| |
| provenance:security:malicious_web_content [2026/10/08 12:10] – New provenance page for security:malicious_web_content (query log, verdicts, hand codes, checks, reviews). Authored by Claude karel.kubicek.claude | provenance:security:malicious_web_content [2026/10/08 12:16] (current) – Complete publication log, other pages, review log; post-snapshot PASS L. Authored by Claude karel.kubicek.claude |
|---|
| | Dates | **Two sittings.** 2026-09-27: research run (probes, 217 candidates, verdicts, reading notes on the IN papers, outside-venue and external research); it stopped before the page, this log, the reviews and the wiki edits — its own closing note was "Not published … none after 2023. All research notes done; page, provenance, reviews, wiki edits not done." 2026-10-08: this sitting, which re-derived every figure, re-checked the "none after 2023" finding, coded the IN papers, wrote, reviewed and published | | | Dates | **Two sittings.** 2026-09-27: research run (probes, 217 candidates, verdicts, reading notes on the IN papers, outside-venue and external research); it stopped before the page, this log, the reviews and the wiki edits — its own closing note was "Not published … none after 2023. All research notes done; page, provenance, reviews, wiki edits not done." 2026-10-08: this sitting, which re-derived every figure, re-checked the "none after 2023" finding, coded the IN papers, wrote, reviewed and published | |
| | Item | //security:malicious_web_content (new) — cryptojacking, exploit kits, malvertising, skimmers//, chosen by Karel in the 2026-09-22 gap pass | | | Item | //security:malicious_web_content (new) — cryptojacking, exploit kits, malvertising, skimmers//, chosen by Karel in the 2026-09-22 gap pass | |
| | Corpus | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 5,855 with ''paper.cols.txt''; 7 venues, 2010–2026; venue index ''data/corpus2/.meta'' 16,864 records in 117 venue-year files — **the snapshot every other page and [[literature:corpus]] use**. **The corpus grew during this sitting:** at 11:35 (file time) on 2026-10-08, 94 records were appended to ''extractions.jsonl'' (IMC 2026: 81; IEEE S&P 2024: 11, 2021: 1, 2023: 1; all ''extractedAt'' 2026-10-08) and ''IMC-2026.json'' (99 records, still being edited at 11:42) was added to the index. The first report run predates the change; the figures-vs-script reviewer found the script dying on its own 5,859 contract. All scripts are now **pinned** (''inSnapshot'', ''META_EXCLUDE'' in the fold): extraction records with ''extractedAt'' before 2026-10-08, index files other than ''IMC-2026.json''. The 94 are probed in report PASS L: **0** crosses any candidate threshold (six have a sub-threshold hit — SMS phishing, a Docker SoK, digital-sovereignty dependencies naming polyfill.io, a bandwidth-selling extension, post-quantum TLS, web accessibility) | | | Corpus | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 5,855 with ''paper.cols.txt''; 7 venues, 2010–2026; venue index ''data/corpus2/.meta'' 16,864 records in 117 venue-year files — **the snapshot every other page and [[literature:corpus]] use**. **The corpus grew during this sitting:** at 11:35 (file time) on 2026-10-08, 94 records were appended to ''extractions.jsonl'' (IMC 2026: 81; IEEE S&P 2024: 11, 2021: 1, 2023: 1; all ''extractedAt'' 2026-10-08) and ''IMC-2026.json'' (99 records, still being edited at 11:42) was added to the index. The first report run predates the change; the figures-vs-script reviewer found the script dying on its own 5,859 contract. All scripts are now **pinned** (''inSnapshot'', ''META_EXCLUDE'' in the fold): extraction records with ''extractedAt'' before 2026-10-08, index files other than ''IMC-2026.json''. At first the 94 were probed in report PASS L and **0** crossed a candidate threshold. By the time of publication the file held **105** added records (IMC 2026: 92); a re-run of PASS L found **one** crosser through the SCHEMA channel — //Honey Configs// (IMC 2026), whose section on content hosted under dangling-DNS names "would be IN": 55 (0.4%) of 13.5k names flagged by ≥ 3 VirusTotal scanners. It is verdicted in ''POST_VERDICTS'' (the report throws on any unverdicted crosser), named on the page under //Why nothing after 2023// and **not counted**. The other sub-threshold hits: SMS phishing, a Docker SoK, digital-sovereignty dependencies naming polyfill.io, a bandwidth-selling extension, post-quantum TLS, web accessibility | |
| | Page status | **New page**, the tenth child of ''security:''. ''sitemap.mjs'' on 2026-10-08: 199 pages, 0 promised-but-missing; no page or red link for this topic. Exported and read before writing: ''security'', ''security:online_scams'' and its provenance, ''security:phishing'', ''security:virustotal'', ''security:web_vulnerabilities'', ''security:domain_abuse'', ''security:headers'', ''privacy:javascript'', ''privacy:advertising'', ''programming:crawler_detection'', ''design:crawling_location''. None covers malicious content served to visitors; ''security:online_scams'' shares five papers (malicious ads and traffic-distribution systems whose landing pages mix malware and scams). Decision: **create**; no page to broaden | | | Page status | **New page**, the tenth child of ''security:''. ''sitemap.mjs'' on 2026-10-08: 199 pages, 0 promised-but-missing; no page or red link for this topic. Exported and read before writing: ''security'', ''security:online_scams'' and its provenance, ''security:phishing'', ''security:virustotal'', ''security:web_vulnerabilities'', ''security:domain_abuse'', ''security:headers'', ''privacy:javascript'', ''privacy:advertising'', ''programming:crawler_detection'', ''design:crawling_location''. None covers malicious content served to visitors; ''security:online_scams'' shares five papers (malicious ads and traffic-distribution systems whose landing pages mix malware and scams). Decision: **create**; no page to broaden | |
| | Models | Page, scripts, verdict changes, the post-2023 re-check and this log: Claude (Opus 5.5). 2026-09-27: candidate verdicts by the same model; reading notes on the IN papers by three ''sonnet'' sub-agents (''notes/mwc_papers_{A,B,C}.md''); external and outside-venue research by ''sonnet'' sub-agents (''notes/mwc_external.md'', ''notes/mwc_outside_{ab,cd,ef}.md''). 2026-10-08: hand codes by three ''sonnet'' coders, one per notes file, each told to check every justifying quote against the paper text (''notes/mwc_hand_{A,B,C}.md'', published below); a ''sonnet'' sub-agent for 2024–2026 industry and government sources (''notes/mwc_external_current.md''). Every external fact that reached the page was re-fetched by ''external_checks_mwc.sh''. Review layer: see //Review// | | | Models | Page, scripts, verdict changes, the post-2023 re-check and this log: Claude (Opus 5.5). 2026-09-27: candidate verdicts by the same model; reading notes on the IN papers by three ''sonnet'' sub-agents (''notes/mwc_papers_{A,B,C}.md''); external and outside-venue research by ''sonnet'' sub-agents (''notes/mwc_external.md'', ''notes/mwc_outside_{ab,cd,ef}.md''). 2026-10-08: hand codes by three ''sonnet'' coders, one per notes file, each told to check every justifying quote against the paper text (''notes/mwc_hand_{A,B,C}.md'', published below); a ''sonnet'' sub-agent for 2024–2026 industry and government sources (''notes/mwc_external_current.md''). Every external fact that reached the page was re-fetched by ''external_checks_mwc.sh''. Review layer: see //Review// | |
| ===== Quotes and figures checked against the papers ===== | ===== Quotes and figures checked against the papers ===== |
| |
| ''verify_mwc_figures.mjs'': **109** needles over 39 papers, each a sentence or clause carrying a figure or quote the page prints, looked up in ''paper.cols.txt'' → ''paper.norm.txt'' → ''paper.txt'' → a pypdf extraction, after folding (ligatures, dashes, quotes, thin-space and "6, 996"-style digit groups, a space after a slash). 108 located exactly, 1 only as ≥ 60% of its five-word windows (Nelms et al. 2016's AV sentence, split by a column; the page does not quote it). Three **mutation controls** — real needles with one digit changed — are rejected, so the lookup can fail. Five needles are under 20 characters and each is distinctive in its paper ("18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)"). | ''verify_mwc_figures.mjs'': **110** needles over 40 papers (the 39 and the post-snapshot IMC 2026 paper), each a sentence or clause carrying a figure or quote the page prints, looked up in ''paper.cols.txt'' → ''paper.norm.txt'' → ''paper.txt'' → a pypdf extraction, after folding (ligatures, dashes, quotes, thin-space and "6, 996"-style digit groups, a space after a slash). 109 located exactly, 1 only as ≥ 60% of its five-word windows (Nelms et al. 2016's AV sentence, split by a column; the page does not quote it). Three **mutation controls** — real needles with one digit changed — are rejected, so the lookup can fail. Five needles are under 20 characters and each is distinctive in its paper ("18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)"). |
| |
| Needles that needed care: Rozzle's "IP address/ subnet" and Revolver's "4, 147" are PDF-text artefacts the fold now repairs; TRIDENT's crawl sentence is split by a figure and is checked as two fragments; Vadrevu and Perdisci's denominator is a table row ("Total 2042 1.42% 16.21%"); Rüth et al.'s prevalence is "< 0.08%" and the page now prints the "<"; MINOS's 34 still-mining sites come from a malware collection "shared publicly on the 21st of April, 2020", which is what dates them; Kasturi et al. count plugin **installs**. | Needles that needed care: Rozzle's "IP address/ subnet" and Revolver's "4, 147" are PDF-text artefacts the fold now repairs; TRIDENT's crawl sentence is split by a figure and is checked as two fragments; Vadrevu and Perdisci's denominator is a table row ("Total 2042 1.42% 16.21%"); Rüth et al.'s prevalence is "< 0.08%" and the page now prints the "<"; MINOS's 34 still-mining sites come from a malware collection "shared publicly on the 21st of April, 2020", which is what dates them; Kasturi et al. count plugin **installs**. |
| |
| ''mwc_page_quotes_check.mjs'': every double-quoted span of 12+ characters on the page must sit inside a needle (corpus papers) or an external-check phrase (outside sources): 69 spans, 36 in needles, 29 in external phrases, 4 the page's own phrases ("No paper since 2023" and three others), 0 unbacked. | ''mwc_page_quotes_check.mjs'': every double-quoted span of 12+ characters on the page must sit inside a needle (corpus papers) or an external-check phrase (outside sources): 70 spans, 37 in needles, 29 in external phrases, 4 the page's own phrases ("No paper since 2023" and three others), 0 unbacked. |
| |
| ===== External sources ===== | ===== External sources ===== |
| * **A headline built on a selection.** "Blocklists miss most of it" was illustrated with the 14 papers where lists missed most, leaving out the four where a list or engine caught most — including the most recent paper (TRIDENT: Brave Shields missed 14.74%). Caught by the generic reviewer; the headline and table now show both sides. | * **A headline built on a selection.** "Blocklists miss most of it" was illustrated with the 14 papers where lists missed most, leaving out the four where a list or engine caught most — including the most recent paper (TRIDENT: Brave Shields missed 14.74%). Caught by the generic reviewer; the headline and table now show both sides. |
| * **TRIDENT credited with residential IPs.** The methods table listed TRIDENT under "screenshot clustering and residential IPs"; it clusters screenshots but crawled from Docker containers and states no vantage. Split into two rows. | * **TRIDENT credited with residential IPs.** The methods table listed TRIDENT under "screenshot clustering and residential IPs"; it clusters screenshots but crawled from Docker containers and states no vantage. Split into two rows. |
| | * **"None of the added records is a candidate" was true for an hour.** The first PASS L run (94 added records) found no crosser; by publication 105 had been added and one IMC 2026 paper crossed through SCHEMA. Caught by re-running the report after the collateral saves; the page was re-saved with the paper named and the 2026 zero called provisional twice over. |
| |
| ===== Publication sequence ===== | ===== Publication sequence ===== |
| | 1 | [[literature:bibliography]] — 20 entries appended to a fresh export (the sibling ''privacy:pii_leakage'' run had saved it minutes earlier) before ''%%</bibtex>%%''; key and title duplicate check against that export: none; cache purged | 1791460488 → 1791460607 | | | 1 | [[literature:bibliography]] — 20 entries appended to a fresh export (the sibling ''privacy:pii_leakage'' run had saved it minutes earlier) before ''%%</bibtex>%%''; key and title duplicate check against that export: none; cache purged | 1791460488 → 1791460607 | |
| | 2 | [[literature:bibliography]] — 2 more entries (''stringhini2013_shady'', ''borgolte2013_delta''), cited after the generic review; fresh export, duplicate check, cache purged | 1791460607 → 1791461302 | | | 2 | [[literature:bibliography]] — 2 more entries (''stringhini2013_shady'', ''borgolte2013_delta''), cited after the generic review; fresh export, duplicate check, cache purged | 1791460607 → 1791461302 | |
| | | 3 | [[security:malicious_web_content]] — new page | none → 1791461417 | |
| | | 4 | [[provenance:security:malicious_web_content]] — this page, first save | none → 1791461420 | |
| | | 5 | [[:security]] — tenth row; "nine" → "ten" in box, heading and methodology; intro names the topic | 1790305423 → 1791461429 | |
| | | 6 | [[security:online_scams]] — //Related pages// bullet | 1790286299 → 1791461433 | |
| | | 7 | [[privacy:javascript]] — //Related Pages// bullet | 1790001104 → 1791461436 | |
| | | 8 | [[security:headers]] — one sentence in the SRI section linking the polyfill.io worked example | 1789634319 → 1791461439 | |
| | | 9 | [[:roadmap]] — //Assessed// row | 1790526202 → 1791461442 | |
| | | 10 | [[provenance:roadmap]] — section 3h | 1790526204 → 1791461445 | |
| | | 11 | [[provenance:security]] — //Tenth child, 2026-10-08// with the re-run set check | 1790305489 → 1791461479 | |
| | | 12 | [[security:malicious_web_content]] — re-saved after the PASS L re-run found the IMC 2026 crosser (named, not counted) | see the page history | |
| | | 13 | this page, second save with this table and //Other pages// complete | see the page history | |
| | |
| | Checks after the saves: ''?purge=true'' on the bibliography and every page above. The rendered content page showed **37** reference entries for **37** distinct citekeys and **0** ''wikilink2'' (red link) spans; the same 0 for this page, [[:security]], [[security:online_scams]], [[privacy:javascript]], [[security:headers]], [[:roadmap]], [[provenance:roadmap]] and [[provenance:security]]. Cross-page anchors resolve: ''security:online_scams#which_methods_are_current'', ''security:phishing#google_safe_browsing'', and the link from [[security:headers]] to ''#worked_examplepolyfillio''. ''report_namespace_overviews.mjs'' printed ''security 10 10 equal'' and exited 1 only on corpus-frame guards (the extraction file grew to 5,964 records on 2026-10-08; not this page's doing). ''sitemap.mjs'': 0 promised-but-missing (its index is cached and did not yet list the new page). |
| |
| ===== Other pages touched in this sitting ===== | ===== Other pages touched in this sitting ===== |
| |
| //Filled in as the saves happen.// | * **[[:security]]** — tenth table row; "nine" → "ten" in the box, the table heading and the methodology paragraph, which now counts five hand-made populations; the intro names malicious content served to visitors. The namespace set check re-run after the save (see //Publication sequence//). The row prints 22 (not the draft's 23) papers reporting list or AV coverage. |
| | * **[[security:online_scams]]**, **[[privacy:javascript]]** — one //Related pages// bullet each. |
| | * **[[security:headers]]** — one sentence at the end of the SRI section pointing to the polyfill.io worked example. |
| | * **[[:roadmap]]** and **[[provenance:roadmap]]** — //Assessed// row and decision entry 3h. |
| | * **[[provenance:security]]** — //Tenth child, 2026-10-08// log entry. |
| | * **[[literature:bibliography]]** — 22 entries, in two saves. |
| | * Not edited: [[security:phishing]], [[security:virustotal]], [[programming:crawler_detection]], [[design:crawling_location]] — the new page links to them; they do not need a link back for the page to be reachable. |
| |
| ===== Review ===== | ===== Review ===== |
| |
| === PASS L — records added to the corpus on 2026-10-08, after this page's snapshot (probed, not counted) === | === PASS L — records added to the corpus on 2026-10-08, after this page's snapshot (probed, not counted) === |
| extraction records: 5953 in the file, 5859 in the snapshot (extractedAt < 2026-10-08), 94 added; by venue-year: IEEE-SP 2024 11, IEEE-SP 2021 1, IEEE-SP 2023 1, IMC 2026 81 | extraction records: 5964 in the file, 5859 in the snapshot (extractedAt < 2026-10-08), 105 added; by venue-year: IEEE-SP 2024 11, IEEE-SP 2021 1, IEEE-SP 2023 1, IMC 2026 92 |
| IEEE-SP 2024 gap 2 mine 0 drive 0 malv 0 skim 0 | On SMS Phishing Tactics and Infrastructure. | IEEE-SP 2024 gap 2 mine 0 drive 0 malv 0 skim 0 | On SMS Phishing Tactics and Infrastructure. |
| IEEE-SP 2024 gap 1 mine 1 drive 0 malv 0 skim 0 | SoK: A Comprehensive Analysis and Evaluation of Docker Container Attack and Defense Mechan | IEEE-SP 2024 gap 1 mine 1 drive 0 malv 0 skim 0 | SoK: A Comprehensive Analysis and Evaluation of Docker Container Attack and Defense Mechan |
| IMC 2026 gap 1 mine 0 drive 0 malv 0 skim 0 | Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment | IMC 2026 gap 1 mine 0 drive 0 malv 0 skim 0 | Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment |
| IMC 2026 gap 2 mine 2 drive 0 malv 0 skim 0 | The Long Road to Web Accessibility: Three Decades of Retrospective Analysis | IMC 2026 gap 2 mine 2 drive 0 malv 0 skim 0 | The Long Road to Web Accessibility: Three Decades of Retrospective Analysis |
| added records crossing any candidate threshold: 0 | IMC 2026 gap 0 mine 0 drive 0 malv 0 skim 0 SCHEMA <-- CROSSES A THRESHOLD; verdict: would be IN (section, injected): dangling-DNS names of legitimate domains serving attacker content; 55 (0.4%) of sampled hostnames flagged by >= 3 VirusTotal engines. Added to the corpus 2026-10-08, after the snapshot; named on the page, not counted | Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse |
| | added records crossing a candidate threshold without a POST_VERDICTS entry: 0; with one: 1 |
| </file> | </file> |
| |
| OK kharraz2019_outguard paper.cols.txt "had approximately 40% more coverage than MinerBlock" [list comparison] | OK kharraz2019_outguard paper.cols.txt "had approximately 40% more coverage than MinerBlock" [list comparison] |
| OK szurdi2021_where paper.cols.txt "miss the vast majority of malicious pages targeting mobile users" [mobile] | OK szurdi2021_where paper.cols.txt "miss the vast majority of malicious pages targeting mobile users" [mobile] |
| | OK (post-snapshot, footnote) paper.cols.txt "55 (0.4%) of the 13.5 k dangling DNS domains studied are flagged as malicious by" [post-snapshot IMC 2026 section] |
| mutant rejected: "Dr. Mine could only find 273 websites, while MineSweeper found 785 websites" | mutant rejected: "Dr. Mine could only find 273 websites, while MineSweeper found 785 websites" |
| mutant rejected: "up to 83% of thereby identified mining websites are not detected by block lists" | mutant rejected: "up to 83% of thereby identified mining websites are not detected by block lists" |
| needles under 20 characters: 6 — "18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)", "1,388 (11.31%)" | needles under 20 characters: 6 — "18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)", "1,388 (11.31%)" |
| |
| 109 needles over 39 papers: 108 exact, 1 partial (column splice), 0 FAILED | 110 needles over 40 papers: 109 exact, 1 partial (column splice), 0 FAILED |
| </file> | </file> |
| |
| external "against recent supply chain attacks" | external "against recent supply chain attacks" |
| external "simulating deployments on a representative sample of 450 domains" | external "simulating deployments on a representative sample of 450 domains" |
| | needle "55 (0.4%) of the 13.5 k dangling DNS domains studied are flagged as malicious by" |
| needle "relying only on pattern matching on the payload would result in 6.23% false negatives" | needle "relying only on pattern matching on the payload would result in 6.23% false negatives" |
| needle "for detection would result in 11.36% false negatives" | needle "for detection would result in 11.36% false negatives" |
| own "not shown to us" | own "not shown to us" |
| |
| 69 quoted spans; 0 not inside any needle or external phrase | 70 quoted spans; 0 not inside any needle or external phrase |
| </file> | </file> |
| |
| export const inSnapshot = (p) => p.extractedAt < SNAPSHOT_DATE; | export const inSnapshot = (p) => p.extractedAt < SNAPSHOT_DATE; |
| export const META_EXCLUDE = new Set(['IMC-2026.json']); | export const META_EXCLUDE = new Set(['IMC-2026.json']); |
| | // Post-snapshot records that cross a candidate threshold, read and verdicted but NOT counted on the page |
| | // (they are outside the snapshot every figure uses). The report throws on any crosser not listed here. |
| | export const POST_VERDICTS = { |
| | 'IMC/2026/honey-configs-measuring-the-emerging-exploitation-of-cloud-ip-address-reuse': 'would be IN (section, injected): dangling-DNS names of legitimate domains serving attacker content; 55 (0.4%) of sampled hostnames flagged by >= 3 VirusTotal engines. Added to the corpus 2026-10-08, after the snapshot; named on the page, not counted', |
| | }; |
| export const THRESH = { GAP: 5, MINE: 5, DRIVE: 5, MALV: 3, SKIM: 3 }; | export const THRESH = { GAP: 5, MINE: 5, DRIVE: 5, MALV: 3, SKIM: 3 }; |
| // Seventh channel, added 2026-10-08 when the "nothing after 2023" finding was re-checked: topic phrases over | // Seventh channel, added 2026-10-08 when the "nothing after 2023" finding was re-checked: topic phrases over |
