '', '', [])
Parler profiles/timelines, not groups or boards. Replies alone do not create a bounded community under this rule.
Checked deciding source span: Developing our custom build crawler, we collected about 17M parleys of a subset of 432K users who were active from February 2021 to January 2022. We labeled our dataset as a post-policy policy change dataset. To the best of our knowledge, ours is the first dataset that was collected after Parler came back online. To
 
## Changed WWW/2023/evidence-of-demographic-rather-than-ideological-segregation-in-news-discussion-o
Before: ('IN', 'reuse', 'main', ['reddit']); after: ('IN', 'collected', 'main', ['reddit'])
Authors explicitly query Pushshift API; apply API-collection convention consistently.
Checked deciding source span: We collect public data from Reddit by using Pushift [6].
 
## Retained IN IEEE-SP/2014/doppelganger-finder-taking-stylometry-to-the-underground
Deciding span verified in whitespace-collapsed cols: For each of these four forums we have a complete SQL dump of their database that includes user registration information, along with public and private messages.
 
## Retained IN CCS/2024/using-ai-assistants-in-software-development-a-qualitative-study-on-security-prac
Deciding span verified in whitespace-collapsed cols: We also reviewed 190 relevant Reddit posts and comments to gain insights into the current discourse surrounding AI assistants for software development.
 
## Retained IN IMC/2020/turning-up-the-dial-the-evolution-of-a-cybercrime-market-through-set-up-stable-a
Deciding span verified in whitespace-collapsed cols: We analyse the first dataset, of which we are aware, about the transactions created and completed on a well-known and high-traffic underground marketplace, Hack Forums, along with the associated threads and posts made by its users over two recent years
 
UNRESOLVED deciding quote exactness: IMC/2019/booting-the-booters-evaluating-the-effects-of-police-interventions-in-the-market; original retained, not independently verified.
 
## Retained IN USENIX/2023/strategies-and-vulnerabilities-of-participants-in-venezuelan-influence-operation
Deciding span verified in whitespace-collapsed cols: During participant recruitment, we have identified and joined six Telegram groups (Tuiteros-DeChavez, Tuiteros Patriotas, TuiterosActivos, Twiteros Patriotas, Twiteros Activos, Bonos de la Patria) used by participants to communicate and coordinate activities.
 
## Changed USENIX/2023/improving-logging-to-reduce-permission-over-granting-mistakes
Before: ('IN', 'collected', 'one-of-several', ['forum', 'mailing-list']); after: ('IN', 'collected', 'minor', ['forum', 'mailing-list'])
Retain real curated forum/Reddit member material but mark minor: prompt/problem/exploit examples or formative survey instrument design rather than main community corpus.
Checked deciding source span: We crawled the real-world problems related to the software from sysadmin forums (e.g., stackexchange, stackoverflow) and the software's administration mailing list, and further filtered the access control related cases with keywords filtering.
 
## Retained IN CCS/2017/economic-factors-of-vulnerability-trade-and-exploitation
Deciding span verified in whitespace-collapsed cols: Through market infiltration we collect information on trade of vulnerability exploits spanning from 2010 to 2017, and correlate this data with Symantec data on exploits detected at scale.
 
## Retained IN CCS/2024/on-the-detectability-of-chatgpt-content-benchmarking-methodology-and-evaluation
Deciding span verified in whitespace-collapsed cols: Finance, Medicine, OpenQA, Reddit, and Wikipedia in HC3 [35]; arXiv papers, PeerRead reviews, Reddit, wikiHow manuals, and Wikipedia in M4 [104]
 
## Retained IN CCS/2018/fraud-de-anonymization-for-fun-and-profit
Deciding span verified in whitespace-collapsed cols: we identified 44 fraud workers in Facebook groups, Zeerk, Peopleperhour, Freelancer and Upwork that advertised prices ranging from a few cents ($0.56 on average from Zeerk.com) to several dollars per review
 
## Changed USENIX/2011/show-me-the-money-characterizing-spam-advertised-revenue
Before: ('IN', 'collected', 'minor', ['forum']); after: ('IN', 'collected', 'minor', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: we were able to capture several pur-Note that this data contains an innate time bias since chase order numbers via forum scraping. This opportuthe date of complaint inevitably came a while later than nity arose because affiliate programs typically sponsor the time of purchase (unlike our own purchases). For this
 
## Changed NDSS/2021/all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: We perform random lookups for mobile phone numbers app has customizable settings for the profile picture, About text, in the US and collect statistics about the number of regand Last Seen information. The default for all these settings istered users, as well as the information exposed by them. is Everybody, with the
 
## Changed USENIX/2018/schrodinger-s-rat-profiling-the-stakeholders-in-the-remote-access-trojan-ecosyst
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: This address space belongs to Relakks VPN [42], a Swedish company 1058 27th USENIX Security Symposium that provides free VPN services and is likewise recommended by RAT instruction videos [50] and HackForums members. VPS providers. In addition to using VPN's, we found the use of VPS instances from prominent services
 
## Changed NDSS/2013/intention-and-origination-an-inside-look-at-large-scale-bot-queries
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: category contain keywords that are known to be related to this section. vulnerabilities such as "php", "yabb", "powered", "topic", "forum", "thread", "board", and "vbulletin" [20]. In partic- 4.1 Query Intention Analysis ular, both "powered" and "php" are popular words with a large number of subtrees under each of
 
## Retained IN WWW/2025/causal-modeling-of-climate-activism-on-reddit
Deciding span verified in whitespace-collapsed cols: our approach uses large-scale and fine-grained longitudinal data (2016 to 2022) to jointly model the roles of sociodemographic makeup, experience of extreme weather events, exposure to climate-related news, and social influence through online interactions
 
DOUBT: climate activation paper clearly uses Reddit member content, but collection route was not established by the audited spans; prior collected label retained provisionally, not safe for route percentages.
 
## Retained IN WWW/2017/tools-for-automated-analysis-of-cybercriminal-markets
Deciding span verified in whitespace-collapsed cols: We collected the forum data in two ways: partial scraping (Darkode, Hack Forums, Hell) and complete publicly leaked database dumps that contain all public posts and metadata prior to the leak (Blackhat World, Nulled, Antichat, Carders and L33tCrew).
 
## Retained IN IEEE-SP/2025/understanding-users-security-and-privacy-concerns-and-attitudes-towards-conversa
Deciding span verified in whitespace-collapsed cols: we gathered all posts from r/ChatGPT from its inception in December 2022 till July 2024, using publicly available Reddit dumps [62]
 
## Changed USENIX/2024/a-mixed-methods-study-on-user-experiences-and-challenges-of-recovery-codes-for-a
Before: ('IN', 'collected', 'one-of-several', ['reddit']); after: ('IN', 'collected', 'one-of-several', ['reddit'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: we conducted a qualitative analysis of related online discussions in the Tuta's support forum on Reddit. We choose Reddit threads, as analyzing users' support requests directly would break data protection policies, especially as it is not transparent which of those users consented to data collection. Tuta only offers
 
## Changed IMC/2017/fifteen-minutes-of-unwanted-fame-detecting-and-characterizing-doxing
Before: ('IN', 'collected', 'main', ['imageboard', 'other']); after: ('IN', 'collected', 'main', ['imageboard'])
Pastebin is not a community under rule; imageboard data alone qualifies. Drop other (Pastebin) from qualifying platforms.
Checked deciding source span: we collected all text files posted to pastebin.com, all postings to the "pol" and "b" forums of 4chan.org, and all postings to the "pol" and "baphomet" forums of 8ch.net during the seven week period of 12/19/2016 to 2/6/2017
 
## Changed USENIX/2019/the-anatomy-of-a-cryptocurrency-pump-and-dump-scheme
Before: ('IN', 'mixed', 'main', ['telegram']); after: ('IN', 'collected', 'main', ['telegram'])
PumpOlymp supplies directory/events but authors independently retrieve Telegram message history using API. Non-community directory reuse does not make qualifying community content mixed-route.
Checked deciding source span: we trace the message history of over 300 Telegram channels from June 17, 2018 to February 26, 2019, and identify 412 pump events orchestrated through those channels
 
## Retained IN WWW/2024/mentallama-interpretable-mental-health-analysis-on-social-media-with-large-langu
Deciding span verified in whitespace-collapsed cols: The raw data is collected from 10 existing mental health analysis datasets from multiple social media data sources, including Reddit
 
## Changed USENIX/2025/understanding-how-users-prepare-for-and-react-to-smartphone-theft
Before: ('CONTEXT', '', '', ['reddit']); after: ('CONTEXT', '', '', ['reddit'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: To reach potential participants, we advertised our study on relevant forums that discuss phone theft, including r/LostMyPhone and r/iphonehelp among others. Our advertisement post outlined the participation requirements, specifically that individuals must have personally experienced phone theft, as well as details
 
## Changed USENIX/2025/abusability-of-automation-apps-in-intimate-partner-violence
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: This research involves two primary activities: (1) evaluating publicly available mobile automation applications, and (2) col- Open Science lecting and analyzing publicly shared automation "recipes" or scripts. Our goal is to understand the abuse potential of these We commit to openly sharing our research artifacts. In
 
## Retained IN USENIX/2025/double-edged-shield-on-the-fingerprintability-of-customized-ad-blockers
Deciding span verified in whitespace-collapsed cols: We scrape ad-blocker forums, where users post feedback and requests to ad-blocker and filter-list maintainers, to gather user ad-blocker configurations at scale.
 
## Retained IN IMC/2018/an-empirical-analysis-of-the-commercial-vpn-ecosystem
Deciding span verified in whitespace-collapsed cols: In July 2017, we performed a complete crawl of the two main 'mega-threads' about VPN recommendations. In addition we performed a secondary crawl to extract VPN names from regular posts on the VPN subreddit within the past three months.
 
## Retained IN WWW/2023/will-admins-cope-decentralized-moderation-in-the-fediverse
Deciding span verified in whitespace-collapsed cols: We collect a large-scale dataset covering 10 months: this includes 1,740 instances, 133.8k users, 29.9m posts, associated metadata, and importantly, the policies setup by the administrators.
 
## Retained IN WWW/2017/ex-machina-personal-attacks-seen-at-scale
Deciding span verified in whitespace-collapsed cols: We apply our methodology to English Wikipedia, generating a corpus of over 100k high quality human-labeled comments and 63M machine-labeled ones
 
## Changed USENIX/2024/bridging-barriers-a-survey-of-challenges-and-priorities-in-the-censorship-circum
Before: ('CONTEXT', '', '', ['mailing-list', 'forum']); after: ('CONTEXT', '', '', ['mailing-list', 'forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Through semi-structured interviews, we gathered insights from providers on the technical, operational, and usability issues that drive or impede CT growth, and with inductive thematic analysis, we identified recurring themes that emerged across different phases of CT operation/usage, including: Discovery &
 
## Changed IEEE-SP/2025/on-the-effectiveness-of-prompt-stealing-attacks-on-in-the-wild-prompts
Before: ('IN', 'reuse', 'main', ['reddit', 'discord', 'other']); after: ('IN', 'reuse', 'main', ['reddit', 'discord', 'other'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: prompt dataset as described in [45]. This dataset comprises a comprehensive collection of 15,140 prompts, gathered from four distinct platforms, all contributed by real users. These platforms include Reddit [11] and Discord [6], as well as a variety of websites such as AIPRM [1], FlowGPT [7], and JailbreakChat [8].
 
## Changed USENIX/2012/enemy-of-the-state-a-state-aware-black-box-web-vulnerability-scanner
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: PhpBB v2 is an open-source forum software. It allows B Scanner Configuration registered users to perform many actions such as create new threads, comment on threads, and message other The following describes the exact settings that were used users. Version 2 is notorious for the amount of security to run each of the
 
## Changed WWW/2011/heat-seeking-honeypots-design-and-experience
Before: ('CONTEXT', '', '', ['forum']); after: ('CONTEXT', '', '', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: The software honeypot mainly sees two types of attacks: attackers trying to register accounts and post in the forums !$ and comments (COMMENT), and attackers trying to access +,-$.,/0,/$ 1234,/5-3,$.6785/,$ 9,5:;.,,<=4>$ the administrator console on these Web applications (AD- ?64,@A6:$ MIN). The reason the
 
## Changed IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service
Before: ('CONTEXT', '', '', ['forum']); after: ('CONTEXT', '', '', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: We found 17 RESIP services either through search engines decide where the domain name of the target to be resolved, by or from Blackhat SEO forums [31]. Among them, 5 (Table I) the RESIP or the gateway. This is important since the resolver were picked out based upon their claimed scale (> 100K can be observed by the
 
## Changed IMC/2024/poster-twinkle-twinkle-streaming-star-illuminating-cdn-performance-over-starlink
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Through advertisement campaigns over Reddit and mailing lists, we the end-user experience. https://blog.cloudflare.com/aim-database-for-internetrecruit 21 Starlink users from North America, Europe, Africa and quality/. [2] Allison et al. 2018. 403 Forbidden: A Global View of CDN Geoblocking (IMC '18). Oceania and 35
 
## Changed NDSS/2013/neighborwatcher-a-content-agnostic-comment-spam-inference-system
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: To collect spam harbors, we started from 10,000 verified spam links Sstudy (which are collected from our previous work [27]) and collected a dataset containing 38,913 real-world spam harbors, which are represented with unique domain names. Specifically, we searched all these spam links in Google and collected the
 
## Changed WWW/2024/deliberate-exposure-to-opposing-views-and-its-association-with-behavior-and-rewa
Before: ('IN', 'reuse', 'main', ['reddit']); after: ('IN', 'collected', 'main', ['reddit'])
Authors explicitly query Pushshift API; apply API-collection convention consistently.
Checked deciding source span: using the Pushshift API [3]. CTH and TD were banned in 2020 for Reddit rule violations
 
## Retained IN WWW/2025/the-agenda-setting-function-of-social-media
Deciding span verified in whitespace-collapsed cols: We begin with a dataset of all Reddit submissions from June 2005 until June 2021.
 
## Retained IN USENIX/2020/the-tools-and-tactics-used-in-intimate-partner-surveillance-an-analysis-of-onlin
Deciding span verified in whitespace-collapsed cols: We collected data from Forums A, B, D and E via custom crawlers built using Scrapy, an open-source, Python-based framework for web scraping.
 
## Retained IN WWW/2020/the-pod-people-understanding-manipulation-of-social-media-popularity-via-recipro
Deciding span verified in whitespace-collapsed cols: We then used the Telegram API to download the group metadata and all the messages from these public Telegram groups
 
## Retained IN WWW/2023/improving-health-mention-classification-through-emphasising-literal-meanings-a-s
Deciding span verified in whitespace-collapsed cols: we crawled the Nairaland website using Beautiful Soup6 (see section 6 for ethical considerations). We select forums where health-related topics are likely to be discussed, i.e. Health and Politics forums.
 
## Retained IN WWW/2019/trajectories-of-blocked-community-members-redemption-recidivism-and-departure
Deciding span verified in whitespace-collapsed cols: In this work we use the complete conversational history between English Wikipedia editors on both article and user talk pages.
 
## Changed USENIX/2025/hatebench-benchmarking-hate-speech-detectors-on-llm-generated-content-and-hate-c
Before: ('IN', 'reuse', 'minor', ['gab-parler-voat', 'reddit']); after: ('IN', 'reuse', 'minor', ['gab-parler-voat', 'reddit'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: hate speech datasets: HateXplain [41], HateCheck [55], Dy-Generated Hate Speech. In Conference on Empirical Methods naHate [70], MHS [56], Gab (GabHateCorpus) [8], Tweetin Natural Language Processing (EMNLP), pages 4699-4705. ACL, 2021. BLM [37], HateEmoji [34], Civil Comments (CC) [16], CovidHate [85], Wikipedia
 
## Retained IN WWW/2024/triage-of-messages-and-conversations-in-a-large-scale-child-victimization-corpus
Deciding span verified in whitespace-collapsed cols: We obtained authorization to access to the dataset through our law enforcement partners after the platform was shut down, survivors were rescued, and the investigation ended.
 
## Changed USENIX/2023/anatomy-of-a-high-profile-data-breach-dissecting-the-aftermath-of-a-crypto-walle
Before: ('IN', 'collected', 'one-of-several', ['reddit']); after: ('IN', 'collected', 'minor', ['reddit'])
Retain real curated forum/Reddit member material but mark minor: prompt/problem/exploit examples or formative survey instrument design rather than main community corpus. Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: The process of designing a survey instrument was informed by multiple posts from affected victims on a dedicated Reddit discussion forum, which emerged after this incident. A non-systematic exploratory review of the posted messages revealed a set of attack vectors, response actions, and reported examples of harm,
 
## Retained IN IEEE-SP/2024/combing-for-credentials-active-pattern-extraction-from-smart-reply
Deciding span verified in whitespace-collapsed cols: For our Smart Reply scenario, we train GPT-2 [41] and Bert2Bert [52] models on a training set (sampled from Reddit data set [21]) consisting of 100,000 message-response text pairs
 
## Changed USENIX/2024/exploring-digital-security-and-privacy-in-relative-poverty-in-germany-through-qu
Before: ('CONTEXT', '', '', ['facebook-group', 'mailing-list']); after: ('CONTEXT', '', '', ['facebook-group', 'mailing-list'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: In addition to participants recruited offline, we re- cruited through a varied set of online spaces like second hand goods mailing lists, Facebook groups, and twitter 2 The full interview guide can be found at https://osf.io/TJA6H/. USENIX Association hashtags related to low income, poverty activism, and Intro the
 
## Retained IN IEEE-SP/2019/stealthy-porn-understanding-real-world-adversarial-images-for-illicit-online-pro
Deciding span verified in whitespace-collapsed cols: More specifically, for Baidu Tieba, we gather images from top 63 most active "bars" (a forum on a certain topic). Considering the relatively short lifespan of porn images, our crawler is designed to iteratively visit the 150 latest posts at each "bar" without sleep.
 
## Changed NDSS/2013/social-turing-tests-crowdsourcing-sybil-detection
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Our experimental datasets are collected from two large OSNs: Facebook and Renren. Facebook is the most popular OSN in the world and has more than 1 billion users [8]. Renren is the largest OSN in China, with more than 220 Unknown Suspicious Dataset Facebook Profiles Profiles Google Image Search Friends of Suspicious
 
## Changed WWW/2022/understanding-conflicts-in-online-conversations
Before: ('IN', 'collected', 'main', ['facebook-group']); after: ('CONTEXT', '', '', ['facebook-group'])
Internal Meta/Facebook group data, coauthors Meta; explicit intern note. Operator research, not outside collection by entering communities.
Checked deciding source span: Our sample of conflict comments consists of de-identified comments from public groups (any size) and large private groups (>32 members) written in English from 05/29/2021 to 08/15/2021 that were reported by a member as containing conflict. Because our goal is to understand the differences between conflict and
 
## Changed NDSS/2012/guess-who-s-texting-you-evaluating-the-security-of-smartphone-messaging-applicat
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: In this section we present the results of our security eval- WhatsApp server. To exploit this vulnerability, it is possiuation of the application discussed in Section 3 with respect ble set up a SSL proxy and install the proxy's certificates as to the different attacks outlined in section 4. described in Section 4 on
 
## Changed USENIX/2019/detecting-and-characterizing-lateral-phishing-at-scale
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: employee accounts from 33 organizations. 1,694 of 1 The number of mailboxes is an upper bound on the number of employees these emails were reported by users, with the remainder found due to the use of mailing lists and aliases. 1276 28th USENIX Security Symposium solely by our detector (§ 4); our detector also finds
 
## Changed NDSS/2024/like-comment-get-scammed-characterizing-comment-scams-on-media-platforms
Before: ('IN', 'collected', 'one-of-several', ['whatsapp', 'telegram']); after: ('OUT', '', '', [])
YouTube comments plus one-to-one WhatsApp/Telegram sting conversations; no messenger group/channel/server entered or analysed.
Checked deciding source span: We collect a total of 50 conversations with scammers through WhatsApp and Telegram. By pretending to be unaware victims, we let scammers progress through their scams while recording the conversations. Our study uncovered two major scam activities from the collected conversations: cryptocurrency investment scams and
 
## Retained IN WWW/2023/understanding-the-behaviors-of-toxic-accounts-on-reddit
Deciding span verified in whitespace-collapsed cols: We collected a total of 2.2 billion comments via Pushshift, a third-party API that aggregates Reddit comments and posts
 
## Retained IN IMC/2020/demystifying-the-messaging-platforms-ecosystem-through-the-lens-of-twitter
Deciding span verified in whitespace-collapsed cols: we select a set of group URLs uniformly at random and join them using an account for each platform
 
## Changed USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram
Before: ('IN', 'collected', 'main', ['telegram']); after: ('IN', 'collected', 'main', ['telegram'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Telegram API [78] to collect 64,801 posts between February 21st and May 29th, 2024. Each channel was queried at 10-minute intervals to capture new posts while adhering to the API rate limits. We also monitored metrics such as subscriber count, post views, and forwards at 10-minute intervals. Telegram channels, by
 
## Retained IN NDSS/2025/exploring-user-perceptions-of-security-auditing-in-the-web3-ecosystem
Deciding span verified in whitespace-collapsed cols: we conducted 20 semi-structured interviews with Web3 users and analyzed 905 Reddit posts to supplement and cross-validate the interview findings
 
## Retained IN IEEE-SP/2025/security-perceptions-of-users-in-stablecoins-advantages-and-risks-within-the-cry
Deciding span verified in whitespace-collapsed cols: We examined the top five hundred subreddits on the Reddit platform, subsequently selecting subreddits tagged as "crypto"
 
## Changed WWW/2022/duet-a-generic-framework-for-finding-special-quadratic-elements-in-data-streams
Before: ('OUT', '', '', []); after: ('IN', 'reuse', 'one-of-several', ['reddit', 'forum'])
Member interactions and posted links are actual reused community data, even without raw text. Q&A Stack Overflow included as forum family.
Checked deciding source span: We use the data set from the social network - Reddit Hyperlink Network [46] and name it Reddit. This subredditto-subreddit hyperlink network is extracted from the posts that create hyperlinks from one subreddit to another, which has 286,561 records in total, including 27,777 distinct items and 137,805 distinct
 
## Changed USENIX/2025/characterizing-and-detecting-propaganda-spreading-accounts-on-telegram
Before: ('IN', 'collected', 'main', ['telegram']); after: ('IN', 'collected', 'main', ['telegram'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: we developed a simple custom Telegram client application using the telethon library [40], which we officially registered as such on the Telegram website and received the required API key. The client application is deployed on the full-time running and protected server and operates in the following way: after an
 
## Changed USENIX/2021/prisec-a-privacy-settings-enforcement-controller
Before: ('IN', 'collected', 'one-of-several', ['reddit']); after: ('IN', 'collected', 'one-of-several', ['reddit'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: We followed a similar methodology for Reddit, and we searched within threads located in subreddits corresponding to the domains in our PCP dataset. This process resulted Goodreads in 101 queries. An example from the Twitter subreddit is: Medium "Anyone know how to make it so people gotta request to follow and see my
 
## Changed IMC/2025/exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts
Before: ('IN', 'collected', 'main', ['forum']); after: ('IN', 'collected', 'main', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: We analyzed accounts sold on underground markets accessed via the Tor network. Initially, Mario Beluri et al. Table 2: Overview of the social media data collection. In the table, we display social media accounts advertised for sale. The accounts that are listed referencing the social media platform account profile we
 
## Changed WWW/2026/anomaly-detection-of-interaction-behaviors-in-streaming-graphs
Before: ('OUT', '', '', []); after: ('IN', 'reuse', 'one-of-several', ['reddit'])
Reused Reddit posting/member data qualify. Wikipedia editing alone is not interpersonal community; only Reddit is qualifying object.
Checked deciding source span: Two existing datasets (Wikipedia and Reddit [36]) are used to evaluate the detection performance of counter-type anomalies. Wikipedia records users' Wikipedia pageediting behaviors: an editing behavior is labeled anomalous if the user is banned after performing it. Reddit captures users' posting behaviors: a post is
 
## Changed USENIX/2024/i-chose-to-fight-be-brave-and-to-deal-with-it-threat-experiences-and-security-pr
Before: ('CONTEXT', '', '', ['reddit']); after: ('CONTEXT', '', '', ['reddit'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: Participant W7 had synthetically-created pictures of her shared in an online community forum: "I think to me the most unpleasant experience was the Reddit picture [...] where someone did something really weird on my picture. That was uncomfortable for me because that was more of a sexual nature. [...] I was 16. [...]
 
## Changed IEEE-SP/2019/does-certificate-transparency-break-the-web-measuring-adoption-and-error-rate
Before: ('IN', 'collected', 'minor', ['forum']); after: ('IN', 'collected', 'minor', ['forum'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: we reviewed CT-related posts in the Chrome product help forum6 . We reviewed the 75 public threads matching a search term for the error code that Chrome displays for CT errors (ERR_CERTIFICATE_TRANSPARENCY_REQUIRED). We coded the threads using a general inductive approach [22]. After reviewing all the threads to
 
## Changed USENIX/2024/understanding-the-security-and-privacy-implications-of-online-toxic-content-on-r
Before: ('CONTEXT', '', '', ['whatsapp', 'telegram']); after: ('CONTEXT', '', '', ['whatsapp', 'telegram'])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: with refugee liaisons (n=12), focus groups (n=9, lation to the center of many conversations on social media, 27 participants), and an online survey (n=29) with refugees, which can be neutral or positive in nature. However, toxic conwe discover unique attack contexts (e.g., participants are tartent about/against
 
## Changed USENIX/2024/from-the-childhood-past-views-of-young-adults-on-parental-sharing-of-childrens-p
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: advertising on Reddit (in r/PaidStudies5 and r/paidstudy6 filters in series, we were left with 382 valid responses in total subreddits), in online classifieds at Indiana University, and (238 from AMT and 144 from other sources), all of which at physical locations in/around Bloomington, Indiana. We were from IP
 
## Retained IN IMC/2019/errors-misunderstandings-and-attacks-analyzing-the-crowdsourcing-process-of-ad-b
Deciding span verified in whitespace-collapsed cols: We built a crawler that collected all the available posts on the forum. In total, we have 23,240 topics with at least one report
 
## Changed CCS/2015/leakage-abuse-attacks-against-searchable-encryption
Before: ('IN', 'reuse', 'one-of-several', ['mailing-list']); after: ('IN', 'reuse', 'minor', ['mailing-list'])
Apache java-user public developer community retained; private Enron email excluded. Role minor because public-list data is benchmark test material rather than study of entering a community.
Checked deciding source span: The second dataset we used is a subset of the Apache mailing list archives. Specifically, we used the "java-user" mailing list from the lucene project for the years 2005-2011.
 
## Changed IEEE-SP/2023/sok-decentralized-finance-defi-attacks
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: search for auditing histories from the following three when nearly 600 million dollars are lost in a single month. sources: (i) public announcements on a protocol's website; Despite the fact that BSC is a relatively new blockchain, it (ii) a protocol's social media and blog post (e.g., Twitter and experienced 69 DeFi
 
## Changed USENIX/2012/pharmaleaks-understanding-the-business-of-online-pharmaceutical-affiliate-progra
Before: ('IN', 'leak', 'main', ['chat-irc']); after: ('OUT', '', '', [])
Financial affiliate databases and private operator/employee IM logs. Mentioned Spamdot forum not analysed as member corpus.
Checked deciding source span: We also relied on instant message chat logs of the operators of GlavMed and SpamIt to aid our understanding and validate our hypotheses about the meaning and use of various tables. However, the GlavMed and SpamIt databases are fundamentally operational in nature, and not naturally designed for the kind of broad
 
## Changed USENIX/2019/protecting-accounts-from-credential-stuffing-with-password-breach-alerting
Before: ('OUT', '', '', []); after: ('OUT', '', '', [])
 Deciding quote replaced with contiguous source span (original was stitched or differed from cols reading order).
Checked deciding source span: like Antipublic (450 million credentials), Exploit.in steal usernames and passwords from our service) and an ad- (600 million credentials), and Collection 1-5 (2.2 billion cre- versarial server (e.g., an attacker harvesting usernames and dentials) have steadily grown as their creators aggregated passwords sent to the
 
Resolved former quote-exactness warning WWW/2022/beyond-bot-detection-combating-fraudulent-online-survey-takers: retained OUT; verified contiguous cols span: The first survey recruits Rust programmers on public online forums and social media networks.
 
Resolved former quote-exactness warning IMC/2019/booting-the-booters-evaluating-the-effects-of-police-interventions-in-the-market: retained OUT; verified contiguous cols span: The closure of HackForums' booter market reduced attacks for 13 weeks globally
 
## Followup correction
Parent requested explicit missing-route sentinel. Added not-stated to ENUMS.route in scripts/grp_codes.mjs; climate activism remains IN/main, but code and route are now not-stated. No direct collection inferred.

Boundary audit c:

ethics_groups_audit_c.md

# Ethics groups audit C — 2026-10-08
 
Model: GPT-6.1-sol audit sub-agent. Owned batches 11–15 only (130 records). Scope: population boundary, route, role and platforms; no new ethics codes were inferred. This is a detected population audit, not an exhaustive corpus recode. No empty deciding quotes existed in these five batches.
 
Sources: each cited key resolves to data/fulltext/<year>/<venue>/<slug>/paper.cols.txt. Whitespace was collapsed for locating spans. PDF fallback used scripts/pdftext.py with PYTHONPATH=ethreg/run20261008/python-deps. Default python lacked pypdf; fallback dependency path worked. pypdf emitted fontTools warnings; uncertainty is recorded below.
 
## Boundary decisions
 
Professional community Q&A and mailing-list archives remain eligible when member contributions are actually analysed. Thus MDSP, NANOG/RIPE and sysadmin Q&A are IN/minor or one-of-several, rather than excluded for having technical subject matter. Pure credentials/device dumps, software downloads, and incidental references are excluded. Telegram channel posts remain eligible even when broadcast-style; the fixed brief explicitly includes messaging channels. Twitter/YouTube feeds remain outside.
 
## Changes
 
- `PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations`: IN/reuse; minor → IN/reuse; minor. Fields: deciding_quote. Reddit data (pushshift dump) is used only to build 10,000 synthetic 'personas' for testing a YouTube recommendation-obfuscation browser extension; not analysed as community content in its own right. Distinct from the separately IRB-approved, consented real-world YouTube user study in the same paper.
 
- `USENIX/2025/from-meme-to-threat-on-the-hateful-meme-understanding-and-induced-hateful-conten`: IN/collected; minor → IN/collected; minor. Fields: deciding_quote. Only 5 of the dataset's memes come from r/badmemes (rest are well-known memes from other sources); this subreddit subset is minor within the paper. Collected meme images (including the Reddit ones) are queried against GPT-4V/GPT-4 as part of the prompt-engineering pipeline.
 
- `IEEE-SP/2018/tracking-certificate-misissuance-in-the-wild`: IN/collected; one-of-several → IN/collected; minor. Fields: deciding_quote, role. Main dataset is Censys certificate scans; the MDSP Google-Groups mailing list is crawled as a secondary community-data source to build a 'CA Notoriety' metric. 'CA/Browser Forum' elsewhere in the paper is a standards body (homograph), distinct from the MDSP mailing list that was actually crawled.
 
- `WWW/2019/self-and-cross-excitation-in-stack-exchange-question-answer-communities`: IN/reuse; main → IN/reuse; main. Fields: deciding_quote. Purely quantitative analysis of aggregate activity timestamps/counts from the public Stack Exchange data dump; no user quotes, no ethics/IRB section.
 
- `IEEE-SP/2026/behind-the-curtain-how-shared-hosting-providers-respond-to-vulnerability-notific`: IN/collected; minor → IN/collected; minor. Fields: deciding_quote. Reddit posts are used only as a sampling frame to build a list of 175 hosting-provider companies (not analysed for their content/community insight). The paper's detailed 'Ethical considerations' section (2.4) is about the 24-participant interview study, not about the Reddit mining step specifically.
 
- `WWW/2019/hack-for-hire-exploring-the-emerging-market-for-account-hijacking`: IN/collected; main → IN/collected; one-of-several. Fields: role, platforms, notes. Analyses forum advertisements and feedback as well as service interactions; Telegram is an advertised contact channel, no Telegram member-content collection established.
 
- `IEEE-SP/2025/analyzing-the-ios-local-network-permission-from-a-technical-and-user-perspective`: IN/collected; minor → IN/collected; minor. Fields: deciding_quote. Reddit/StackOverflow posts were searched/read (not joined) to compile a list of user misconceptions, a minor input feeding survey design; ERB approval text is explicitly tied to the separate Prolific survey, not this forum search. StackOverflow coded loosely as 'forum'.
 
- `CCS/2020/impersonation-as-a-service-characterizing-the-emerging-criminal-infrastructure-f`: IN/collected; main → IN/collected; minor. Fields: role, platforms, notes. Community-member examples in Telegram are a minor validation source; forum contacts obtain access to the main ImpaaS marketplace dataset.
 
- `USENIX/2024/malla-demystifying-real-world-large-language-model-integrated-malicious-services`: IN/collected; main → IN/collected; one-of-several. Fields: role, platforms, notes. Main collection combines five marketplaces and four forums; forum listings are one of several sources. Marketplace listings alone are outside this population.
 
- `CCS/2011/an-efficient-user-verification-system-via-mouse-movements`: IN/collected; one-of-several → OUT/other; . Fields: verdict, code, deciding_quote, route, role, platforms, object, interaction, interaction_quote, review, review_body, review_quote, notes. Forum browser instrumentation, not recorded member posts, profiles or community interactions.
 
- `NDSS/2025/towards-understanding-unsafe-video-generation`: IN/reuse; main → IN/reuse; main. Fields: deciding_quote. The paper itself did not collect from 4chan; it reuses 4chan-sourced prompts from Qu et al.'s prior 'Unsafe Diffusion' dataset. Its own IRB/Prolific ethics discussion concerns a separate human-subjects survey where Prolific workers labeled AI-generated videos (derivative synthetic content), not raw 4chan text, so Prolific is not coded as third_party here.
 
- `IEEE-SP/2023/blue-is-the-new-black-market-privacy-leaks-and-re-victimization-from-police-auct`: IN/collected; minor → OUT/other; . Fields: verdict, code, deciding_quote, route, role, platforms, object, review, review_body, review_quote, consent, waiver_reason, consent_quote, notes. Purchased-device private data corpus; Telegram group contents occur incidentally on one phone, not a community collection.
 
- `IEEE-SP/2016/users-really-do-plug-in-usb-drives-they-find`: IN/collected; minor → OUT/mention; . Fields: verdict, code, deciding_quote, route, role, platforms, object, access, review, review_body, review_quote, notes. Incidental community reaction to authors’ USB experiment, rather than a member-content dataset.
 
- `IEEE-SP/2024/no-easy-way-out-the-effectiveness-of-deplatforming-an-extremist-forum-to-suppres`: IN/collected; main → IN/collected; main. Fields: deciding_quote. paper.cols.txt for this key is spliced with an unrelated WWW'24 CMV/Reddit-downvote paper (lines 2-6, e.g. 'UCL's Research Ethics Committee'); all quotes here verified against scripts/pdftext.py clean rendering instead.
 
- `WWW/2019/to-return-or-to-explore-modelling-human-mobility-and-dynamics-in-cyberspace`: IN/collected; main → IN/reuse; main. Fields: code, route, dataset, access, notes. Downloaded an existing public Reddit post archive; no evidence of direct crawl. Membership movement inferred from member posts.
 
- `PETS/2016/blogs-twitter-feeds-and-reddit-comments-cross-domain-authorship-attribution`: IN/collected; one-of-several → IN/collected; one-of-several. Fields: deciding_quote. Reddit is one of three domains (blogs, Twitter, Reddit) used equally for cross-domain stylometry; ground-truth accounts are self-disclosed by users (via /r/twitter), which the paper argues avoids deanonymization harm. Quotes verified against scripts/pdftext.py; the .cols rendering splices this passage across columns.
 
- `PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri`: IN/collected; one-of-several → IN/collected; one-of-several. Fields: deciding_quote. Reddit forum threads mined only to find app-name mentions (nonidentifiable, no account metrics) to supplement a Google-Play app dataset; the paper's IRB approval covers only the separate human-subjects survey, not the forum scraping. Forum threads/comments were sent to GPT-4-Turbo (OpenAI) as an LLM-as-a-Judge to extract app mentions.
 
- `WWW/2023/misbehavior-and-account-suspension-in-an-online-financial-communication-platform`: IN/collected; main → IN/collected; main. Fields: deciding_quote. No ethics/IRB/consent/anonymisation discussion found anywhere in the paper despite collecting 2.76M user profiles and 5.3M comments via TradingView's own web APIs (public data, snowball sampling).
 
- `USENIX/2024/moderating-illicit-online-image-promotion-for-unsafe-user-generated-content-game`: IN/collected; minor → IN/collected; minor. Fields: deciding_quote. Main labeled dataset is built from X/Twitter hashtag search (broadcast, out of scope) and Common Sense Media self-reported reviews/stories (product-review-like, out of scope); only the small 322-image Reddit+Discord 'in-the-wild' robustness test counts as community-space data collection. Image annotation done only by 3 authors (no crowd workers).
 
- `CCS/2010/testing-metrics-for-password-creation-policies-by-attacking-large-sets-of-reveal`: IN/leak; main → OUT/other; . Fields: verdict, code, deciding_quote, route, role, dataset, platforms, object, access, notes. Credential dumps, not community posts or membership data.
 
- `NDSS/2026/loki-proactively-discovering-online-scams-by-mining-toxic-search-queries`: IN/reuse; one-of-several → OUT/other; . Fields: verdict, code, deciding_quote, route, role, dataset, platforms, object, access, interaction, interaction_quote, review, review_quote, terms, terms_quote, notes. Reuses verified scam website URLs derived from subreddit reports, not subreddit member content. Borderline derivative-data case; excluded under actual-member-content rule.
 
- `WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms`: IN/collected; one-of-several → IN/collected; one-of-several. Fields: deciding_quote. Only Telegram (channels) qualifies as a community space among the five platforms studied; X, Instagram, Facebook (plain accounts/pages, no Facebook Groups found) and YouTube are broadcast feeds, out of scope. This batch's TSV row for this key has corrupted probe-count columns ('recall'/'msgch-verdict' instead of numbers); key and path were intact so this was coded normally from the paper text.
 
- `USENIX/2023/multiview-finding-blind-spots-in-access-deny-issues-diagnosis`: IN/collected; one-of-several → IN/collected; one-of-several. Fields: deciding_quote. 112 real-world access-deny issue reports scraped from mailing lists/forums form the evaluation corpus (IN); the paper's only ethics/IRB statement is scoped to the separate human user study (recruited via mailing list/reddit/Slack), not to the forum-data collection.
 
- `WWW/2020/dark-matter-uncovering-the-darkcomet-rat-ecosystem`: IN/collected; minor → OUT/other; . Fields: verdict, code, deciding_quote, route, role, platforms, object, review, review_body, review_quote, notes. RAT victim databases inside software hack packs; the analysed records are infected-device victims, not community members’ posts.
 
- `USENIX/2024/the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor`: OUT/broadcast;  → IN/collected; one-of-several. Fields: verdict, code, deciding_quote, route, role, platforms, object, notes. Telegram scraper citations [54–55] explicitly name telegram-channel-scraper/Telemetrio. Channel profiles and posts count; X/Instagram/YouTube feeds do not. No ethics fields newly inferred.
 
- `WWW/2023/a-prompt-log-analysis-of-text-to-image-generation-systems`: IN/reuse; main → IN/reuse; main. Fields: deciding_quote. The Midjourney dataset (usernames, user IDs, timestamps, prompts) was previously crawled from the Midjourney Discord server by a third party and reused here; this paper does no new collection or ethics discussion of its own.
 
## Checked source spans
The following deciding spans were read in surrounding source context and located verbatim after whitespace collapse. Unchanged IN quotes are retained; ellipsis-joined or mis-spaced quotes were replaced by actual contiguous spans where feasible. This checks inclusion evidence only, not all ethics quotes.
 
- `USENIX/2025/i-cannot-write-this-because-it-violates-our-content-policy-understanding-content` (paper.cols.txt):
  > We performed a keyword-based search in GAI online tool-related subreddits and then manually filtered out irrelevant posts, creating the final Reddit dataset for analysis.
 
- `IEEE-SP/2023/its-up-to-the-consumer-to-be-smart-understanding-the-security-and-privacy-attitu` (paper.cols.txt):
  > we conducted a qualitative content analysis of 4,957 Reddit comments in 180 security- and privacy-related discussion threads from /r/homeautomation, a major Reddit smart home forum
 
- `USENIX/2021/having-your-cake-and-eating-it-an-analysis-of-concession-abuse-as-a-service` (paper.cols.txt):
  > we performed an in-depth analysis of criminal communications on four popular underground forums, where we discovered 2,251 service providers of CAaaS scams
 
- `WWW/2022/identification-of-disease-or-symptom-terms-in-reddit-to-improve-health-mention-c` (paper.cols.txt):
  > we selected categories of subreddits where members are likely to discuss topics related to disease or symptom terms. We included 15 subreddits from the 3 domains of Daily, Fun, and Health. Using the PRAW API, we retrieved all available posts from these subreddits
 
- `PETS/2023/a-utility-preserving-obfuscation-approach-for-youtube-recommendations` (source PDF via pypdf):
  > For each user submission, we first extract the username and all YouTube links posted by this Reddit account.
 
- `WWW/2015/opinion-spam-detection-in-web-forum-a-real-case-study` (paper.cols.txt):
  > we conduct a real case study based on a set of internal records of opinion spams leaked from a shady marketing campaign. We explore the characteristics of opinion spams and spammers in a web forum
 
- `PETS/2022/understanding-privacy-related-advice-on-stack-overflow` (paper.cols.txt):
  > We collected 170 privacy-related posts on Stack Overflow created between April 2016 to April 2021 using Stack Exchange's API
 
- `WWW/2026/deepfakes-in-the-2025-canadian-election-prevalence-partisanship-and-platform-dyn` (paper.cols.txt):
  > Similar election-related queries were applied to Bluesky and Reddit using their respective public APIs, again filtering for posts that included attached media (for Reddit, using a set of subreddits).
 
- `CCS/2013/rethinking-ssl-development-in-an-appified-world` (paper.cols.txt):
  > We used stackoverflow.com, a popular online forum for software developers, to search for results that contained text such as "android/ios allow all certificates" and "android/ios trust all certificates"
 
- `USENIX/2025/from-meme-to-threat-on-the-hateful-meme-understanding-and-induced-hateful-conten` (source PDF via pypdf):
  > we manually select newly published and trending ones from Know Your Meme (KYM) [4] website and subreddit Bad Memes [3] by checking out the latest updates
 
- `IEEE-SP/2018/tracking-certificate-misissuance-in-the-wild` (paper.cols.txt):
  > We crawled the MDSP forum from the beginning of 2015 and searched for links to certificates that were misissued (e.g., a link to crt.sh). We
 
- `WWW/2019/self-and-cross-excitation-in-stack-exchange-question-answer-communities` (source PDF via pypdf):
  > Stack Exchange encompasses several Q&A communities, termed Stack Exchange instances, with each dedicated to Q&A on
 
- `IEEE-SP/2010/a-practical-attack-to-de-anonymize-social-network-users` (paper.cols.txt):
  > By directing our custom crawler to Xing, we could download the data of 6,574 groups containing more than 1.8 million unique members.
 
- `IEEE-SP/2026/behind-the-curtain-how-shared-hosting-providers-respond-to-vulnerability-notific` (source PDF via pypdf):
  > we identified companies by analyzing discussions on relevant Reddit communities (r/VPS, r/agency, r/webhosting, r/Hosting). Posts were selected if they discussed hosting
 
- `WWW/2019/hack-for-hire-exploring-the-emerging-market-for-account-hijacking` (paper.cols.txt):
  > Posing as buyers, we interacted with 27 English, Russian, and Chinese blackmarket services, only five of which succeeded in attacking synthetic (though realistic) identities we controlled.
 
- `WWW/2019/characterizing-speed-and-scale-of-cryptocurrency-discussion-spread-on-reddit` (source PDF via pypdf):
  > An archive of Reddit posts and comments is publicly available at https://files.pushshift.
 
- `WWW/2019/generalists-and-specialists-using-community-embeddings-to-quantify-activity-dive` (paper.cols.txt):
  > The data we used is publicly available and can be downloaded from pushshift.io
 
- `USENIX/2018/reading-thieves-cant-automatically-identifying-and-understanding-dark-jargons-fr` (paper.cols.txt):
  > we parsed the underground forum snapshots collected by the darknet marketplace archives programs and other research projects
 
- `IMC/2011/an-analysis-of-underground-forums` (source PDF via pypdf):
  > Each of these datasets has been acquired by unknown outside parties and made public (“leaked”) via various methods.
 
- `USENIX/2023/cryptographic-deniability-a-multi-perspective-study-of-user-perceptions-and-expe` (source PDF via pypdf):
  > we analyzed a thread [9] from moderncrypto.org—public forums for discussing modern cryptographic practice
 
- `IMC/2019/a-first-look-at-the-crypto-mining-malware-ecosystem-a-decade-of-unrestricted-wea` (paper.cols.txt):
  > we have analyzed a dataset of posts collected from various underground forums [21]
 
- `IEEE-SP/2025/analyzing-the-ios-local-network-permission-from-a-technical-and-user-perspective` (paper.cols.txt):
  > We limited our search to the most commonly used platforms for tech-related problems: Reddit, StackOverflow, and X
 
- `CCS/2020/impersonation-as-a-service-characterizing-the-emerging-criminal-infrastructure-f` (paper.cols.txt):
  > we collected a number of examples provided by users of ImpaaS.ru on a Telegram channel linked to the platform, to which we have gained access through ImpaaS.ru
 
- `NDSS/2019/cybercriminal-minds-an-investigative-study-of-cryptocurrency-abuses-in-the-dark-web` (paper.cols.txt):
  > The Community category represents Internet forums, where anyone can access and share diverse information.
 
- `IEEE-SP/2017/under-the-shadow-of-sunshine-understanding-and-detecting-bulletproof-hosting-on` (paper.cols.txt):
  > we scan underground forums for posts advertising BPH services and contact them for purchasing
 
- `IMC/2020/reading-in-between-the-lines-an-analysis-of-dissenter` (paper.cols.txt):
  > we crawled Dissenter for URLs that users comment on, the comments they made about those pages, as well as replies to other users' comments
 
- `PETS/2022/towards-improving-code-stylometry-analysis-in-underground-forums` (paper.cols.txt):
  > we also use data from the CrimeBB dataset, which contains data scraped from various underground forums
 
- `USENIX/2024/malla-demystifying-real-world-large-language-model-integrated-malicious-services` (paper.cols.txt):
  > we collected 13,353 listings from nine underground marketplaces and forums (i.e., Abacus Market, Kerberos Market, Kingdom Market, WeTheNorth Market, MGM Grand Market, Hack Forums, XSS.is, BreachForums, and BlackHatWorld)
 
- `WWW/2020/ten-social-dimensions-of-conversations-and-relationships` (paper.cols.txt):
  > A dataset containing the vast majority of the submissions and comments published on Reddit since 2007 is publicly available
 
- `USENIX/2025/bots-can-snoop-uncovering-and-mitigating-privacy-risks-of-bots-in-group-chats` (paper.cols.txt):
  > Our case studies used two datasets: DISCO [63] and Pushshift [10]. DISCO contains 1.5M Discord messages from 323.6K users across four groups
 
- `WWW/2024/getting-bored-of-cyberwar-exploring-the-role-of-low-level-cybercrime-actors-in-t` (paper.cols.txt):
  > 1 764 posts made by 372 users on Hack Forums mentioning the two countries, and 441 Telegram announcements (with 58k replies) of a volunteer hacking group
 
- `WWW/2021/short-is-the-road-that-leads-from-fear-to-hate-fear-speech-in-indian-whatsapp-gr` (paper.cols.txt):
  > we joined and monitored over 5,000 political groups discussing politics. From these groups, we obtained all the text messages, images, video and audio shared in the groups
 
- `CCS/2011/an-efficient-user-verification-system-via-mouse-movements` (paper.cols.txt):
  > For the field set, more than 1,000 unique forum users' • Angle of Curvature.
 
- `NDSS/2015/mind-your-blocks-on-the-stealthiness-of-malicious-bgp-hijacks` (source PDF via pypdf):
  > We check our candidate hijack cases against reported routing incidents in the archives of these two mailing lists
 
- `NDSS/2025/towards-understanding-unsafe-video-generation` (source PDF via pypdf):
  > 4chan is an anonymous platform where people post unsafe content, including sexual, violent, hateful, etc.
 
- `IEEE-SP/2023/blue-is-the-new-black-market-privacy-leaks-and-re-victimization-from-police-auct` (paper.cols.txt):
  > Owner was a member of a Telegram group chat that offers paid tutorials for committing fraud.
 
- `IEEE-SP/2016/users-really-do-plug-in-usb-drives-they-find` (paper.cols.txt):
  > a user posted on the university sub-Reddit attack's success rate, but we do find that by attaching keys to about finding multiple drives on campus and stated that they the drive, more users return the drives and that by providing reported the incident to an IT group.
 
- `IEEE-SP/2024/no-easy-way-out-the-effectiveness-of-deplatforming-an-extremist-forum-to-suppres` (source PDF via pypdf):
  > We have been scraping the two most active forums associated with online harassment for years due to their increasingly toxic content, as part of the
 
- `WWW/2019/to-return-or-to-explore-modelling-human-mobility-and-dynamics-in-cyberspace` (paper.cols.txt):
  > We first download all the user posts on Reddit from 2012 July to 2014 Dec.
 
- `PETS/2016/blogs-twitter-feeds-and-reddit-comments-cross-domain-authorship-attribution` (source PDF via pypdf):
  > The usernames were collected from users of the subreddit/r/twitter
 
- `PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri` (source PDF via pypdf):
  > identified seven core subreddits: r/military, r/army, r/USMC, r/navy, r/airforce, r/spaceforce, and r/uscg. We leveraged the PRAW API
 
- `USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s` (paper.cols.txt):
  > In total, our snapshot includes 1 704 relevant posts made by 714 active forum users.
 
- `WWW/2023/misbehavior-and-account-suspension-in-an-online-financial-communication-platform` (source PDF via pypdf):
  > with their corresponding social graphs, 4.2M historical article posts, and 5.3M comments, including information on nearly 4 000 suspended accounts and 17 000 removed comments.
 
- `USENIX/2024/moderating-illicit-online-image-promotion-for-unsafe-user-generated-content-game` (source PDF via pypdf):
  > This platform enabled our entry into a variety of Roblox game servers on Discord, leading to the discovery of 210 instances for
 
- `CCS/2010/testing-metrics-for-password-creation-policies-by-attacking-large-sets-of-reveal` (paper.cols.txt):
  > The majority of tests in this paper use passwords collected from the RockYou password list [6].
 
- `NDSS/2026/loki-proactively-discovering-online-scams-by-mining-toxic-search-queries` (paper.cols.txt):
  > The dataset is constructed by leveraging user-submitted reports from the popular subreddit /r/scams, which are subsequently verified by security experts who manually inspect and label live websites as scams.
 
- `WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms` (source PDF via pypdf):
  > we gathered data across X, Instagram, Facebook, Telegram, and YouTube using the formulated keywords.
 
- `PETS/2026/the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas` (paper.cols.txt):
  > We collected posts related to privacy and software development from the r/gdpr and r/europrivacy subreddits using the Python Reddit API Wrapper [5] in April 2025.
 
- `USENIX/2024/does-online-anonymous-market-vendor-reputation-matter` (paper.cols.txt):
  > We complement market data with social network features extracted from a OAM forum, and by qualitatively coding reputation signals from over 15,000 posts and comments across two subreddits.
 
- `IEEE-SP/2025/learning-from-censored-experiences-social-media-discussions-around-censorship-ci` (paper.cols.txt):
  > we tracked posts in more than 80 Telegram channels to identify and evaluate desktop and mobile executables, IP configuration files, etc., if they had instances of malicious behaviors.
 
- `USENIX/2026/stayin-alive-how-global-stolen-data-markets-thrive-on-telegram` (paper.cols.txt):
  > We collect data about the channels and their users, as well as messages and files shared within the channels.
 
- `WWW/2026/doxing-as-a-service-demystifying-the-chinese-online-doxing-ecosystem` (source PDF via pypdf):
  > Analyzing 25,972 messages and 13.22 million subscriber links from 100 major channels on Telegram, we demystify its organization, operations, and user engagement.
 
- `USENIX/2023/multiview-finding-blind-spots-in-access-deny-issues-diagnosis` (source PDF via pypdf):
  > issues from mailing lists [2, 8, 10, 11] and sysadmin online forums [1, 3, 4, 6, 7, 9].
 
- `NDSS/2026/mapping-the-cloud-a-mixed-methods-study-of-cloud-security-and-privacy-configuration-challenges` (paper.cols.txt):
  > we collected approximately 251,900 cloud-related security and privacy posts from Stack Overflow, spanning from August 2008 to March 2024.
 
- `WWW/2020/dark-matter-uncovering-the-darkcomet-rat-ecosystem` (paper.cols.txt):
  > To supplement our data set of downloaded DarkComet databases, we downloaded DarkComet hack packs from a combination of hacking forums and VirusTotal.
 
- `CCS/2010/dissecting-one-click-frauds` (paper.cols.txt):
  > We collect data from three public forums: 2 Channel BBS [5]: The largest bulletin board in Japan, which provides discussion threads on various topics ranging from Japanese anime to sports. Several ongoing threads are dedicated to exposing One Click Frauds.
 
- `IMC/2023/rovista-measuring-and-analyzing-the-route-origin-validation-rov-in-rpki` (paper.cols.txt):
  > we utilize the archive of the nanog mailing list and engage with network operators on the RPKI community discord channel [64].
 
- `USENIX/2024/the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor` (paper.cols.txt):
  > Using API services [10, 11, 54, 55, 78], we collected data related to social media profiles (e.g., name, description, profile picture, date of creation, account status, etc.) between May 2023 and October 2023.
 
- `USENIX/2016/investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa` (paper.cols.txt):
  > We tracked these conversations on blackhatworld.com and pay-per-install.com, enumerating over 50 commercial PPI affiliate programs that exclusively deal with Windows installs.
 
- `WWW/2023/a-prompt-log-analysis-of-text-to-image-generation-systems` (source PDF via pypdf):
  > The Midjourney dataset [39] is obtained by crawling message records from the Midjourney Discord community over a period of four weeks (June 20
 
 
## Limits and disagreements
No full ethics-field re-audit was attempted. Existing fields may have unsupported quotes or mistaken review scope; population audit is not certification of those fields. `no-easy-way-out` .cols is contaminated by unrelated WWW text, and `mind-your-blocks` .cols visibly splices a different paper; both verdicts were checked against their own PDF. Default pypdf font warnings were not evidence of a wrong PDF, but exact symbols/ligatures can still differ. OUT/CONTEXT existing classifications were screened from their current deciding evidence; most were not full-paper reread. No empty deciding_quote found. Full-corpus completeness cannot be established from these candidate batches.
 
Validation: all 130 JSONL lines parse; all deciding quotes nonempty; every IN has a valid route and role. After audit: IN 54; CONTEXT 9; OUT 67. Change summary: six IN→OUT, one OUT→IN, one direct-collection→reuse, role/platform corrections and contiguous quote repairs. Counts are this five-batch audit only.

Review-outcome extraction spot checks:

ethics_groups_review_spotchecks.txt

IEEE-SP/2024/no-easy-way-out-the-effectiveness-of-deplatforming-an-extremist-forum-to-suppres | extraction reviewOutcome=approved | section=ethics
QUOTE: Our work was formally approved by our institutional Ethics Review Board (ERB) for data collection and analysis.
Contiguous normalized cols check: NOT LOCATED; do not treat as certified quotation
 
USENIX/2020/the-tools-and-tactics-used-in-intimate-partner-surveillance-an-analysis-of-onlin | extraction reviewOutcome=exempt | section=ethics
QUOTE: Our IRB office reviewed the study and deemed it to not be human-subjects research, since all data was already in the public domain.
Contiguous normalized cols check: LOCATED
 
WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms | extraction reviewOutcome=not-required | section=ethics
QUOTE: Our research did not directly involve interaction with any human subjects, including scammers. We collected publicly available data from social media profiles using API queries.
Contiguous normalized cols check: NOT LOCATED; do not treat as certified quotation
 
WWW/2026/doxing-as-a-service-demystifying-the-chinese-online-doxing-ecosystem | extraction reviewOutcome=explicitly-discussed-no-review | section=discussion
QUOTE: Sensitive information was masked before storage and analysis, and no private or restricted groups were accessed.
Contiguous normalized cols check: LOCATED
 
IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e | extraction reviewOutcome=sought-outcome-unstated | section=ethics
QUOTE: All interactions were carried out using anonymized accounts. We refrained from engaging in conversations that could support or promote criminal activity, and we never made payments or provided resources.
Contiguous normalized cols check: LOCATED
 
CCS/2020/impersonation-as-a-service-characterizing-the-emerging-criminal-infrastructure-f | extraction reviewOutcome=none-mentioned | section=methodology
QUOTE: No personally identifiable information is reported in our dataset. IP addresses of victims are masked on the platform ... For obvious ethical concerns, we did not purchase any.
Contiguous normalized cols check: NOT LOCATED; do not treat as certified quotation
 
 
Additional spotcheck PETS/2026/no-privacy-for-privates-how-military-communities-experience-and-perceive-the-pri | approved
Our study was approved by our university's Institutional Review Board (IRB).
LOCATED as normalized cols span (not independent verification of outcome category).
 
Additional spotcheck WWW/2023/improving-health-mention-classification-through-emphasising-literal-meanings-a-s | not-required
Hence, ethical approval is not required for this research.
LOCATED as normalized cols span (not independent verification of outcome category).
 
Additional spotcheck WWW/2023/misbehavior-and-account-suspension-in-an-online-financial-communication-platform | none-mentioned
This work is licensed under a Creative Commons Attribution International 4.0 License.
LOCATED as normalized cols span (not independent verification of outcome category).

No material reviewer finding rejected. Optional numerical-cap expansion declined for the reason in the generic row. Reviewer contexts were explicitly marked potentially incomplete. Focused reviewers received full content/provenance drafts and report source/output, then fixes were sent back for recheck. Review notes are retained locally; table records findings/dispositions rather than pretending the reviewers verified unsupported hand ethics fields.

Final rechecks: figures output byte-identical after wording changes; currency corrections accepted and scoped PASS; citation wording and original-PDF approval PASS; generic passive-entry change PASS. No unresolved material review finding.

Shared bibliography saved at revision 1791456134, content at revision 1791456263, each with guarded –if-rev and required Authored by Claude summary. Content export is byte-identical to the reviewed draft. Live HTML has the entering_and_recording_online_groups anchor, bibtex_citekey inline markers, bibtex_references list, all three new citekeys and the provenance link. Provenance is saved subsequently with its own guarded revision; the final verification artifact records its cross-link check.

{
  "content_html_bytes": 230701,
  "section_anchor": true,
  "native_citekey_markers": true,
  "reference_list": true,
  "new_keys_rendered": {
    "beadle2025_privacy": true,
    "barbosa2019_privatechat": true,
    "franzke2020_aoir": true,
    "marjanov2026_stayin": true,
    "roy2025_darkgram": true
  },
  "provenance_link": true
}

No exhaustive recall estimate; no independently recoded broad-population component-specific approval, waiver or hosted-LLM percentage. Actual small/private-group consent practices need more direct examples before asserting a norm. We do not establish a universal size threshold, an ethical right to covert entry, regional legal exceptions or permissions for every platform. Those questions require a study-specific institutional process.

[1]

Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[2]

Akiwate, Gautam; Savage, Stefan; Voelker, Geoffrey M.; Claffy, Kimberly C. (2021): "Risky BIZness: risks derived from registrar name management", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Pauley, Eric; Sheatsley, Ryan; Hoak, Blaine; Burke, Quinn; Beugin, Yohan; McDaniel, Patrick D. (2022): "Measuring and Mitigating the Risk of IP Reuse on Public Clouds", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[4]

Zhang, Fenglu; Zhang, Yunyi; Liu, Baojun; Alowaisheq, Eihal; Ying, Lingyun; Li, Xiang; Zhang, Zaifeng; Liu, Ying; Duan, Haixin; Zhang, Min (2023): "Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[5]

Zhang, Yunyi; Zhang, Mingming; Liu, Baojun; Liu, Zhan; Zhang, Jia; Duan, Haixin; Zhang, Min; Shi, Fan; Xu, Chengxi (2024): "Cross the Zone: Toward a Covert Domain Hijacking via Shared DNS Infrastructure", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Szurdi, Janos; Christin, Nicolas (2017): "Email Typosquatting", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[7]

Kaleli, Beliz; Kondracki, Brian; Egele, Manuel; Nikiforakis, Nick; Stringhini, Gianluca (2021): "To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[8]

So, Johnny; Miramirkhani, Najmeh; Ferdman, Michael; Nikiforakis, Nick (2022): "Domains Do Change Their Spots: Quantifying Potential Abuse of Residual Trust", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Liu, Guannan; Jin, Lin; Hao, Shuai; Zhang, Yubao; Liu, Daiping; Stavrou, Angelos; Wang, Haining (2023): "Dial "N" for NXDomain: The Scale, Origin, and Security Implications of DNS Queries to Non-Existent Domains", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[10]

So, Johnny; Sanchez-Rola, Iskander; Nikiforakis, Nick (2025): "Lost in the Mists of Time: Expirations in DNS Footprints of Mobile Apps", in: Proceedings of the USENIX Security Symposium. (Link)

[11]

Hortea, Gabriel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Tapiador, Juan (2026): "Dead Domains, Living Data: A Privacy Risk Analysis of Domain Lifecycle in Android Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Lauinger, Tobias; Chaabane, Abdelberi; Buyukkayhan, Ahmet Salih; Onarlioglu, Kaan; Robertson, William (2017): "Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers", in: Proceedings of the USENIX Security Symposium. (Link)

[13]

Chen, Pinji; Chen, Jianjun; Zhang, Mingming; Wang, Qi; Zhang, Yiming; Xu, Mingwei; Duan, Haixin (2025): "Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[14]

franzke, aline shakti; Bechmann, Anja; Zimmer, Michael; Ess, Charles; of Internet Researchers, Association (2020): "Internet Research: Ethical Guidelines 3.0", Association of Internet Researchers (Technical report). (Link)

[15]

Barbosa, Sérgio; Milan, Stefania (2019): "Do Not Harm in Private Chat Apps: Ethical Issues for Research on and with WhatsApp", Westminster Papers in Communication and Culture 14(1):49-65. (DOI)