Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Provenance: security:malicious_web_content ======

Working log behind **[[security:malicious_web_content|Malicious web content: cryptojacking, exploit kits, malvertising and skimmers]]**. Corpus-wide caveats (venue coverage, the selection funnel, provisional venue-years) are on [[literature:corpus]] and are not restated here. Citations use the shared [[literature:bibliography]]; the 22 entries this run added are listed under //Bibliography// below and belong to the content page, not to this log. No ''~~DISCUSSION~~'' block: comments belong on the content page.

Voice here is a working log. It is read by somebody checking a number.

===== The run =====

^ Item ^ Value ^
| Dates | **Two sittings.** 2026-09-27: research run (probes, 217 candidates, verdicts, reading notes on the IN papers, outside-venue and external research); it stopped before the page, this log, the reviews and the wiki edits — its own closing note was "Not published … none after 2023. All research notes done; page, provenance, reviews, wiki edits not done." 2026-10-08: this sitting, which re-derived every figure, re-checked the "none after 2023" finding, coded the IN papers, wrote, reviewed and published |
| Item | //security:malicious_web_content (new) — cryptojacking, exploit kits, malvertising, skimmers//, chosen by Karel in the 2026-09-22 gap pass |
| Corpus | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 5,855 with ''paper.cols.txt''; 7 venues, 2010–2026; venue index ''data/corpus2/.meta'' 16,864 records in 117 venue-year files — **the snapshot every other page and [[literature:corpus]] use**. **The corpus grew during this sitting:** at 11:35 (file time) on 2026-10-08, 94 records were appended to ''extractions.jsonl'' (IMC 2026: 81; IEEE S&P 2024: 11, 2021: 1, 2023: 1; all ''extractedAt'' 2026-10-08) and ''IMC-2026.json'' (99 records, still being edited at 11:42) was added to the index. The first report run predates the change; the figures-vs-script reviewer found the script dying on its own 5,859 contract. All scripts are now **pinned** (''inSnapshot'', ''META_EXCLUDE'' in the fold): extraction records with ''extractedAt'' before 2026-10-08, index files other than ''IMC-2026.json''. At first the 94 were probed in report PASS L and **0** crossed a candidate threshold. By the time of publication the file held **105** added records (IMC 2026: 92); a re-run of PASS L found **one** crosser through the SCHEMA channel — //Honey Configs// (IMC 2026), whose section on content hosted under dangling-DNS names "would be IN": 55 (0.4%) of 13.5k names flagged by ≥ 3 VirusTotal scanners. It is verdicted in ''POST_VERDICTS'' (the report throws on any unverdicted crosser), named on the page under //Why nothing after 2023// and **not counted**. The other sub-threshold hits: SMS phishing, a Docker SoK, digital-sovereignty dependencies naming polyfill.io, a bandwidth-selling extension, post-quantum TLS, web accessibility |
| Page status | **New page**, the tenth child of ''security:''. ''sitemap.mjs'' on 2026-10-08: 199 pages, 0 promised-but-missing; no page or red link for this topic. Exported and read before writing: ''security'', ''security:online_scams'' and its provenance, ''security:phishing'', ''security:virustotal'', ''security:web_vulnerabilities'', ''security:domain_abuse'', ''security:headers'', ''privacy:javascript'', ''privacy:advertising'', ''programming:crawler_detection'', ''design:crawling_location''. None covers malicious content served to visitors; ''security:online_scams'' shares five papers (malicious ads and traffic-distribution systems whose landing pages mix malware and scams). Decision: **create**; no page to broaden |
| Models | Page, scripts, verdict changes, the post-2023 re-check and this log: Claude (Opus 5.5). 2026-09-27: candidate verdicts by the same model; reading notes on the IN papers by three ''sonnet'' sub-agents (''notes/mwc_papers_{A,B,C}.md''); external and outside-venue research by ''sonnet'' sub-agents (''notes/mwc_external.md'', ''notes/mwc_outside_{ab,cd,ef}.md''). 2026-10-08: hand codes by three ''sonnet'' coders, one per notes file, each told to check every justifying quote against the paper text (''notes/mwc_hand_{A,B,C}.md'', published below); a ''sonnet'' sub-agent for 2024–2026 industry and government sources (''notes/mwc_external_current.md''). Every external fact that reached the page was re-fetched by ''external_checks_mwc.sh''. Review layer: see //Review// |
| Scripts added | ''scripts/mwc_fold.mjs'' (probes, inclusion rule, 261 verdicts, hand codes, the post-2023 reading lists), ''scripts/report_malicious_web_content.mjs'' (+ ''-output.txt''), ''scripts/verify_mwc_figures.mjs'' (+ ''-output.txt''), ''scripts/external_checks_mwc.sh'' (+ ''-output.txt''), ''scripts/mwc_recent_probe.mjs'' (+ ''-output.txt''), ''scripts/mwc_screening_probe.mjs'' (+ ''-output.txt''), ''scripts/mwc_notes_quotecheck.mjs'' (+ ''-output.txt''), ''scripts/mwc_page_quotes_check.mjs'' (+ ''-output.txt''), ''scripts/bib_additions_malicious_web_content.bib'', ''scripts/build_provenance_malicious_web_content.py''. The 2026-09-27 draft report (''scripts/_mwc_draft_report.mjs'') and helpers (''_mwc_*.mjs'') are superseded and kept only as history |
| Guards run before publication | ''check_wrap.mjs'', ''check_tables.mjs'', ''check_typography.mjs'', ''check_wrapped_lists.py''; ''check_page_numbers.mjs'' windowed (//Use in publications// to //What to report//) and whole-page against the concatenation of the report, verifier, external-check, funnel and recent-probe outputs; ''check_attributions.mjs'' (8 table attributions match; the prose mode flagged three non-names — "WebAssembly", "ISP", "URL" — before a citation, false positives); citekey resolution (37 keys: 15 live before this run, 22 added) |
| Write path | ''node scripts/dw.mjs put'' (JSON-RPC) with ''%%--if-rev%%'' on every save; shared pages re-exported immediately before each save |
| Environment | ''pypdf'' was missing from the system Python this sitting; a private ''uv'' venv supplied it to ''scripts/pdftext.py'' for the PDF fallback of every quote check. Run the checkers with that venv first on ''PATH'' |
| Accidental exposure | None. Credentials stayed in ''.env''; no token was printed |

===== Scope and judgement calls =====

^ Decision ^ Why ^ What a reasonable person might have done instead ^
| **The object is content served to a visitor's browser, collected in the wild.** Detectors count only when evaluated on in-the-wild content | The page is for someone about to crawl. Lab-only defences, attack demonstrations and server-side malware are cited as context | Count every detector paper. Rejected: the population would then measure what the literature //proposed//, not what it //found// |
| **The line with ''security:online_scams'' is the destination.** A malicious-ad or redirect paper whose measured destinations include malware or forced downloads is IN here and may be IN there; one whose destinations are only scams is CONTEXT here | Five social-engineering ad and traffic-distribution papers measure both. Splitting them would leave the malvertising lineage on neither page | Assign each paper to one page. Rejected: the shared papers carry the vantage experiments both pages need |
| **EKHUNTER (NDSS 2015) moved from IN to CONTEXT on 2026-10-08** | Flagged by the 2026-09-27 reading agent and by this sitting's coder: it analyses leaked exploit-kit //server// code in a lab and attacks it; nothing served to a visitor is collected. Exploit papers 13 → 12; IN 40 → 39 | Keep it IN as exploit-kit measurement. Reasonable; declined because the rule's object is served content |
| **Host, router, IoT, CI and cloud mining are out** (CONTEXT ''host-mining'') | Item brief. They dominate the post-2021 //cryptojacking// vocabulary, which is why mention counts are shown beside the population, never as it | — |
| **Physical card skimmers are a homonym** (OUT): //Fear the Reaper// (USENIX 2018), //Kiss from a Rogue// (S&P 2019), //Please Pay Inside// (USENIX 2019) | They measure gas-pump hardware. The item brief asked for this check | — |
| **Search poisoning is IN only when its destinations deliver malware** (the three 2011 papers); later search abuse is CONTEXT | Same line as ''security:online_scams'', which files the 2011 papers as search-abuse context | — |
| **Two codes made stricter by the author** | CCS 2016 cloud repositories: "reported what a list caught" true → **false** (the coder flagged it as a stretch: 502 of 694 were confirmed by AV and lists, no missed-by-list figure). CCS 2018 CMTracker: window "2018-04" → **not stated** (taken from Table 2's report date; the crawl dates are not printed) | Keep the coders' values: 23 rather than 22 reported list coverage, 28 rather than 27 stated a window. (The first draft of the page printed 23 and 28 from a report run made **before** these overrides; the figures reviewer caught it — see //Review//.) |
| **Hand codes by three coders, one batch each; not double-coded** | 39 papers × 8 fields; each coder quotes the paper for every field. Several codes are marked borderline in the coders' FLAGS (published below) | Double-code a sample. Not done; the page says so |
| **Outside-venue papers only as footnotes, never in a count** (WasmGuard, LiMS, the FTC eCrime study, the post-Coinhive cryptojacking papers) | The corpus claims are about seven venues | Add them to the bibliography. Footnotes keep the bibliography to cited corpus papers |
| **The status column of the currency table rests on dated primary sources, not on the corpus** | The corpus cannot say whether a phenomenon is alive; vendor telemetry is labelled VENDOR on the page | Leave status out. Rejected: the item says currency is the point of the page |

===== Probes and the candidate set =====

Full-text probes run over ''paper.cols.txt'', whitespace-collapsed, paper-counted; the gap-pass regex is also run exactly as the gap pass ran it (''paper.norm.txt'', raw). Regexes are in ''mwc_fold.mjs'' below.

^ Probe ^ Threshold ^ Papers ^
| GAP (2026-09-22 gap-pass family ''malicious_web_content''), as run on ''paper.norm.txt'' | ≥ 5 | 124 (87 web, 70 crawled, 20 from 2024–2026) — reproduces the gap pass |
| GAP, same regex on ''paper.cols.txt'' | ≥ 5 | 138 |
| MINE, in-browser mining vocabulary | ≥ 5 | 25 |
| DRIVE, drive-by / exploit kit / honeyclient / malicious JavaScript | ≥ 5 | 81 |
| MALV, malvertising / malicious ads | ≥ 3 | 52 |
| SKIM, web skimming / Magecart / polyfill.io / script supply chain | ≥ 3 | 12 (and 32 with any hit, all read) |
| SCHEMA, the extraction's detection / classification / population free text | any | 84 |
| //Union of the six — the 2026-09-27 candidate set// | | //217// |
| INDEX, title + abstract over the whole venue index (added 2026-10-08) | any | 140 index records, 117 extracted; **44** not caught by any other channel |
| **Union = candidate set** | | **261** |

The 44 INDEX-only candidates were all read (verdicts in the fold, under "added 2026-10-08"); **none is IN**. Two papers that the 2026-09-27 run had cited from outside the candidate set (Subresource Integrity adoption, PHP web shells) became candidates through this channel and moved from ''EXTRA_CONTEXT'' into the verdict list.

===== The post-2023 question =====

The item and the 2026-09-27 note both said "none after 2023" and asked whether that is the field or the probes. Four checks, each with its script:

  - **Candidates by year** (report PASS J1). 47 of the 261 candidates are from 2024–2026: 0 IN, 28 CONTEXT, 19 OUT, each with a reason in the fold.
  - **Wider vocabularies, 2024–2026, outside the candidates** (''mwc_recent_probe.mjs''). 1,828 papers. WIDE (malicious scripts, iframes, redirects, compromised CDNs/libraries, watering hole, script supply chain, …) ≥ 5: 53; NEW (ClickFix, fake CAPTCHA, fake update, SocGholish, ClearFake, wallet drainers, SEO poisoning, search-ad malware, polyfill.io, fake installers, tech-support scams): 24; a title/summary match: 104. Every **web-platform** paper with WIDE ≥ 5 or any NEW hit — **32** — has a reading verdict (''RECENT_READ'' in the fold; the script exits if one is missing or stale): OUT 14, scams 8, phishing 4, vulnerabilities 2, and one each third-party risk, extension, attack demonstration, ads. **0 IN.** Three were read in full-text context because the title did not settle them: the PETS 2025 piracy-site tracking paper (malvertising and malware appear only in related work), the IMC 2025 drainer-as-a-service paper (phishing), and the USENIX 2026 indirect-prompt-injection paper ("in the wild" is the attack's deployment, not a census).
  - **The funnel** (''mwc_screening_probe.mjs'', report PASS J2). INDEX over all 16,864 snapshot records: 140 hits, of which 117 extracted, 21 screened out by the abstract classifier, 2 selected but never extracted, 0 without an abstract. Each of the 23 non-extracted hits has a note (''FUNNEL_NOTES''); 6 are on topic — //You are what you include// (CCS 2012, selected, no PDF), a Wasm-mining detector poster (CCS 2019), MineThrottle (TheWebConf 2020), and from 2025 WasmGuard, LiMS and //Beast in the Cage//, all three defences. LiMS's abstract was fetched from arXiv and WasmGuard's from its dataset README; neither collects malicious content in the wild, so neither would be IN.
  - **Outside the venues.** The 2026-09-27 sub-agents swept 2019–2026 (notes ''mwc_outside_{ab,cd,ef}.md''): post-Coinhive cryptojacking 5 papers (ICICT 2020, RAID 2022, a EuroS&P 2021 SoK, TDSC 2024, WISA 2024); web skimming 3 (eCrime 2020 FTC study, SECRYPT 2023 / Computers & Security 2024, IEEE NCA 2025); malvertising 2022–2026 5 (ICWE 2024, IEEE CCWC 2023 — read from the authors' poster, Xplore refused —, EuroS&P 2026, Scientific Reports 2026, PAM 2022); exploit kits 2021–2026 **none** (DIMVA 2022–2025, RAID 2024, ACSAC 2022–2024, ESORICS 2022–2024, PAM 2021–2025 programmes checked). The ones the page names were re-fetched by the external script on 2026-10-08.

**Conclusion recorded on the page:** exploit kits and in-browser mining ended as mass phenomena and the literature's decline tracks them; malvertising, skimming, compromised-site injects and third-party script compromise did not end (government, standards-body and vendor sources through 2026), and the venues' recent work in this neighbourhood is scams, phishing, drainers, registry packages and LLM-system attacks. The funnel lost three 2025 defence papers on the topic, none a census. 2024 is firm; 2025–2026 provisional.

===== Queries, with their denominators =====

Every corpus figure on the page, the query behind it, and its population. The printed values are in the report output below.

^ Figure on the page ^ Query ^ Population / denominator ^
| 261 candidates; IN 39 (14.9%: 36 primary, 3 section); CONTEXT 108 by code; OUT 114 by code | PASS A union; PASS B verdicts | 261 candidates |
| probe precision and recall table | PASS B | hits of each probe; recall of the 39 |
| gap pass 124 / 87 web / 70 crawled / 20 recent; none of the 20 IN; 44 INDEX-only, 0 IN | PASS A, PASS B, PASS J2 | 5,859 papers (norm); 117 extracted INDEX hits |
| 38 web, 33 crawled | PASS C | 39 IN |
| year buckets, types, venues, per-thousand rates | PASS C (''YEAR_BUCKETS'' from ''lib.mjs'') | 39 IN; corpus papers per bucket; last bucket starred |
| type spans (exploit 12, 2010–2015; mining 8, 2018–2021; malvertising 6, 2012–2023; injected 6, 2013–2022; search 3, 2011; downloads 2; redirect systems 2; skimming 0) | PASS C "By type" | 39 IN |
| detector, ground truth, visits, vantage, cloaking counts and era columns; 22 reported list or AV coverage; 27 stated a window, lag 0–2 years, median 1; latest data 2022 | PASS D over ''HAND'' | 39 IN, hand-coded |
| 26 active-visit papers: 13 single-visit, 18 vantage not stated, 12 cloaking not discussed | PASS D | the 26 IN papers coded single / repeated / multi-config |
| ethics 2 / 26 / 1 / 1 / 9 no record; notified 5 / 3 / 2 / 20 / 9 | PASS E | 39 IN; ''null'' objects counted separately |
| released 11 public / 2 promised / 1 on request / 23 none / 2 no record | PASS E ''artifacts.availability'' | 39 IN |
| LLM: 0 of 39 IN, 5 of 108 CONTEXT; corpus 2/719, 27/690, 77/770, 71/415 | PASS E ''classification[].method == 'llm''' | IN; CONTEXT; papers per year |
| 47 recent candidates (0 / 28 / 19) | PASS J1 | 261 candidates |
| 1,828 / 32 must-read / verdict heads | PASS J3, ''mwc_recent_probe.mjs'' | 2024–2026 papers outside the candidates |
| 16,864 records; 23 never extracted; 6 on topic; 3 from 2025 | PASS J2, ''mwc_screening_probe.mjs'' | the INDEX hits in the venue index |
| named-phenomenon mentions per year (cryptojack*, coinhive, …) | PASS J4 | papers per year with ''paper.cols.txt'' |
| 5 IN here and on ''security:online_scams'' | PASS H, against ''scam_fold.mjs'' | 39 IN |

PASS K lists the artifact links the extraction recorded for the IN papers. Its count line is labelled as **not** a release rate (the links include third-party URLs such as tool homepages); the page uses ''artifacts.availability'' instead.

===== Hand verdicts and hand codes =====

The 261 verdicts carry a reason each (''VERDICTS'' in the fold; CONTEXT also printed in PASS G). The 217 from 2026-09-27 were made from title, extraction summary and probe-hit snippets, with the borderline ones read in context (listed in the 2026-09-27 log: Tales from the Porn, Vadrevu 2019, TRIDENT, the TDS paper, push ads, the Wasm census, WordPress plugins, DOITRUST, CyberProbe, Betrayed, the chain-of-trust paper, click interception, children's sites, self-deleting JavaScript, SURF, Fashion crimes, deSEO). The 44 INDEX-only candidates were verdicted on 2026-10-08 from title, abstract and summary, with two read in context (network-operator content injection; the notification-campaign paper, which turned out to be about Google Analytics settings).

**Hand codes** (''HAND'' in the fold) were made on 2026-10-08 by three ''sonnet'' coders, one per reading-notes file, from the notes and the papers' full text, with a closed vocabulary and the instruction to pick the conservative value when unsure. Their files — rows, a justifying quote per field checked against ''paper.cols.txt'', a digest and FLAGS per paper — are published below. The coders report all 40 full texts readable. Coder A: 91 quotes verbatim and 32 found only in parts across column splices; coder B gave no total, marking a few column-spliced quotes and two WebAssembly-paper phrases that the PDF text mangles; coder C: about 14 partial, none unfound, and two notes quotes it could not find were dropped. The author then changed two codes (see //Scope//) and dropped EKHUNTER's row.

The reading notes from 2026-09-27 are **not** published. ''mwc_notes_quotecheck.mjs'' (output below) located **984 of 1,111** double-quoted spans of 25+ characters in the papers' renderings (101 of them only as ≥ 60% of five-word windows, i.e. across a column splice). Of the 127 not located, the ones read by hand are mostly the regex pairing a quotation mark that closes one quote with the next one's opening (text //between// two quotes) and table rows paraphrased into a sentence; the rest were not individually checked. The page therefore relies on the notes for nothing: every page figure is a needle checked against the paper, and every code has the coder's own checked quote.

===== Quotes and figures checked against the papers =====

''verify_mwc_figures.mjs'': **110** needles over 40 papers (the 39 and the post-snapshot IMC 2026 paper), each a sentence or clause carrying a figure or quote the page prints, looked up in ''paper.cols.txt'' → ''paper.norm.txt'' → ''paper.txt'' → a pypdf extraction, after folding (ligatures, dashes, quotes, thin-space and "6, 996"-style digit groups, a space after a slash). 109 located exactly, 1 only as ≥ 60% of its five-word windows (Nelms et al. 2016's AV sentence, split by a column; the page does not quote it). Three **mutation controls** — real needles with one digit changed — are rejected, so the lookup can fail. Five needles are under 20 characters and each is distinctive in its paper ("18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)").

Needles that needed care: Rozzle's "IP address/ subnet" and Revolver's "4, 147" are PDF-text artefacts the fold now repairs; TRIDENT's crawl sentence is split by a figure and is checked as two fragments; Vadrevu and Perdisci's denominator is a table row ("Total 2042 1.42% 16.21%"); Rüth et al.'s prevalence is "< 0.08%" and the page now prints the "<"; MINOS's 34 still-mining sites come from a malware collection "shared publicly on the 21st of April, 2020", which is what dates them; Kasturi et al. count plugin **installs**.

''mwc_page_quotes_check.mjs'': every double-quoted span of 12+ characters on the page must sit inside a needle (corpus papers) or an external-check phrase (outside sources): 70 spans, 37 in needles, 29 in external phrases, 4 the page's own phrases ("No paper since 2023" and three others), 0 unbacked.

===== External sources =====

^ Source ^ Used for ^ How verified ^
| Coinhive blog, 2019-02-26 (Wayback copy of 2019-02-27) | mining row: "discontinue our service on March 8, 2019", hash-rate drop after the Monero fork | re-fetched; the live site is gone |
| Adobe Flash EOL FAQ (Wayback copy of 2020-05-16); chromium.org Flash roadmap; Mozilla 2020-11-17 post | exploit-kit row | re-fetched; adobe.com timed out from here, so the Wayback copy of Adobe's own page is used |
| Microsoft Tech Community IE11 retirement FAQ | exploit-kit row: IE11 desktop app disabled 2023-02-14 | re-fetched |
| ThreatDown (Malwarebytes) 2023-08-11 | exploit-kit row: RIG still used in 2023 | re-fetched; vendor telemetry, labelled |
| Proofpoint, BlueMoon, 2026-09-09 | exploit-kit row | re-fetched; vendor |
| Google Threat Intelligence Group, //Coruna//, 2026-03-03 | exploit-kit row: an iOS kit served via hidden iframes on compromised and fake sites in 2025 | found by the external-currency reviewer; re-fetched by the author and four phrases added to the external script |
| Mozilla 2019-09-03 post; chromestatus feature 4800491902992384 | mining row: Firefox blocks miners by default; Chrome Heavy Ad Intervention thresholds | re-fetched (chromestatus via its JSON API) |
| c/side, 2025-07-17 (updated 2026-07-20) | mining row: 3,500+ sites | re-fetched; single vendor, labelled "not independently confirmed" |
| GitHub API: ''keraf/NoCoin'', ''hoshsadiq/adblock-nocoin-list''; CoinBlockerLists ''info.txt'' and the ''AstroMash'' mirror README | detection section: list status | API and fetch in the external script. The 2024 date of the CoinBlockerLists suspension is the mirror's (secondary); the maintainer's statement is undated, and the page says so |
| Cloudflare 2024-02-29 and 2024-06-26; Sansec 2024-06-25; Censys 2024-07-02; US Treasury sb0149 (2025-05-29) | polyfill.io section | re-fetched. The Namecheap hold is sourced to Sansec's update line — no Namecheap statement was found. Censys counts hosts, and the page says so. Andrew Betts's February 2024 post was **not** used: its text could not be fetched from X or the Wayback copy |
| PCI SSC blog (2025-01-30 SAQ A update; 2025-03-10 e-skimming supplement) | skimming row, polyfill.io section | re-fetched. The literal requirement text is in a gated PDF (403); the page quotes the Council's own blog |
| Sansec 2026-04-07 | skimming row | re-fetched; vendor |
| FTC eCrime 2020 PDF | skimming row (outside corpus) | re-fetched, pypdf text, two phrases |
| CISA/FBI AA25-203A; Microsoft 2025-08-21 (ClickFix); Proofpoint 2025-06-16 (ClearFake); Europol 2026-06-24; operation-endgame.com news | injected-scripts row | re-fetched; CISA and Europol with Playwright (curl is refused) |
| Microsoft 2025-03-06; Malwarebytes 2024-10-07 | malvertising row | re-fetched; vendor |
| Safe Browsing v4 overview; v4→v5 migration guide | blocklist section: v4 deprecated; "60% of sites that deliver attacks live less than 10 minutes" | re-fetched |
| arXiv 2509.14583 (LiMS), WasmMal README (WasmGuard), arXiv 2408.03426, 2001.02975, 2110.11241, 2404.14190 | the post-2023 section (outside corpus) | abstracts re-fetched |
| GitHub API for the population's artifacts (MineSweeper, Outguard, SEACMA, TRIDENT, CMTracker, ODIN, WasmBench, WasmMal); Zenodo DOI of Rüth et al. | //What the 39 papers did// | API and DOI resolution |

**Rejected or not used, and why** (from both sittings):

^ Source ^ Why not ^
| Andrew Betts's polyfill.io warning (X, 2024-02) | text not fetchable (login wall; the Wayback capture is an app shell). Quoted only in news; not used |
| A Namecheap statement on the polyfill.io hold | none found; Sansec's update line is the only first-hand record |
| PCI DSS v4.0.1 standard PDF | gated (403); the Council's blog is used for the requirement summary |
| The Hacker News on RIG/PRODAFT 2023 (45% CVE-2021-26411) | news rewrite of a vendor report whose original was not fetched; ThreatDown's own post covers 2023 activity |
| Google 2025 Ads Safety Report | gives no malware count for ads; "Malware or Unwanted Software 2M+" is in the publisher-pages table. Not used |
| ESET "+517% ClickFix", "33,290 compromised sites in 2025" | seen only in search summaries; never fetched |
| Red Canary SocGholish page | prints no publication date; Europol and Operation Endgame used instead |
| News rewrites (thehackernews, bleepingcomputer, securityweek and others) and secondary BlueMoon write-ups | secondary to the vendors and agencies cited |
| Two ARES cryptojacking-evasion papers (2022, 2024) | ACM pages refused automated fetches; not cited |
| "PoT: Proof-of-Theft", DNS-based cryptojacking detection, CryptoGuard, CryptoCatch preprints | no confirmed venue, or not in-browser |
| Two IC3/CyberCon 2025 polyfill.io papers | a case study and a lab simulation, not measurements |
| ICCS 2025 and WEBIST 2024 LLM malicious-page papers, SocketAI, CASCADE, CASHEWS | LLM detection outside the venues; the page names SocketAI and CASCADE once as context for the LLM row and counts none |
| British Airways ICO penalty notice (2020) | verified in the first sitting; not needed for a methods page and not re-fetched, so not cited |

===== What could not be established =====

  * **Whether the funnel's false negatives go beyond the INDEX phrases.** The title-plus-abstract probe only finds papers that use its vocabulary; abstract screening's false-negative rate is unmeasured corpus-wide ([[literature:corpus]]).
  * **Whether in-browser mining revived in 2025.** One vendor's telemetry; no second source found.
  * **Prevalence of ClickFix, fake-update and skimmer injects on the web.** Vendors and agencies report campaigns and remediation counts, not a prevalence over a defined population.
  * **Double-coding.** Each paper was coded by one coder.
  * **The CCWC 2023 malvertising paper's abstract** was read from the authors' poster, not IEEE Xplore.
  * **Mass-market plug-in exploit kits after 2023.** No primary source found for RIG, Magnitude or similar after 2023; absence of a report is not absence of the kit. Browser-engine kits are documented (Coruna, BlueMoon); how widely they are served is not.

===== Mistakes caught during the run =====

  * **EKHUNTER as IN.** The 2026-09-27 verdicts had it IN; its own reading agent and this sitting's coder both flagged that it analyses exploit-kit server code in a lab. Moved to CONTEXT (''ecosystem'', redefined to "exploit-kit server code, exploit trade and underground markets"); every IN figure was re-derived after the move (40 → 39, exploit 13 → 12).
  * **The draft report ran with the hand-code guard disabled** (''if (false) die(…)'' in ''_mwc_draft_report.mjs''), so it printed zeros for every method table. The published script throws if an IN paper lacks a code.
  * **The venue-index size.** The report's first contract was 16,864 (the figure on [[literature:corpus]]); it failed on 16,963, because ''IMC-2026.json'' was added to the index on 2026-10-08, and was briefly changed to 16,963. After the figures reviewer found the extraction file had grown too (5,953 records), every script was pinned to the 16,864-record / 5,859-paper snapshot, with ''IMC-2026.json'' excluded and the 94 new records probed in PASS L. The draft of this bullet still said "now asserts 16,963" when the generic reviewer read it.
  * **A "post-2023" claim built on vocabulary alone.** The first draft of the J4 table read as if //cryptojacking// had stopped being written about; the counts show 7–10 papers a year through 2025. The page now says the words persist and the measurements stopped, and explains why (host, router, CI and IoT mining, and citations).
  * **Reading-note quotes.** ''mwc_notes_quotecheck.mjs'' first reported 868 of 1,180 located: pypdf was missing (the PDF fallback crashed), and the span regex paired the closing quotation mark of a short quote with the next quote's opening. With pypdf restored, every quotation-mark pair tokenised, and a partial (five-word window) rule like ''quote_check.mjs'''s, 984 of 1,111.
  * **Page wording corrected against the papers before review:** MineSweeper's 785 is its detector's count, not a WebAssembly-only one; Kasturi et al. count plugin //installs// on backups of over 400K WordPress sites (not "eight years of one host's backups"); Rüth et al.'s prevalence is "< 0.08%"; the FTC study //attempted// purchases with one unique card per site; MINOS's 34 sites date from a malware collection shared in April 2020, not a "2020 re-check"; the outside-venue exploit-kit search covered programmes for 2021–2025, not 2021–2026; the CoinBlockerLists suspension year comes from a mirror README.
  * **Short needles.** Five needles first matched bare numbers ("5,143", "6,601", "34 unique websites", "1.42%", "991,513"); each was lengthened to its sentence or table row, and three mutation controls were added.
  * **A headline built on a selection.** "Blocklists miss most of it" was illustrated with the 14 papers where lists missed most, leaving out the four where a list or engine caught most — including the most recent paper (TRIDENT: Brave Shields missed 14.74%). Caught by the generic reviewer; the headline and table now show both sides.
  * **TRIDENT credited with residential IPs.** The methods table listed TRIDENT under "screenshot clustering and residential IPs"; it clusters screenshots but crawled from Docker containers and states no vantage. Split into two rows.
  * **"None of the added records is a candidate" was true for an hour.** The first PASS L run (94 added records) found no crosser; by publication 105 had been added and one IMC 2026 paper crossed through SCHEMA. Caught by re-running the report after the collateral saves; the page was re-saved with the paper named and the 2026 zero called provisional twice over.

===== Publication sequence =====

Every save used ''dw.mjs put'' with ''%%--if-rev%%'' set to the revision read just before it; shared pages were re-exported immediately before their save. Times are UTC, 2026-10-08.

^ Step ^ Page ^ Revision before → after ^
| 1 | [[literature:bibliography]] — 20 entries appended to a fresh export (the sibling ''privacy:pii_leakage'' run had saved it minutes earlier) before ''%%</bibtex>%%''; key and title duplicate check against that export: none; cache purged | 1791460488 → 1791460607 |
| 2 | [[literature:bibliography]] — 2 more entries (''stringhini2013_shady'', ''borgolte2013_delta''), cited after the generic review; fresh export, duplicate check, cache purged | 1791460607 → 1791461302 |
| 3 | [[security:malicious_web_content]] — new page | none → 1791461417 |
| 4 | [[provenance:security:malicious_web_content]] — this page, first save | none → 1791461420 |
| 5 | [[:security]] — tenth row; "nine" → "ten" in box, heading and methodology; intro names the topic | 1790305423 → 1791461429 |
| 6 | [[security:online_scams]] — //Related pages// bullet | 1790286299 → 1791461433 |
| 7 | [[privacy:javascript]] — //Related Pages// bullet | 1790001104 → 1791461436 |
| 8 | [[security:headers]] — one sentence in the SRI section linking the polyfill.io worked example | 1789634319 → 1791461439 |
| 9 | [[:roadmap]] — //Assessed// row | 1790526202 → 1791461442 |
| 10 | [[provenance:roadmap]] — section 3h | 1790526204 → 1791461445 |
| 11 | [[provenance:security]] — //Tenth child, 2026-10-08// with the re-run set check | 1790305489 → 1791461479 |
| 12 | [[security:malicious_web_content]] — re-saved after the PASS L re-run found the IMC 2026 crosser (named, not counted) | see the page history |
| 13 | this page, second save with this table and //Other pages// complete | see the page history |

Checks after the saves: ''?purge=true'' on the bibliography and every page above. The rendered content page showed **37** reference entries for **37** distinct citekeys and **0** ''wikilink2'' (red link) spans; the same 0 for this page, [[:security]], [[security:online_scams]], [[privacy:javascript]], [[security:headers]], [[:roadmap]], [[provenance:roadmap]] and [[provenance:security]]. Cross-page anchors resolve: ''security:online_scams#which_methods_are_current'', ''security:phishing#google_safe_browsing'', and the link from [[security:headers]] to ''#worked_examplepolyfillio''. ''report_namespace_overviews.mjs'' printed ''security 10 10 equal'' and exited 1 only on corpus-frame guards (the extraction file grew to 5,964 records on 2026-10-08; not this page's doing). ''sitemap.mjs'': 0 promised-but-missing (its index is cached and did not yet list the new page).

===== Other pages touched in this sitting =====

  * **[[:security]]** — tenth table row; "nine" → "ten" in the box, the table heading and the methodology paragraph, which now counts five hand-made populations; the intro names malicious content served to visitors. The namespace set check re-run after the save (see //Publication sequence//). The row prints 22 (not the draft's 23) papers reporting list or AV coverage.
  * **[[security:online_scams]]**, **[[privacy:javascript]]** — one //Related pages// bullet each.
  * **[[security:headers]]** — one sentence at the end of the SRI section pointing to the polyfill.io worked example.
  * **[[:roadmap]]** and **[[provenance:roadmap]]** — //Assessed// row and decision entry 3h.
  * **[[provenance:security]]** — //Tenth child, 2026-10-08// log entry.
  * **[[literature:bibliography]]** — 22 entries, in two saves.
  * Not edited: [[security:phishing]], [[security:virustotal]], [[programming:crawler_detection]], [[design:crawling_location]] — the new page links to them; they do not need a link back for the page to be reachable.

===== Review =====

Four reviewers, each told that the author's context might not be exhaustive and each handed the page, this log's draft, the report script with its unedited output, the verifier, the funnel and recent probes, the external-check script with its output, the fold module and the coders' files. The three focused passes ran in parallel on the first complete draft, before publication; every accepted fix was applied and the report, verifier, external checks and guards re-run before the generic pass. Findings files (workdir): ''notes/mwc_review_figures.md'', ''notes/mwc_review_citations.md'', ''notes/mwc_review_external.md'', ''notes/mwc_review_generic.md''.

^ Reviewer ^ Finding ^ Action ^
| figures-vs-script (sonnet) | **F-01 (defect).** The page printed 23 papers reporting list/AV coverage and 28 stating a window; the report prints 22 and 27. The draft took both from a report run made //before// the author's two stricter overrides | **Accepted.** 22 and 27 on the page, the namespace row and this log; the //Scope// row now says which way the overrides moved the counts |
| figures-vs-script (sonnet) | **F-02 (defect).** "Block lists missed up to 82% of the mining sites one zone-file scan found": in Rüth et al.'s Table 2 the 82% is the Alexa row, the .org zone row is 67% (also citations C1) | **Accepted.** Reworded with both rows; both table rows are now needles |
| figures-vs-script (sonnet) | **F-03 (defect).** The CONTEXT breakdown ended "other 8" and summed to 104, not 108 | **Accepted.** All eight remaining codes listed (12 papers) |
| figures-vs-script (sonnet) | F-04: "8 scams, 4 phishing, 14 unrelated" covers 26 of the 32 must-read papers | **Accepted.** The six other context papers named |
| figures-vs-script (sonnet) | F-05: the currency table said "0 measurement papers" for third-party script compromise, but two IN papers measure malicious third-party resources (click-intercepting scripts, cloud buckets) | **Accepted.** Row now names both and says none measures a trusted library changing owner |
| figures-vs-script (sonnet) | F-06: "13 visited each site once" counts two papers whose single visit is only implied | **Accepted** as wording ("as far as the paper says (two of them only by implication)"); codes unchanged |
| figures-vs-script (sonnet) | F-07: the 26 "active-visit" papers are 25 crawls plus CyberProbe, a server scanner | **Accepted.** Said on the page |
| figures-vs-script (sonnet) | F-08: Subramani's "less than 1%" is a share of all landing URLs (also C3) | **Accepted.** Row rewritten with the population and the 11.31% month-later figure |
| figures-vs-script (sonnet) | **F-09 (reproducibility).** The corpus grew to 5,953 records during the sitting; the report died on its own contract; the funnel output was stale (16,864 vs 16,963) | **Accepted.** All scripts pinned to the 5,859 / 16,864 snapshot; report PASS L probes the 94 new records (0 cross a threshold); the page and the //Run// table say so; outputs regenerated |
| figures-vs-script (sonnet) | F-11: "card-skimmer homonym 5" — three are card skimmers | **Accepted.** "card skimmers and card scanning (homonyms) 5" |
| figures-vs-script (sonnet) | F-12: ''RECENT_READ'' keyed by slug only; the lag median is the upper median for even //n//; the ClickFix vocabulary is narrow | **Noted, not changed.** Slugs are unique within 2024–2026; the median is printed as computed (n=27, odd, after F-01); the vocabulary is published with the script |
| figures-vs-script (sonnet) | F-13: several per-paper figures had no needle (all true when checked by hand) | **Accepted in part.** Needles added for every figure touched in this review (now 104) |
| figures-vs-script (sonnet) | Checked correct: every PASS A–I figure the page uses, the named-phrase table, ''HAND'' row for row against the coders' blocks (bar the documented overrides), nine hand rows against justifications and five against paper text | — |
| citations-and-quotes (sonnet) | All 35 keys resolve; no collisions or same-paper duplicates; all 20 additions match index metadata; three USENIX author lists re-checked on the landing pages; prose names match first authors; ~20 external sources re-fetched (CISA and Europol with Playwright), wording and dates verbatim | — |
| citations-and-quotes (sonnet) | **C2 (defect).** Bijmans et al.'s 21,022 / 10,100 come from a 1,769,183-site top-list crawl, not "whole TLD zones"; the TLD crawl was a ~20% sample and found 0.011% | **Accepted.** Read-first row and results row rewritten; both crawls' figures are needles |
| citations-and-quotes (sonnet) | C4, C5, C12, C13: Cova's 80.6% is on 823 known-bad pages, not a crawl; Li et al.'s ">1%" is over 90,000 pages and includes click fraud; EvilSeed's 26.2% is over all URLs the search gadgets returned; Grier's 77,000 URLs include a crowd-sourced feed; Li et al. 2014's data are 2012 | **All accepted**, each with a needle |
| citations-and-quotes (sonnet) | C6: the Safe Browsing "60% … less than 10 minutes" sentence is about phishing | **Accepted.** "writing about phishing" |
| citations-and-quotes (sonnet) | C7: SAQ A merchants were taken out of PCI requirements 6.4.3 and 11.6.1 | **Accepted.** Said in the polyfill.io section |
| citations-and-quotes (sonnet) | C8, C11: "served injected code through 100K+ sites" overstated Sansec's embed count; the CISA advisory is about Interlock and does not put the ClickFix pages on compromised sites | **Accepted.** Both reworded |
| citations-and-quotes (sonnet) | C9, C10: Malwarebytes cited for 2025 with only a 2024 post; Heavy Ad Intervention described without its 15-s-in-30-s trigger and as if miner-specific | **Accepted.** Both corrected |
| citations-and-quotes (sonnet) | C13 nits: c/side's date is the post date; the FTC copy is marked draft; ''singh2026_empire'' has no venue field in the live bibliography; Zhang et al.'s interceptions are not all malicious | **Accepted** for the first, second and fourth. The ''singh2026_empire'' entry predates this run and is not this page's to change; left as found |
| external-currency (sonnet) | **X1 (omission).** Google's //Coruna// report (2026-03-03): an iOS exploit kit served in 2025 through hidden iframes on compromised Ukrainian sites to selected iPhones, then on a large set of fake finance sites | **Accepted and re-verified** by the author (fetch, four phrases now in the external script). The exploit-kit status now reads "historical for the plug-in kits of the corpus era; browser-engine and mobile kits persist, mostly targeted"; the honeyclient row and the //Why a crawl undercounts// framing follow |
| external-currency (sonnet) | X2: Safe Browsing v4 is deprecated with no published shutdown date (v4 page updated 2026-03-10) | No change: the page states no date |
| external-currency (sonnet) | X3, X4: WISA 2024 proceedings are dated 2025; ICWE 2024's venue rests on the notes, not the script | X3 noted (the page gives no proceedings year). X4 **accepted**: the chapter DOI is now resolved by the external script |
| external-currency (sonnet) | X5: no government action on polyfill.io/Funnull after 2025-05-29; c/side counts 61,593 PublicWWW pages still naming polyfill.io (2026-05-18) | **Accepted in part.** The page says no later action was found; the c/side count (vendor, a source-search hit count) is not used |
| external-currency (sonnet) | X6: no second source for 2024–2026 in-browser cryptojacking | No change: the page already says "single source" |
| external-currency (sonnet) | X7: Wepawet and Capture-HPC no longer answer; no dated shutdown statement | No change: the page names them as examples of a historical method and states no status |
| external-currency (sonnet) | X8: no peer-reviewed 2025–2026 measurement of malicious served content found (arXiv, OpenAlex, web search; DBLP and Semantic Scholar bot-walled, so eCrime/DIMVA/RAID/ACSAC/EuroS&P 2026 programmes not read directly) | No change; recorded as a limit of the outside search |

| generic (fable) | **G1 (defect).** "Blocklists miss most of it" showed only the 14 of 22 papers where lists missed most; four where the list or engine caught most were left out, including the most recent paper (TRIDENT: Brave Shields missed 14.74%) | **Accepted.** Headline reworded ("miss much of it, and how much depends on the list and the lag": 18 missed most, 4 caught most); the four rows added with needles; section retitled; the four remaining papers pointed to |
| generic (fable) | **G2 (defect).** The methods table broke its own "2022–2026" rule (graph row called current with no paper after 2021) and credited TRIDENT with residential IPs it did not use | **Accepted and re-verified** in TRIDENT's text (Docker containers, no vantage stated). Graph row "historical by this table's rule" with a judgement; ad-crawling row split; the looser meaning of the detector table's Status column is now stated |
| generic (fable) | G3: "every one was read" — the 2024–2026 verdicts were made from title, summary and hit contexts, few in full text; 21 non-web WIDE hits were never verdicted | **Accepted.** Both sentences now say how the verdicts were made; the 21 are named as unverdicted, with what their titles are |
| generic (fable) | G4: the intro said the venues "stopped measuring" skimmers and a swapped library, which they never measured | **Accepted** |
| generic (fable) | G5: the malvertising span hides that 2019–2023 are social-engineering-ad papers; TRIDENT's inclusion and its list-as-label ground truth were not stated | **Accepted.** Currency row split by era; the TRIDENT read-first row says why it is IN and what its labels rest on; the open question says the 2022 data are social-engineering-ad data |
| generic (fable) | **G6 (omission).** Device is not among the crawl filters though Coruna, polyfill.io and Szurdi et al. ("miss the vast majority of malicious pages targeting mobile users") point there | **Accepted.** Sixth filter added with the quote (a needle) and a mobile-profile line in the to-do box |
| generic (fable) | G7: no live seed source named | **Accepted in part.** URLhaus (re-fetched by the external script), Safe Browsing and VirusTotal named as seeds with links to their pages; vendor indicator lists mentioned generically. Web Risk not added (not fetched) |
| generic (fable) | G8: "current kits target mobile devices" generalised from Coruna alone | **Accepted.** Both places now name Coruna (iPhones) and BlueMoon (targeted links) separately |
| generic (fable) | **G9 (defect, this log).** //Mistakes// said the contract asserts 16,963; the scripts pin 16,864 | **Accepted.** Bullet rewritten with the actual sequence |
| generic (fable) | G10: "14,971 WordPress sites" is stronger than the sources | **Accepted.** "websites — primarily WordPress, per Europol"; Europol's phrase added to the external script |
| generic (fable) | G11: no read-first entry for the injected-script lineage behind the gap the page calls largest | **Accepted.** Li et al. 2014 and Borgolte et al. 2013 added (two new bibliography entries) |
| generic (fable) | G12–G14: currency rows cover 37 of 39; sibling page defines "current" over 2023–2026; "The answer" merged two probes' vocabularies | **Accepted**, all three (note under the table; the window difference stated and explained; the sentence now says which probe found what) |
| generic (fable) | G15: placeholders in this log; the namespace row must carry 22/27 | Expected pre-publication; filled at publication, and the namespace row was corrected to 22 before its save |
| generic (fable) | Spot-check of a dozen 2022–2026 and boundary verdicts (R&B, children's sites vs Tales from the Porn, DOITRUST, self-deleting JS, Unsafe LLM search, Whatcha, Wobfuscator, piracy sites, EKHUNTER, LiMS/WasmGuard, Vadrevu/TRIDENT): none reversed. Re-runs of the post-review outputs confirmed | — |

After the generic pass's fixes the verifier (109 needles), page-quote check, external checks, report, ''check_page_numbers.mjs'' (windowed and whole-page) and the markup guards were re-run. The focused reviewers were **not** re-run on the post-generic revision; every change since their pass is listed above and was re-checked by the author against the scripts' outputs.

===== Report output, unedited =====

<file text report_malicious_web_content-output.txt>

=== PASS A — candidate probes (full text, paper-counted) ===
papers: 5859; with paper.norm.txt: 5859; with paper.cols.txt: 5855
probe                                                            rendering                             threshold  papers
---------------------------------------------------------------  ------------------------------------  ---------  -------------------------------
GAP (2026-09-22 gap pass, as run)                                paper.norm.txt, raw                   >= 5       124
GAP (same regex)                                                 paper.cols.txt, whitespace-collapsed  >= 5       138
MINE (in-browser mining vocabulary)                              paper.cols.txt, collapsed             >= 5       25
DRIVE (drive-by, exploit kit, honeyclient, malicious JS)         paper.cols.txt, collapsed             >= 5       81
MALV (malvertising, malicious ads)                               paper.cols.txt, collapsed             >= 3       52
SKIM (web skimming, Magecart, polyfill.io, script supply chain)  paper.cols.txt, collapsed             >= 3       12
SKIM, any hit (read in full, not a candidate threshold)          paper.cols.txt, collapsed             >= 1       32
SCHEMA (detection / classification / population free text)       extraction                            any        84
UNION of the six channels above (the 2026-09-27 candidate set)                                                    217
INDEX (title + abstract, whole venue index; added 2026-10-08)    corpus2/.meta                         any        140 in the index, 117 extracted
  of which no other channel caught                                                                                44
UNION = candidate set                                                                                             261
gap pass as run (paper.norm.txt, >= 5): 124 papers, 87 include the web platform, 70 crawled, 20 from 2024–2026

=== PASS B — hand verdicts over the candidate set ===
INCLUSION RULE (written before the verdicts were counted):
IN      — the paper's measured objects include malicious code or content that websites, ads or
          redirect chains serve to a visitor's browser and that acts against the visitor without
          consent: exploit pages and exploit kits (drive-by download), malicious JavaScript,
          deceptive or forced malware downloads, malicious advertising, search poisoning whose
          destinations deliver malware, in-browser cryptomining without consent (cryptojacking),
          payment-form skimming, and malicious code injected into or included by an otherwise
          legitimate site (compromise, malicious third-party script or plugin). The paper collects
          instances in the wild (crawl, honeyclient, feed, network trace, passive DNS, telemetry,
          site backups) and measures, detects, clusters or labels them. A detector or defence counts
          only if it is evaluated on in-the-wild web content, not only on synthetic samples.
          SCOPE: P = the paper is about it; S = one section of a paper about something else.
CONTEXT — the adjacent subject, owned elsewhere or outside the visitor frame: scams whose harm is a
          payment (security:online_scams), phishing (security:phishing), script-analysis and evasion
          technique without an in-the-wild malicious census (privacy:javascript), malicious browser
          extensions, mining malware on hosts, routers, IoT, CI or cloud (out of scope by the brief),
          search abuse with generic destinations, malicious URL/domain infrastructure without the
          served content, how sites get compromised, notification, third-party dependency risk
          without malicious content, package-registry supply chain, mobile in-app ads, lab-only
          defences, proof-of-concept browser-feature abuse, and users' exposure from telemetry.
OUT     — incidental, non-web malware, physical card skimmers (a homonym), fraud against a platform.
Boundary with security:online_scams: a malicious-ad or redirect paper whose measured destinations
include malware, exploit or unwanted-download delivery is IN here and may also be IN there; one whose
destinations are only scams is CONTEXT scams here.

candidates 261: IN 39 (14.9%), CONTEXT 108 (41.4%), OUT 114 (43.7%)
IN scope: primary 36, one section 3

CONTEXT, by code (papers):
code               papers  meaning
-----------------  ------  ----------------------------------------------------------------------------------------------------------------------------------------------
javascript         10      script analysis, obfuscation or evasion technique, or intrusive script behaviour, without an in-the-wild malicious census (privacy:javascript)
phishing           9       credential theft (security:phishing)
search-abuse       9       search poisoning or SEO abuse whose destinations are generic or not malware
third-party-risk   8       third-party dependency and library risk without malicious content measured
host-mining        7       mining malware on hosts, routers, IoT devices, CI or cloud; mining pools and traffic
infra              7       malicious URL / domain / hosting infrastructure without the served content
attack-capability  7       proof-of-concept abuse of a browser feature, not measured in the wild
scams              6       scams whose harm is a payment (security:online_scams)
site-compromise    6       how sites get compromised, web-server malware, compromise prediction
mobile             6       malicious or devious in-app mobile ads
web-vuln           6       vulnerabilities in sites (security:web_vulnerabilities)
social-url         5       malicious URLs posted on social platforms (the post, not the content)
domain-abuse       4       parking, typosquatting, name systems (security:domain_abuse)
supply-chain       3       malicious packages in software registries (not served to visitors)
ecosystem          3       exploit-kit server code, exploit trade and underground markets
extension          2       malicious browser extensions
defence-lab        2       defence or forensics evaluated on simulated attacks only
user-exposure      2       users' exposure to malicious content from telemetry or logs
ads                2       problematic ads measured as ad content (privacy:advertising)
notification       1       notifying compromised sites (practices:notifying_websites)
cloaking           1       cloaking against crawlers as a method (programming:crawler_detection)
download           1       trojanised software the user seeks out
on-path            1       malicious or ad content injected into page traffic by network operators, not served by the site

OUT, by code (papers):
code         papers  meaning
-----------  ------  -------------------------------------------------
mention      79      malicious web content incidental to another topic
non-web      24      malware or attacks outside the web platform
homonym      5       physical card skimmers and card scanning
mobile       5       mobile app security without served web content
other-fraud  1       fraud against a platform or advertiser

Precision and recall of each probe against the IN set:
probe                   hits  IN  precision  CONTEXT  recall of IN
----------------------  ----  --  ---------  -------  -----------------
GAP >= 5 (cols)         138   36  26.1%      58       36 of 39 (92.3%)
MINE >= 5               25    8   32.0%      13       8 of 39 (20.5%)
DRIVE >= 5              81    23  28.4%      29       23 of 39 (59.0%)
MALV >= 3               52    14  26.9%      23       14 of 39 (35.9%)
SKIM >= 3               12    0   0.0%       3        0 of 39 (0.0%)
SCHEMA                  84    27  32.1%      34       27 of 39 (69.2%)
INDEX (title+abstract)  117   30  25.6%      52       30 of 39 (76.9%)
UNION                   261   39  14.9%      108      39 of 39 (100.0%)
IN papers the GAP probe misses:
  USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks  (gap hits 1)
  IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem  (gap hits 2)
  CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web  (gap hits 1)

GAP >= 5 (cols) from 2024–2026: 23; IN among them: 0
GAP set, 2024–2026, every paper with its verdict:
  2024  OUT:mention  stealing-trust-unraveling-blind-message-attacks-in-web3-authentication — Web3 authentication
  2025*  CONTEXT:web-vuln  in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-d — DOM gadgets
  2024  OUT:mention  shedding-light-on-cvss-scoring-inconsistencies-a-user-centric-study-on — CVSS
  2024  CONTEXT:ads  targeted-and-troublesome-tracking-and-advertising-on-childrens-website — children's-site ads, a few linking to malicious content (privacy:advertising)
  2025*  CONTEXT:infra  mantis-detection-of-zero-day-malicious-domains-leveraging-low-reputed- — zero-day malicious domains from hosting
  2025*  OUT:mention  only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single- — brokered SSO
  2025*  OUT:mention  decoy-databases-analyzing-attacks-on-public-facing-databases — database honeypots
  2025*  CONTEXT:infra  dive-into-the-cloud-unveiling-the-ab-usage-of-serverless-cloud-functio — abuse of serverless function domains
  2024  CONTEXT:attack-capability  compromising-industrial-processes-using-web-based-programmable-logic-c — web-based PLC malware proof of concept
  2024  OUT:mention  understanding-and-analyzing-appraisal-systems-in-the-underground-marke — underground appraisal systems
  2025*  CONTEXT:host-mining  mineshark-cryptomining-traffic-detection-at-scale — cryptomining network traffic
  2025*  CONTEXT:infra  misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shorteni — URL-shortener abuse
  2025*  OUT:mention  power-related-side-channel-attacks-using-the-android-sensor-framework — sensor side channel
  2026*  CONTEXT:infra  indicator-of-benignity-an-industry-view-of-false-positive-in-malicious — false positives in malicious-domain detection
  2024  CONTEXT:supply-chain  donapi-malicious-npm-packages-detector-using-behavior-sequence-knowled — malicious npm packages
  2024  CONTEXT:javascript  fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniq — FV8 forced execution over extensions and npm
  2024  OUT:mention  windows-into-the-past-exploiting-legacy-crypto-in-modern-oss-kerberos- — Kerberos
  2025*  OUT:mention  dns-flare-a-flush-reload-attack-on-dns-forwarders — DNS forwarder attack
  2025*  OUT:mention  i-have-no-idea-how-to-make-it-safer-studying-security-and-privacy-mind — extension developers
  2025*  CONTEXT:attack-capability  shadowed-realities-an-investigation-of-ui-attacks-in-webxr — WebXR UI attacks
  2025*  CONTEXT:search-abuse  unsafe-llm-based-search-quantitative-analysis-and-mitigation-of-safety — AI search engines returning malicious URLs
  2025*  CONTEXT:web-vuln  xssky-detecting-xss-vulnerabilities-through-local-path-persistent-fuzz — XSS fuzzing
  2024  CONTEXT:javascript  detecting-and-understanding-self-deleting-javascript-code — self-deleting JavaScript

The gap pass's own 20 (paper.norm.txt, 2024–2026), by verdict here:
  2024  OUT:mention  stealing-trust-unraveling-blind-message-attacks-in-web3-authentication
  2025*  CONTEXT:web-vuln  in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-d
  2024  OUT:mention  shedding-light-on-cvss-scoring-inconsistencies-a-user-centric-study-on
  2024  CONTEXT:ads  targeted-and-troublesome-tracking-and-advertising-on-childrens-website
  2025*  OUT:mention  only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-
  2025*  OUT:mention  decoy-databases-analyzing-attacks-on-public-facing-databases
  2025*  CONTEXT:infra  dive-into-the-cloud-unveiling-the-ab-usage-of-serverless-cloud-functio
  2024  CONTEXT:attack-capability  compromising-industrial-processes-using-web-based-programmable-logic-c
  2024  OUT:mention  understanding-and-analyzing-appraisal-systems-in-the-underground-marke
  2025*  CONTEXT:host-mining  mineshark-cryptomining-traffic-detection-at-scale
  2025*  CONTEXT:infra  misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shorteni
  2024  CONTEXT:supply-chain  donapi-malicious-npm-packages-detector-using-behavior-sequence-knowled
  2024  CONTEXT:javascript  fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniq
  2024  OUT:mention  windows-into-the-past-exploiting-legacy-crypto-in-modern-oss-kerberos-
  2025*  OUT:mention  dns-flare-a-flush-reload-attack-on-dns-forwarders
  2025*  OUT:mention  i-have-no-idea-how-to-make-it-safer-studying-security-and-privacy-mind
  2025*  CONTEXT:attack-capability  shadowed-realities-an-investigation-of-ui-attacks-in-webxr
  2025*  CONTEXT:search-abuse  unsafe-llm-based-search-quantitative-analysis-and-mitigation-of-safety
  2025*  CONTEXT:web-vuln  xssky-detecting-xss-vulnerabilities-through-local-path-persistent-fuzz
  2024  CONTEXT:javascript  detecting-and-understanding-self-deleting-javascript-code

=== PASS C — the IN population ===
IN: 39 papers; include the web platform: 38; crawled (crawlConfig or automated-web-crawl): 33

By year bucket (2025–2026* provisional):
bucket      IN  IN primary  CONTEXT  corpus papers  IN per 1,000 corpus papers  types (IN)
----------  --  ----------  -------  -------------  --------------------------  -------------------------------------------------
2010–2013   15  15          7        511            29.4                        exploit 10, search 3, malvertising 1, injected 1
2014–2017   9   8           24       769            11.7                        injected 3, malvertising 2, exploit 2, download 2
2018–2021   13  11          32       1439           9.0                         mining 8, general 2, malvertising 2, injected 1
2022–2024   2   2           26       1955           1.0                         injected 1, malvertising 1
2025–2026*  0   0           19       1185           0.0                         —

By year (IN):
2010: 2; 2011: 5; 2012: 4; 2013: 4; 2014: 3; 2015: 3; 2016: 3; 2017: 0; 2018: 4; 2019: 5; 2020: 1; 2021: 3; 2022: 1; 2023: 1; 2024: 0; 2025*: 0; 2026*: 0
last year with an IN paper: 2023; IN papers from 2024–2026: 0

By venue (IN):
CCS 11; IMC 5; NDSS 2; PETS 0; USENIX 8; WWW 9; IEEE-SP 4

By type (IN), with first and last year — the currency table reads this:
type          papers  primary  first  last  years                                                        meaning
------------  ------  -------  -----  ----  -----------------------------------------------------------  -------------------------------------------------------------------------------------------------------------------
exploit       12      11       2010   2015  2010,2010,2011,2011,2012,2012,2012,2013,2013,2013,2014,2015  exploit pages, exploit kits, drive-by downloads, malicious JavaScript found on web pages
download      2       2        2015   2016  2015,2016                                                    deceptive or forced malware / unwanted-software downloads from web pages
search        3       3        2011   2011  2011,2011,2011                                               search poisoning whose destinations deliver malware
malvertising  6       6        2012   2023  2012,2014,2015,2019,2020,2023                                malicious ads, ad chains and push ads
mining        8       6        2018   2021  2018,2018,2018,2019,2019,2019,2021,2021                      in-browser cryptomining without consent (cryptojacking)
injected      6       6        2013   2022  2013,2014,2016,2016,2019,2022                                malicious code injected into or included by legitimate sites (compromise, third-party script, plugin, cloud bucket)
general       2       2        2018   2021  2018,2021                                                    several kinds of malicious destination, grouped into campaigns or redirect systems
skimming      0       0        —      —     —                                                            payment-form (web) skimming

IN papers (year — key — type/scope — note):
  2010  CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections  — exploit/P — drive-by defence evaluated against daily-harvested in-the-wild malicious URLs
  2010  WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod  — exploit/P — JSAND: emulation + anomaly detection of drive-by JavaScript on 140K+ pages (Wepawet)
  2011  CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web  — search/P — trending-term search and Twitter results leading to malware-distributing and ad-filled sites
  2011  CCS/2011/surf-detecting-and-measuring-search-poisoning  — search/P — SURF: search-poisoning redirection chains to fake AV, malware and scams
  2011  USENIX/2011/deseo-combating-search-result-poisoning  — search/P — deSEO: search-result poisoning that spreads malware via compromised servers
  2011  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads  — exploit/P — ARROW: signatures for drive-by downloads from 3.5B honeyclient HTTP traces
  2011  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages  — exploit/P — Prophiler: static filter for malicious pages ahead of a dynamic honeyclient
  2012  CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising  — malvertising/P — Knowing your enemy: malvertising on Alexa top-90K, ad redirection chains, MadTracer
  2012  CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service  — exploit/P — exploit-as-a-service: exploit kits, malicious URL feeds, passive DNS traffic estimates
  2012  IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages  — exploit/P — EvilSeed: guided search for malicious pages from seed URLs
  2012  IEEE-SP/2012/rozzle-de-cloaking-internet-malware  — exploit/P — Rozzle: multi-path JavaScript execution to de-cloak environment-sensitive malware on live URLs
  2013  CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns  — injected/P — Delta: DOM-tree deltas of changed sites identify web-based infection campaigns
  2013  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages  — exploit/P — SpiderWeb: crowd-sourced redirection chains classify malicious pages
  2013  IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o  — exploit/P — dedicated malicious hosts and TDSes in 5.5M-URL redirection graphs
  2013  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware  — exploit/P — Revolver: evasive web malware via AST similarity over Wepawet submissions
  2014  IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i  — injected/P — mass redirect-script injections on compromised sites (JsRED)
  2014  IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements  — malvertising/P — 673,596 ads crawled and labelled with Wepawet, blacklists, VirusTotal
  2014  NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers  — exploit/S — CyberProbe: Internet-wide probing for malicious servers, exploit servers among them
  2015  CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti  — exploit/P — poster: malicious pages by redirection-chain similarity, honeyclient labels
  2015  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths  — download/P — WebWitness: malware download paths on an academic network
  2015  WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions  — malvertising/P — malvertising delivered through ad-injecting extensions
  2016  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma  — injected/P — malicious cloud repositories (buckets) that websites load resources from
  2016  USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks  — download/P — social-engineering software download attacks on a live academic network
  2016  WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications  — injected/P — remotely included JavaScript in compromised web applications as indicators of compromise
  2018  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea  — mining/P — CMTracker: cryptojacking on 853,936 pages
  2018  CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense  — mining/P — MineSweeper: drive-by mining on Alexa top 1M, Wasm/cache detector
  2018  IMC/2018/digging-into-browser-based-crypto-mining  — mining/P — browser-based mining: crawl, Coinhive short links, pools
  2018  WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics  — general/P — analytics IDs link malicious URLs (malware, phishing, scams) into campaigns
  2019  IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem  — mining/S — porn-site privacy census; a section finds miners and VirusTotal-flagged third parties, per country
  2019  IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att  — malvertising/P — social-engineering ad campaigns (fake software, scams) on low-tier ad networks
  2019  USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web  — injected/P — third-party scripts intercepting clicks on 613 of 250K sites
  2019  USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking  — mining/P — cryptojacking campaigns at Internet scale: crawl plus NetFlow
  2019  WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild  — mining/P — Outguard: cryptojacking detector and census on Alexa top 1M
  2020  IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising  — malvertising/P — malicious web-push ad campaigns
  2021  NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system  — mining/P — MINOS: Wasm cryptojacking detector, in-the-wild sites
  2021  WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas  — mining/S — WebAssembly census: a section measures cryptomining's share of Wasm on live sites
  2021  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems  — general/P — abusive traffic distribution systems: malicious redirections (downloads, scams) by profile and vantage
  2022  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress  — injected/P — malicious WordPress plugins across eight years of site backups
  2023  USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks  — malvertising/P — TRIDENT: social-engineering ads (malicious downloads, scams) detected on 100K+ crawled sites

=== PASS D — hand-coded method attributes of the IN papers (read from full text) ===
denominator: the 39 IN papers; eras: 2010–2013 15, 2014–2017 9, 2018–2021 13, 2022–2024 2

detect:
detect       papers  of 39  2010–2013  2014–2017  2018–2021  2022–2024  meaning
-----------  ------  -----  ---------  ---------  ---------  ---------  ------------------------------------------------------------------------------------------------------------------------------------------------
honeyclient  9       23.1%  7          2          0          0          executes the page in an instrumented browser, emulator or VM and looks for exploitation or infection (Wepawet, Capture-HPC, custom honeyclient)
behavioural  11      28.2%  0          2          8          1          runtime signals of what the code does, in an instrumented browser: CPU, WebAssembly, WebSocket / Stratum traffic, cache, API traces, navigations
signature    15      38.5%  6          3          5          1          known-bad matching: script signatures, filter lists (NoCoin, CoinBlockerLists), URL or domain blacklists, YARA or regex rules
static-ml    15      38.5%  8          4          2          1          a learned classifier over static features of the page, script, URL or ad
graph        11      28.2%  6          3          2          0          redirect-chain, dependency, hosting or campaign graph analysis
network      4       10.3%  1          2          1          0          passive network traces, NetFlow, DNS or proxy logs
av           7       17.9%  1          3          3          0          antivirus or VirusTotal verdicts used as the detector
manual       7       17.9%  2          1          4          0          manual analysis is the detector

gt:
gt           papers  of 39  2010–2013  2014–2017  2018–2021  2022–2024  meaning
-----------  ------  -----  ---------  ---------  ---------  ---------  -----------------------------------------------------------------------------------
blocklist    13      33.3%  5          3          4          1          blacklists, threat feeds or filter lists
av           19      48.7%  4          6          7          2          VirusTotal or antivirus verdicts
honeyclient  9       23.1%  7          2          0          0          a dynamic analyser's verdict (Wepawet and the like)
manual       30      76.9%  11         7          10         2          researchers hand-checked a sample
vendor       7       17.9%  4          2          1          0          a partner's production data (search engine, ad network, AV vendor, hosting backups)
own-rule     5       12.8%  1          1          3          0          only the paper's own detector or rule; no independent label

visits:
visits        papers  of 39  2010–2013  2014–2017  2018–2021  2022–2024  meaning
------------  ------  -----  ---------  ---------  ---------  ---------  ----------------------------------------------------------------------
single        13      33.3%  2          2          8          1          each site or URL visited once (one snapshot)
repeated      6       15.4%  4          2          0          0          sites revisited over time
multi-config  7       17.9%  3          0          4          0          sites visited under several configurations, profiles or vantage points
passive       8       20.5%  4          3          0          1          no active visits: traces, telemetry, feeds, backups
not-stated    5       12.8%  2          2          1          0          not stated

vantage:
vantage     papers  of 39  2010–2013  2014–2017  2018–2021  2022–2024  meaning
----------  ------  -----  ---------  ---------  ---------  ---------  -------------------------------------------------
single      3       7.7%   1          0          2          0          one location or network stated
multi       5       12.8%  1          1          3          0          several locations, networks or IP types
passive     8       20.5%  4          3          0          1          observed from a network or partner, not a crawler
not-stated  23      59.0%  9          5          8          1          not stated

cloak:
cloak      papers  of 39  2010–2013  2014–2017  2018–2021  2022–2024  meaning
---------  ------  -----  ---------  ---------  ---------  ---------  ---------------------------------------------------------------------------------------------------------------
measured   11      28.2%  5          2          4          0          compared configurations or vantages, or quantified evasion, on their own data
addressed  9       23.1%  6          1          2          0          took a countermeasure (IP rotation, real browser, emulation, forced execution) without measuring the difference
none       19      48.7%  4          6          7          2          not discussed as affecting their count
data window stated: 27 of 39; years from the end of the data window to publication: min 0, median 1, max 2 (n=27); distribution 0y 8, 1y 17, 2y 2
latest data collected by any IN paper: 2022 (USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks)
active-visit papers (single / repeated / multi-config): 26; of them single-visit 13; of them vantage not stated 18; of them cloak none 12

reported how much of their own set a blocklist, feed or AV engine missed or caught: 22 of 39 (56.4%)

detect × type (papers):
type          n   honeyclient  behavioural  signature  static-ml  graph  network  av  manual
------------  --  -----------  -----------  ---------  ---------  -----  -------  --  ------
exploit       12  8            0            4          4          4      1        1   1
download      2   0            0            0          1          2      2        1   1
search        3   0            0            2          3          1      0        0   1
malvertising  6   1            4            3          2          2      0        2   2
mining        8   0            5            3          1          0      1        2   1
injected      6   0            2            2          3          1      0        0   0
general       2   0            0            1          1          1      0        1   1
skimming      0   0            0            0          0          0      0        0   0

per paper:
  2010 blade-an-attack-agnostic-approach-for-preventi exploit      window=not stated | det=honeyclient | gt=own-rule+av | visits=multi-config | vantage=not-stated | cloak=none | bl=y
  2010 detection-and-analysis-of-drive-by-download-at exploit      window=2008-01 to 2009-11 | det=honeyclient | gt=honeyclient+manual | visits=multi-config | vantage=single | cloak=addressed | bl=y
  2011 fashion-crimes-trending-term-exploitation-on-t search       window=2010-07 to 2011-04 | det=signature+static-ml | gt=blocklist+manual | visits=repeated | vantage=not-stated | cloak=none | bl=y
  2011 surf-detecting-and-measuring-search-poisoning  search       window=2010-09 to 2011-04 | det=static-ml+graph | gt=manual | visits=repeated | vantage=not-stated | cloak=measured | bl=y
  2011 deseo-combating-search-result-poisoning        search       window=2010-05 to 2011-02 | det=static-ml+signature+manual | gt=manual+vendor | visits=passive | vantage=passive | cloak=addressed | bl=y
  2011 arrow-generating-signatures-to-detect-drive-by exploit      window=not stated | det=honeyclient+signature+graph | gt=honeyclient+vendor | visits=not-stated | vantage=not-stated | cloak=none | bl=n
  2011 prophiler-a-fast-filter-for-the-large-scale-de exploit      window=not stated | det=static-ml | gt=honeyclient+manual | visits=single | vantage=not-stated | cloak=addressed | bl=n
  2012 knowing-your-enemy-understanding-and-detecting malvertising window=2011-06 to 2011-10 | det=graph+static-ml+signature | gt=blocklist+av+vendor+manual | visits=repeated | vantage=multi | cloak=measured | bl=y
  2012 manufacturing-compromise-the-emergence-of-expl exploit      window=2012-03 to 2012-05 | det=honeyclient+signature+graph+network | gt=vendor+blocklist+manual | visits=passive | vantage=passive | cloak=addressed | bl=y
  2012 evilseed-a-guided-approach-to-finding-maliciou exploit      window=2010-11 to 2011-11 | det=honeyclient+signature | gt=honeyclient+blocklist | visits=not-stated | vantage=not-stated | cloak=measured | bl=n
  2012 rozzle-de-cloaking-internet-malware            exploit      window=not stated | det=honeyclient+static-ml | gt=honeyclient+manual | visits=multi-config | vantage=not-stated | cloak=measured | bl=n
  2013 delta-automatic-identification-of-unknown-web- injected     window=2013-01 to 2013-05 | det=static-ml | gt=honeyclient+manual | visits=repeated | vantage=not-stated | cloak=none | bl=n
  2013 shady-paths-leveraging-surfing-crowds-to-detec exploit      window=2012-02 to 2012-03 | det=graph+static-ml | gt=av+manual | visits=passive | vantage=passive | cloak=addressed | bl=y
  2013 finding-the-linchpins-of-the-dark-web-a-study- exploit      window=2012-02 to 2012-08 | det=av+graph | gt=av+blocklist | visits=single | vantage=not-stated | cloak=addressed | bl=n
  2013 revolver-an-automated-approach-to-the-detectio exploit      window=not stated | det=honeyclient+manual | gt=honeyclient+manual | visits=passive | vantage=passive | cloak=measured | bl=n
  2014 hunting-the-red-fox-online-understanding-and-d injected     window=2012-04 to 2013-08 | det=signature+behavioural | gt=av+blocklist+vendor+manual | visits=not-stated | vantage=not-stated | cloak=measured | bl=y
  2014 the-dark-alleys-of-madison-avenue-understandin malvertising window=not stated | det=honeyclient+signature+av | gt=honeyclient+blocklist+av | visits=repeated | vantage=not-stated | cloak=none | bl=n
  2014 cyberprobe-towards-internet-scale-active-detec exploit      window=2013-03 to 2013-08 | det=signature | gt=own-rule+manual | visits=repeated | vantage=multi | cloak=none | bl=y
  2015 poster-detecting-malicious-web-pages-based-on- exploit      window=2012-07 to 2014-12 | det=static-ml+honeyclient | gt=honeyclient | visits=not-stated | vantage=not-stated | cloak=none | bl=n
  2015 webwitness-investigating-categorizing-and-miti download     window=not stated | det=network+graph+av | gt=av+manual | visits=passive | vantage=passive | cloak=none | bl=y
  2015 understanding-malvertising-through-ad-injectin malvertising window=2014-03 to 2014-05 | det=behavioural+av | gt=av+manual | visits=single | vantage=not-stated | cloak=addressed | bl=n
  2016 lurking-malice-in-the-cloud-understanding-and- injected     window=2015-02 | det=static-ml+graph | gt=av+blocklist+manual | visits=single | vantage=not-stated | cloak=measured | bl=n
  2016 towards-measuring-and-mitigating-social-engine download     window=not stated | det=network+graph+static-ml+manual | gt=manual+av | visits=passive | vantage=passive | cloak=none | bl=y
  2016 automatic-extraction-of-indicators-of-compromi injected     window=2015-01 to 2015-08 | det=static-ml | gt=manual+vendor | visits=passive | vantage=passive | cloak=none | bl=y
  2018 how-you-get-shot-in-the-back-a-systematical-st mining       window=not stated | det=behavioural | gt=manual | visits=single | vantage=not-stated | cloak=measured | bl=y
  2018 minesweeper-an-in-depth-look-into-drive-by-cry mining       window=2018-03 to 2018-05 | det=signature+behavioural | gt=manual | visits=single | vantage=single | cloak=none | bl=y
  2018 digging-into-browser-based-crypto-mining       mining       window=2018-02 to 2018-07 | det=signature+behavioural | gt=blocklist+manual+own-rule | visits=single | vantage=not-stated | cloak=none | bl=y
  2018 betrayed-by-your-dashboard-discovering-malicio general      window=2017-02 to 2017-09 | det=graph+signature | gt=av+vendor | visits=not-stated | vantage=not-stated | cloak=none | bl=y
  2019 tales-from-the-porn-a-comprehensive-privacy-an mining       window=not stated | det=av | gt=av | visits=multi-config | vantage=multi | cloak=measured | bl=n
  2019 what-you-see-is-not-what-you-get-discovering-a malvertising window=not stated | det=behavioural+manual | gt=manual+blocklist+av | visits=multi-config | vantage=multi | cloak=addressed | bl=y
  2019 all-your-clicks-belong-to-me-investigating-cli injected     window=2018-05 | det=behavioural | gt=own-rule | visits=single | vantage=not-stated | cloak=none | bl=n
  2019 inadvertently-making-cyber-criminals-rich-a-co mining       window=2017-09 to 2019-05 | det=behavioural+signature+network | gt=own-rule+manual | visits=single | vantage=single | cloak=measured | bl=n
  2019 outguard-detecting-in-browser-covert-cryptocur mining       window=2018-02 to 2018-10 | det=behavioural | gt=blocklist+manual | visits=single | vantage=not-stated | cloak=none | bl=y
  2020 when-push-comes-to-ads-measuring-the-rise-of-m malvertising window=2019-09 to 2019-10 | det=behavioural+graph+signature+manual | gt=blocklist+av+manual | visits=multi-config | vantage=not-stated | cloak=addressed | bl=y
  2021 minos-a-lightweight-real-time-cryptojacking-de mining       window=not stated | det=static-ml | gt=av+manual | visits=single | vantage=not-stated | cloak=none | bl=n
  2021 an-empirical-study-of-real-world-webassembly-b mining       window=2020-04 to 2020-09 | det=av+manual | gt=av+manual | visits=single | vantage=not-stated | cloak=none | bl=n
  2021 where-are-you-taking-me-understanding-abusive- general      window=2019-06 to 2019-08 | det=static-ml+manual+av | gt=manual+av | visits=multi-config | vantage=multi | cloak=measured | bl=y
  2022 mistrust-plugins-you-must-a-large-scale-study- injected     window=2012-07 to 2020-07 | det=signature | gt=manual+av | visits=passive | vantage=passive | cloak=none | bl=n
  2023 trident-towards-detecting-and-mitigating-web-b malvertising window=2021-10 to 2022-10 | det=static-ml+behavioural | gt=blocklist+av+manual | visits=single | vantage=not-stated | cloak=none | bl=y

=== PASS E — extraction fields over the IN papers (enums; nulls and sentinels shown, never counted as answers) ===
ethics.reviewOutcome: none-mentioned 26; NULL (no ethics object) 9; approved 2; sought-outcome-unstated 1; explicitly-discussed-no-review 1  (of 39)
ethics.notifiedAffectedParties: not-stated 20; NULL (no ethics object) 9; partial 5; no 3; not-applicable 2  (of 39)
artifacts.availability: none-mentioned 23; public 11; NULL (no artifacts object) 2; promised-not-yet-available 2; on-request 1  (of 39)

crawled IN papers: 33; with a crawlConfig object: 33
crawlConfig.headless (crawled IN): not-stated 30; headless 3  (of 33)
crawlConfig.interactionDepth (crawled IN): single-target-page 15; landing-plus-subpages 7; landing-page-only 6; deep-crawl 3; not-stated 2  (of 33)
crawlConfig.statefulness (crawled IN): not-stated 26; stateless 5; stateful 2  (of 33)
IN papers with any stated vantage.locations: 7 of 39
classification[].method == 'llm': 0 of 39 IN
classification[].method == 'llm' among the 108 CONTEXT papers: 5 — 2025* sheeps-clothing-wolfish-intent-automated-detection (ads) [other: GPT-4o-mini] ; 2026* indicator-of-benignity-an-industry-view-of-false-p (infra) [other: GPT-4o] ; 2025* unsafe-llm-based-search-quantitative-analysis-and- (search-abuse) [vulnerability: PhishLLM; vulnerability: HtmlLLM-Detector] ; 2026* cutting-the-gordian-knot-detecting-malicious-pypi- (supply-chain) [other: GPT-4.1; other: GPT-4.1 with RAG knowledge base] ; 2025* darkgram-a-large-scale-analysis-of-cybercriminal-a (ecosystem) [website-category: GPT-4 API; website-category: GPT-4 API]
corpus-wide papers with an 'llm' classification tuple: 177 of 5859; 2023–2026 by year: 2023 2 of 719 (0.3%), 2024 27 of 690 (3.9%), 2025* 77 of 770 (10.0%), 2026* 71 of 415 (17.1%)
classification[].method over the IN papers (papers per method, multi-valued): third-party-service 31; heuristic-rules 20; manual-labelling 16; supervised-ml 14; blocklist 11; regex-or-signature 9; unsupervised-ml 8; curated-database 7; dynamic-analysis 6; static-analysis 4; graph-analysis 1

=== PASS F — detection[] tuples of the IN papers (prevalence is a model summary: every figure the page uses is re-checked against the paper by verify_mwc_figures.mjs) ===

# CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections (4 tuples)
  - drive-by malware installation blocking | metric: true-positive and false-negative rates | prevalence: BLADE blocked all 7,925 attempted drive-by malware installs | quote: "BLADE was successful at blocking all 7,925 attempted drive-by malware installs while generating zero false alarms."
  - false-positive prevention | metric: false-positive rate | prevalence: zero false positives | quote: "Under BLADE's design, there are two potential reasons why an authorized executable download may be inadvertently hindered by BLADE"
  - zero-day attack coverage | metric: attack prevention coverage | prevalence: 11 recently disclosed zero-day exploits were prevented | quote: "In each case, BLADE successfully prevented the execution of the drive-by exploit binary"
  - browser performance overhead | metric: relative download delay | prevalence: under 3% for large files and approximately 3% for small files | quote: "delays shown in Table 4 hovered over 3% for small files and under 3% for large files."

# WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod (5 tuples)
  - drive-by-download attacks | metric: false-negative rate | prevalence: 0.2% on 823 known-bad samples | quote: "JSAND had two false negatives on the known-bad datasets. This corresponds to a false negative rate of 0.2%."
  - malicious JavaScript | metric: detection rate | prevalence: Detected 137 malicious URLs in the crawling dataset; 122 were manually verified. | quote: "On this dataset, JSAND reported 137 URLs as being malicious. Of these, we manually verified that 122 did actually launch drive-by downloads."
  - false positives | metric: false-positive rate | prevalence: 15 false positives among over 115K crawled URLs | quote: "The remaining 15 URLs (hosted on ten domains) appeared to be benign, and, thus, are false positives."
  - exploit classification | metric: classified samples | prevalence: 1,545 malicious samples classified during October 2009 operational use | quote: "Our tool was able to classify the exploits used in 1,545 of the malicious samples."
  - anomaly-score feature contribution | metric: share of final anomaly score | prevalence: Exploitation features accounted for 88%; environment preparation 9%. | quote: "exploitation features account for the largest share of the score (88% of the final value), followed by the environment preparation features (9%)"

# CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web (4 tuples)
  - malware in trending-term results | metric: share of terms, results, URLs, and domains | prevalence: Malware appeared in 1,232 of 6,946 trending terms; 7,889 of 9.8 million results were infected. | quote: "We observed malware in the search results of 1 232 of the 6 946 terms in the trending set. Running queries six times a day over three months yielded 9.8 million search results."
  - MFA sites | metric: share of terms, results, URLs, and domains | prevalence: MFA sites appeared in 77% of trending web-search terms and 94% of trending Twitter terms. | quote: "77% of terms in the trending set included one or more of the 629 MFA domains in at least one result."
  - MFA-domain collusion | metric: share of MFA domains in connected component | prevalence: 193 sites, or 30.7% of all MFA sites, formed a strongly connected component. | quote: "193 sites (30.7% of all MFA sites) form a strongly connected component."
  - search-engine intervention effect | metric: percentage change in monthly visits | prevalence: Monthly MFA visits fell 31%, from 4.67 million to 3.2 million. | quote: "Between March 10 and April 24, 2011, the monthly rate fell 31% to 3.2 million."

# CCS/2011/surf-detecting-and-measuring-search-poisoning (8 tuples)
  - search poisoning | metric: share of popular search keywords with poisoned results | prevalence: During most epochs, more than 50% of search keywords that became popular got poisoned. | quote: "During most epochs, we found that more than 50% of the search keywords that became popular on that epoch got poisoned."
  - cross-site redirections | metric: share of poisoning traces | prevalence: over 98% of Sstudy traces | quote: "We found that over 98% traces in Sstudy contain one or more redirections that cross website boundaries."
  - poisoning lag | metric: time until first poisoned result | prevalence: 38% of poisoned keywords had a lag of one day or less; 7% had a lag of seven days. | quote: "38% of them had poisoning lag (i.e., the time it takes for the first poisoned result to be detected) of one day or less."
  - rogue landing-page lifetime | metric: average lifetime | prevalence: 1.7 days | quote: "the average life time of a rogue landing page involved in search poisoning is only 1.7 days."
  - malicious terminal-page detection failure | metric: share missed by scanners | prevalence: 78.9% of malicious terminal pages | quote: "well-known malicious webpage scanners (e.g., [3]) have failed to detect 78.9% of malicious terminal pages involved in the search poisoning cases detected by SURF"
  - terminal-page content variety | metric: category distribution among sampled terminal pages | prevalence: Fake AV was most prevalent; social-engineering pages were dominant players. | quote: "As expected, fake AVs are the most prevalent adopters of search poisoning during the entire 7-month period."
  - SURF search-poisoning detection | metric: true-positive and false-positive rates | prevalence: 99.1% detection rate at 0.9% false-positive rate | quote: "achieving an average true positive rate of 99.1% at a 0.9% false positive rate."
  - generic search-poisoning detection | metric: true-positive and false-positive rates | prevalence: 98% detection rate at 1.8% false-positive rate | quote: "Averaging the results of the 3-fold validation, we obtained a detection rate of 98% at a false positive rate of 1.8%."

# USENIX/2011/deseo-combating-search-result-poisoning (7 tuples)
  - SEO search-result poisoning | metric: share of searches with malicious links in top 100 results | prevalence: around 36% of searches | quote: "the results to around 36% of the search results contain malicious links"
  - Large-scale SEO campaign | metric: compromised domains | prevalence: 5,400 domains identified, around 5,000 active | quote: "In all, we were able to identify 5400 domains, of which around 5000 were active"
  - Attacker keyphrase reuse | metric: distinct keyphrases | prevalence: 20,145 distinct keyphrases across 38 files | quote: "Across all the compromised sites, we found 38 different keyphrase files, with a total of 20,145 distinct keyphrases."
  - SEO campaign traffic | metric: estimated victims redirected to FakeAV sites | prevalence: over 81,000 victims | quote: "by extrapolating this number to the start of the campaign (August 7th), we estimate that there were over 81,000 victims who were taken to FakeAV sites."
  - Malicious URL-group detection | metric: malicious groups and compromised domains | prevalence: 9 September groups and 11 January groups; 957 domains and 15,482 URLs | quote: "In total, we find 9 malicious groups from the September data and 11 groups from the January data."
  - Live search-result poisoning | metric: share of queried terms yielding a malicious link | prevalence: 36% of 120 keywords; 45% for attacker-poisoned keywords | quote: "For a total of 120 keywords, 36% of them yield at least one malicious link in the top 100 results"
  - Compromised-server search activity | metric: share of servers issuing queries | prevalence: 46% of compromised servers versus less than 5% of top-500 Alexa sites | quote: "Less than 5% of the top 500 Alexa Web sites ever submitted queries during the month of September 2010, while 46% of the compromised servers did."

# WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads (5 tuples)
  - drive-by downloads | metric: number of malicious HTTPTraces | prevalence: 1,345,890 of 3.5 billion HTTPTraces | quote: "Out of Stotal, 1, 345, 890 HTTPTraces (denoted as Smalicious) are identified as drive-by download attacks."
  - central-server malware distribution networks | metric: share of MDNs | prevalence: 97 of 6,937 MDNs (1.4%) used one or more central servers | quote: "ARROW identified 6, 937 MDNs in total and 97 MDNs (1.4%) using one or more central servers."
  - additional drive-by downloads | metric: additional detection coverage | prevalence: 96.0% more suspicious HTTPTraces than existing approaches | quote: "In particular, the ARROW signatures contribute a large number of new suspicious HTTPTraces (96.0%)."
  - signature false positives | metric: false positive rate | prevalence: 2 of 10,733,282 benign HTTPTraces (0.0019%) | quote: "Out of total 10, 733, 282 legitimate HTTPTraces, only 2 HTTPTraces are matched with the signatures indicating an extremely low false positive rate of 0.0019%."
  - central-server trace coverage | metric: overlap coverage of existing detections | prevalence: 23.8% (320,310 of 1,345,890 malicious traces) | quote: "These central server signatures have a coverage of 23.8% of the HTTPTraces detected by existing approaches."

# WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages (4 tuples)
  - malicious web pages | metric: false-negative and false-positive rates | prevalence: Prophiler flagged 14.3% of 18,939,908 pages as malicious | quote: "Prophiler flagged 14.3% of these pages as malicious, thus achieving an 85.7% reduction of the load on the back-end analyzer."
  - drive-by-download pages | metric: false-negative rate | prevalence: 0.54% false negatives on 153,115 validation pages | quote: "On this dataset, Prophiler produced a false positive rate of 10.4% and a false negative rate of 0.54%."
  - malicious pages among filtered benign pages | metric: estimated false-negative rate | prevalence: 3 malicious pages among 162,315 sampled benign-classified pages | quote: "Of these 162,315 pages, only 3 were found to be malicious."
  - malicious web pages | metric: back-end workload reduction | prevalence: 85.7% reduction in dynamic-analysis load | quote: "Our results show that our filter is able to reduce the load on a more costly dynamic analysis tools by more than 85%."

# CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising (5 tuples)
  - malvertising redirection chains | metric: number of malicious domain-paths | prevalence: 9,568 unique malvertising domain-paths | quote: "MadTracer detects 617 infected publishers and 9,568 unique malvertising domain-paths in total with a false detection (FD) rate around 5%."
  - malvertising prevalence | metric: share of crawled publisher pages | prevalence: over 1% of the top Alexa home pages lead to malvertising | quote: "Given 53,100 out of 90,000 crawled publisher Web pages have display-ad-related paths, we observe from our data that over 1% of the top Alexa home pages lead to malvertising."
  - ad redirection chains | metric: number of unique chains and URLs | prevalence: 24,801,406 unique redirection chains and 21,944,174 unique URLs | quote: "In this way, we obtain 24,801,406 unique redirection chains and 21,944,174 unique URLs during the data collection."
  - cloaking strategies | metric: pages with browser-dependent attacks | prevalence: 95 of 126 pages attacked IE successfully; 57 did not attack Firefox | quote: "Among the 126 pages, 95 of them deliver attacks successfully to IE, and 57 do not display malicious contents when visited by Firefox."
  - click fraud | metric: detected click-fraud domain-paths | prevalence: 4,221 click-fraud domain-paths in Testing-Jun-Sep | quote: "If a path has both properties, it means that the publisher page successfully redirects a browser to an ad landing page without actual user clicks, which fulfills a fraudulent click."

# CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service (5 tuples)
  - malware families distributed by drivebys | metric: number of identifiable families | prevalence: 32 families | quote: "These kits are used to install at least 32 identifiable families of malware, which cover the spectrum of monetization techniques."
  - exploit-kit prevalence | metric: share of malicious URLs | prevalence: Blackhole accounted for 29% of all malicious URLs | quote: "Blackhole accounting for 29% of all malicious URLs in our data, followed in popularity by Incognito."
  - driveby domain lifetime | metric: median duration | prevalence: 2.5 hours for final exploit domains | quote: "Final domains are short lived, with a median duration of 2.5 hours."
  - driveby DNS traffic | metric: estimated visits | prevalence: 47,250 queries over 60 days | quote: "In total, we estimate that driveby exploit pages were queried 47,250 times over the course of 60 days."
  - Google Safe Browsing response time | metric: median time before and after listing | prevalence: 17 hours before flagging and 11 hours after listing | quote: "A median malicious domain receives traffic for 17 hours before Google flags it, and continues to receive traffic for 11 hours after it is listed."

# IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages (6 tuples)
  - malicious web pages | metric: toxicity | prevalence: 3,036 of 226,140 URLs; 1.34% | quote: "E VIL S EED submitted 226,140 URLs to the oracles, of which 3,036 were found to be malicious, for a toxicity of 1.34%."
  - guided-search expansion | metric: seed expansion | prevalence: 5.2; over five times more malicious URLs than the crawler | quote: "during these 25 days, E VIL S EED discovered over five times more malicious URLs than the crawler (the expansion is 5.2), visiting 92% less pages."
  - redirection-based cloaking | metric: share of tested URLs | prevalence: 26.2% of URLs tested were cloaked; 7.3% of domains hosted cloaked URLs | quote: "Overall, 26.2% of the URLs tested were in fact cloaked, and 7.3% of the domains tested hosted at least one cloaked URL."
  - malicious cloaked pages | metric: toxicity among visited pages | prevalence: 94.37% of analyzed URL detections; 0.93% of visited pages malicious | quote: "The results of this experiment are shown in Table III. ... 11,384 94.37% 0.93% 45.90"
  - malicious-domain registration clustering | metric: conditional probability | prevalence: 7.51%, versus 0.19% under independence | quote: "The empirical evidence of the collected data, instead, shows that these events are correlated, as P is empirically equal to 7.51%."
  - malicious landing pages from DNS traces | metric: malicious candidate URLs | prevalence: 171 URLs on 62 domains from 4,820 candidates | quote: "our gadget generated 4,820 candidate URLs (on 2,473 domains), of which 171 URLs (on 62 domains) were determined to be malicious"

# IEEE-SP/2012/rozzle-de-cloaking-internet-malware (6 tuples)
  - environment-dependent JavaScript | metric: share of JavaScript files | prevalence: 7.7% of all JavaScript files referenced environment-specific values | quote: "Only 7.7% of all JavaScript files reference environment-specific values."
  - offline runtime malware detection | metric: detected URLs and relative increase | prevalence: 11,559 with Rozzle versus 1,662 in the base run; 595% more detections | quote: "Nozzle triggered in 1, 662 cases total in the base run while the second run using Rozzle flagged 11, 559 URLs (595% more detections)."
  - online runtime malware detection | metric: detected malicious URLs | prevalence: 224 with Rozzle versus 74 with the base configuration | quote: "The dynamic detector, Nozzle, flagged 74 malicious URLs with the base configuration and 224 using the Rozzle configuration."
  - online static malware detection | metric: new detections | prevalence: 156 new Zozzle detections with Rozzle | quote: "there were 225 errors and 156 new Zozzle detections in the second run."
  - Rozzle CPU overhead | metric: median, 80th percentile, and average overhead | prevalence: 0% median, 1.1% at the 80th percentile, and 10% average CPU overhead | quote: "the median CPU overhead is 0% and the 80th percentile is 1.1%. The average CPU overhead is 10%"
  - Rozzle memory overhead | metric: median, 80th percentile, and average overhead | prevalence: 0.6% median, 1.4% at the 80th percentile, and 3% average memory overhead | quote: "The median memory overhead is 0.6% and the 80th percentile is 1.4%. The average overhead is 3%."

# CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns (4 tuples)
  - unknown web-based infection campaigns | metric: number of detected clusters and campaigns | prevalence: 67,038 different clusters; one confirmed campaign involved 15 website pairs from 10 unique URLs. | quote: "In our experiments, we identified a total of 67,038 different clusters"
  - Cool Exploit Kit infection campaign | metric: campaign cluster size | prevalence: 15 different website pairs from 10 unique URLs | quote: "This in-the-wild infection campaign was found at the beginning of April 2013 in a set of 15 different web sites from the following 10 unique URLs"
  - cross-site request forgery token trend | metric: number of website pairs | prevalence: 17 different website pairs | quote: "In total, we identified a similar modification among 17 different pairs of web sites."
  - website changes over time | metric: time difference between paired versions | prevalence: Median time difference was 20 days; 80% were at least 2 hours apart. | quote: "The average time difference of our pairs is 4 weeks ... 50% being 20 days or more apart (median)."

# CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages (2 tuples)
  - malicious web pages | metric: number of detected URLs and false-positive rate | prevalence: 562 graphs were flagged as malicious, leading to 3,368 URLs. | quote: "Of the 3,549 redirection graphs built from S (using the four groupings), 562 graphs were flagged as malicious by our detection algorithm. In total, these graphs led to 3,368 URLs."
  - malicious-page detection | metric: share of malicious-page visits blocked before compromise | prevalence: SpiderWeb would have successfully blocked 93% of 10,914 visits. | quote: "This means that out of 10,914 visits of malicious web pages, SpiderWeb would have successfully blocked 93% of them."

# IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o (6 tuples)
  - malicious URL redirection paths | metric: count of malicious paths | prevalence: 3,925,321 malicious URL paths | quote: "All together, we have gathered about 5.5 million initial URLs, which serve as inputs to a set of crawlers described below during a 7-month period to collect data."
  - dedicated malicious HICs | metric: share of malicious paths | prevalence: 15,273 HICs attached to 76.2% of malicious paths | quote: "Among them, 15,273 are found to only host confirmed malicious URL paths ... We call the former dedicated malicious HICs"
  - PageRank-detected malicious HICs | metric: expansion rate and false detection rate | prevalence: over 12 times expansion with 2.63% FDR after seed rolling | quote: "after 3 iterations, the detection coverage can be significantly increased: the number of detected host paths is increased from 242,776 (48.59%) to 361,675 (72.38%), resulting in over 12 times of expansion."
  - Traffic Distribution Systems | metric: share of doorway URLs | prevalence: 52.67% of doorway URLs send traffic to TDSes | quote: "52.67% of doorway URLs are found to send web traffic to these TDSs."
  - TDS malicious lifetime | metric: median malicious lifetime | prevalence: 65.21 days for hosts using neither DDNS nor free-domain providers | quote: "The median malicious life time for the hosts running on possibly dedicated domains (in the "neither" category) is 65.21 days"
  - traffic after TDS parking | metric: median lookups per day | prevalence: parked TDSes receive more than 10 times regular parked-domain traffic | quote: "parked TDSes have more than 10 times the the amount of lookups per day than the regular parked domains."

# USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware (4 tuples)
  - evasive JavaScript | metric: number of evasion groups and scripts | prevalence: 4,147 evasive scripts grouped into 155 evasion groups | quote: "Revolver identified 6, 996 scripts where malicious JavaScript was injected, 101, 039 scripts with data-dependencies, 4, 147 evasive scripts, and 2, 490 scripts as general evolutions."
  - JavaScript injection | metric: number of scripts and groups | prevalence: 6,996 scripts grouped into 701 JavaScript-injection groups | quote: "Revolver identified 6, 996 scripts where malicious JavaScript was injected"
  - data-dependent scripts | metric: number of scripts and groups | prevalence: 101,039 scripts grouped into 475 data-dependency groups | quote: "101, 039 scripts with data-dependencies"
  - general script evolution | metric: number of scripts and groups | prevalence: 2,490 scripts grouped into 273 general-evolution groups | quote: "2, 490 scripts as general evolutions"

# IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i (7 tuples)
  - mass redirect-script injection | metric: share of payload classes infecting both HTML and JS | prevalence: 115 out of 213 (53.99%) | quote: "115 out of 213 (53.99%), infected both HTML and JS files"
  - JavaScript-library prevalence | metric: URLs associated with identified libraries | prevalence: 18 libraries associated with 99,140 URLs (31.11%) in the Good set | quote: "from the Good set, 99,140 (31.11%) URLs are associated with the 18 libraries."
  - redirect-script infection | metric: JS-file coverage in Bad set | prevalence: 47,735 JS files (68.07%) and 63,912 HTML files (17.81%) | quote: "we captured another 17,594 infections, which increases our total detection counts to 47,735 JS files ... covering 68.07%"
  - unknown redirect infections | metric: confirmed infected JS files | prevalence: 409 infected JS files, with no false positives | quote: "Altogether, our approach captured 409 infected JS files (with 277 URLs). All of them were confirmed through VirusTotal and manual analysis, without any false positives."
  - redirector obfuscation | metric: redirectors exposing targets in code | prevalence: 1,815 of 5,071 redirectors | quote: "Among all 5,071 redirectors, 1,815 did not fit such descriptions. In other words, they exposed their redirection targets in their code."
  - P2P redirect network | metric: compromised hosts covered | prevalence: 1,760 hosts (5.89%), in 63 clusters | quote: "This process resulted in a subset of redirection paths that cover 1,760 (5.89%) of the compromised hosts found by JsRED"
  - compromise lifetime | metric: maximum observed lifetime | prevalence: up to 285 days (8.5 months) | quote: "the infection period for some hosts (i.e., compromise lifetimes) can be as long as 285 days (8.5 months)."

# IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements (8 tuples)
  - malicious advertisements | metric: incidents and share of collected advertisements | prevalence: 6,601 incidents; about 1% of 673,596 advertisements | quote: "In general, we identified 6,601 incidents in which the advertisements triggered our detection framework. Surprisingly, we observed that about 1% of all the collected advertisements show a malicious behavior."
  - blacklisted advertisement domains | metric: incident count | prevalence: 4,794 incidents | quote: "Blacklists 4,794"
  - suspicious redirections | metric: incident count | prevalence: 1,396 incidents | quote: "Suspicious redirections 1,396"
  - heuristic malicious behavior | metric: incident count | prevalence: 309 incidents | quote: "Heuristics 309"
  - malicious executables | metric: incident count | prevalence: 68 incidents | quote: "Malicious executables 68"
  - malicious Flash | metric: incident count | prevalence: 31 incidents | quote: "Malicious Flash 31"
  - ad arbitration chains | metric: maximum chain length | prevalence: Up to 30 auctions for malvertisements | quote: "there were cases in which a specific ad slot participated in up to 15 auctions for benign advertisements and up to 30 auctions for malvertisements."
  - iframe sandbox protection | metric: share of crawled websites using sandbox | prevalence: None of the crawled websites used the attribute | quote: "none of the websites that we crawled utilized this attribute to protect its users."

# NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers (4 tuples)
  - malicious servers | metric: number of distinct servers detected | prevalence: 151 distinct malicious servers through 24 localized and Internet-wide scans | quote: "Using CyberProbe and those fingerprints, we perform 24 scans (12 of them Internet-wide). The scans identify 7,881 P2P bots and 151 distinct malicious servers including C&C servers, exploit servers, payment servers, and click redirectors."
  - P2P bots | metric: number of supernodes detected | prevalence: 7,884 supernodes in an Internet-wide scan | quote: "A later Internet-wide scan found 7,884 supernodes (0.0003% response rate)."
  - provider locality | metric: average servers per provider | prevalence: 3.2 servers per provider | quote: "Overall, these operations host an average of 3.2 servers per provider."
  - unknown malicious infrastructure | metric: percentage of detected servers absent from databases | prevalence: 75% unknown to VirusTotal, URLQuery, Malware Domain List, and VxVault | quote: "Of those servers 75% are unknown to 4 public databases of malicious infrastructure: VirusTotal [56], URLQuery [54], Malware Domain List [35], and VxVault [58]."

# CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti (2 tuples)
  - malicious web pages in drive-by download attacks | metric: accuracy, recall, and precision | prevalence: accuracy was about 20% higher than the previous method | quote: "The results of our experiments with two years of data showed that the accuracy of our method was about 20% higher than that of the previous method."
  - classifier performance over time | metric: accuracy, recall, and precision | prevalence: accuracy was less than 0.9 except for Jan. - Mar. 2013 | quote: "Figure 2-4 shows the change of accuracy, recall, and precision every three months."

# USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths (8 tuples)
  - executable downloads | metric: number of downloads | prevalence: 174,376 executable downloads | quote: "To collect executable file downloads we use deep packet inspection to perform on-the-fly TCP flow reconstruction, keeping a buffer of all recent HTTP transactions."
  - malicious executable downloads | metric: number of downloads | prevalence: 5,536 downloads labeled malicious | quote: "Using the malicious executable identification process defined in Section 2.2, we labeled 5, 536 downloads as malicious."
  - malware downloads | metric: number of downloads and unique samples | prevalence: 1,064 malware downloads and 533 unique samples | quote: "This resulted in 1, 064 malware downloads, with a total of 533 unique samples."
  - malware download path categories | metric: labeled paths by category | prevalence: 164 drive-by, 41 social engineering, and 328 update/drop events | quote: "This time-consuming analysis produced a set of labeled paths, with 164 drive-by, 41 social engineering and 328 update/drop malware download events."
  - source relationships in download paths | metric: traceback feature prevalence | prevalence: All surrogate referrer features achieved 96% drive-by and 95% social-engineering success | quote: "Only Referrer and Location 0% 53% All surrogate referrer features 96% 95%"
  - malware download causes | metric: classification accuracy | prevalence: Over 93% of downloads correctly labeled | quote: "The classifier correctly labeled over 93% of the downloads."
  - download path traceback | metric: correctly traced paths | prevalence: 92% of download paths correctly traced back | quote: "The results show that 92% of the download paths were correctly traced back by our system."
  - malicious injection domains | metric: detection rate and false positives | prevalence: 94.87% detection rate at 0.07% false positives | quote: "Thus, overall, we obtained a minimum of 94.87% detection rate at 0.07% false positives."

# WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions (8 tuples)
  - ad-injecting extensions | metric: share of Chrome extensions | prevalence: 292 of 18,030 extensions | quote: "We ran Expector on all extensions available on the Chrome extension store (almost 18,000), and identified 292 extensions that embed ad-injection capabilities."
  - malvertising extensions | metric: share of ad-injecting extensions | prevalence: 56 of 292 extensions | quote: "Of these, 56 deliver ads that lead users to sites that host malware, and have an overall user base of 602,417."
  - malicious advertisements | metric: fraction of extension-injected ads | prevalence: roughly 4% on top-1000 Alexa websites | quote: "none of the ads originally embedded on the top-1000 Alexa websites were malicious, whereas we found that roughly 4% of extension-injected ads on these websites were malicious."
  - malicious ad networks | metric: ad-network domains delivering malicious ads | prevalence: 16 of 67 domains; 13 delivered only malicious ads | quote: "we found that 16 out of the 67 (24%) ad network domains deliver malicious ads"
  - malware-download overlap | metric: fraction of overlapping source identifiers | prevalence: 0.6% to 47% | quote: "Table 4 shows this fraction, ranging from as low as 0.6% to an astonishing 47%"
  - Expector false positives | metric: false-positive rate | prevalence: 3.6% (11 of 303) | quote: "This indicates a very low false positive rate of 3.6%."
  - Expector false negatives | metric: false-negative rate | prevalence: 3.0% (1/33) | quote: "In summary, Expector has a low false negative rate of 3.0% (1/33)."
  - DNS temporal correlation | metric: average Pearson correlation | prevalence: higher for corresponding malware domains than 44 arbitrary malware domains | quote: "we further computed the Pearson correlation values between monthly DNS lookups of each ad network domain and all of its corresponding malware hosting domains."

# CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma (8 tuples)
  - malicious or compromised cloud repositories | metric: precision and coverage against ground truth | prevalence: 694 repositories among 6,885 identified repositories | quote: "Among them, BarFinder identified 694 malicious or compromised repositories [...] with a precision of 95% and a coverage of 90% against our ground-truth set."
  - malicious cloud repositories in unknown set | metric: false discovery rate | prevalence: 730 flagged; 694 confirmed Bars | quote: "BarFinder reported a total of 730 Bars [...] AV scanning and blacklist verification confirmed that 502 buckets were indeed bad. [...] This validation further confirmed 192 Bars."
  - cloud-bucket misconfiguration | metric: number of vulnerable repositories | prevalence: 472 of 6,885 repositories, associated with 1,306 front-end websites | quote: "By scanning all 6,885 repositories [...] we discovered that 472 are vulnerable, which were associated with 1,306 front-end websites."
  - Bar infrastructure and sharing | metric: domains and redirection paths involving confirmed Bars | prevalence: 694 Bars served 156,608 domains through 6,513,519 paths involving 166,772 domains | quote: "These Bars were found to directly serve 156,608 domains [...] through which they are further attached to 6,513,519 redirection paths involving 166,772 domains."
  - Bar lifetime | metric: repository lifespan | prevalence: Google Drive repository remained for over 150 days | quote: "we continuously crawled the front-end bad sites every five days to check whether they were still using the same set of Bars"
  - evasion techniques | metric: average lifespan by technique | prevalence: Content separation exceeded 30 days on average | quote: "we manually choose 10 Bars with each evasion technique (40 in total), combined with 10 Bars without evasion, and then compare their life spans."
  - geographic distribution of front-end sites | metric: country distribution | prevalence: Sites distributed across 81 countries; United States 14% | quote: "Figure 6 shows the distribution of Bars' frontend websites across 81 countries, as determined by the geolocations of the sites."
  - malicious-content reuse | metric: content-sharing groups | prevalence: Three types: intra-bucket, cross-bucket, and cross-platform sharing | quote: "In this way, we were able to discover three types of content sharing: intra-bucket sharing, cross-bucket sharing, and cross-platform sharing."

# USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks (7 tuples)
  - social-engineering executable downloads | metric: count of labelled attacks | prevalence: 2,004 real-world SE download attacks | quote: "Our analysis is based on a dataset consisting of 2, 004 real-world SE download attacks."
  - advertisement-mediated SE attacks | metric: share of SE attacks | prevalence: 80.64% used ads; 7.29% used search plus ads | quote: "Over 80% of the SE attacks we observed used ads displayed on websites visited by the user."
  - SE deception and persuasion tactics | metric: share of SE downloads | prevalence: Repackage+Entice: 48.50% | quote: "The most popular combination of deception and persuasion techniques is repackage+entice, making up over 48% of the observations."
  - fake-antivirus attacks | metric: share of SE attacks | prevalence: less than 1% | quote: "our study of in-the-wild SE malware downloads finds that they represent less than 1% of modern SE attacks."
  - ad-driven benign downloads | metric: share of benign downloads | prevalence: around 7% | quote: "We find that around 7% of all benign software downloads are ad-driven."
  - AV detection of SE downloads | metric: share detected on collection day | prevalence: Zero-day detection ranged from 0% to 34.4% across reported categories | quote: "We scanned each of the samples on the day we collected them. Then, we also "aged" the samples for a period of one month"
  - ad-driven SE download classification | metric: true-positive and false-positive rates | prevalence: 91.2% true positives and 0.5% false positives | quote: "The classifier correctly identified over 91% of the ad-driven SE downloads. Furthermore, it has a very low false positive rate of 0.5%."

# WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications (5 tuples)
  - Web indicator extraction | metric: number of validated WIOCs | prevalence: 96 valid indicators from 303 detection-set URLs | quote: "Invalid Indicator 22 Valid Indicator of Compromise 96 Not-enough-data 185"
  - Compromised webpage association | metric: share of candidate indicators classified valid | prevalence: Almost 20% were JavaScript URLs never previously observed; 80% had appeared in earlier honeypot data. | quote: "Almost 20% of those indicators were URLs of JavaScript component that we never observed before in our honeypot. Interestingly, the remaining 80% were instead components that were observed several times by our honeypot during the previous ye"
  - Real-world WIOC exposure | metric: requests per indicator per day | prevalence: Each indicator was requested by an average of 47 different users per day. | quote: "In average, each indicators was requested by 47 different users per day."
  - Existing antivirus detection | metric: share of webpages detected by at least one antivirus | prevalence: Only 5.3% of webpages including an indicator were detected. | quote: "In total, only 5.3% of the webpages including an indicator were detected by at least for one antivirus products."
  - Previously unknown indicators | metric: share previously unknown to vendor | prevalence: Over 90% of WIOCs were previously unknown and considered benign. | quote: "Overall, over 90% of our web indicators were previously unknown to the vendor and were considered benign by their internal intelligence database."

# CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea (8 tuples)
  - cryptojacking webpages | metric: detected webpages | prevalence: 2,770 unique cryptojacking samples from 853,936 popular web pages | quote: "our approach successfully discovered 2,770 unique cryptojacking samples from 853,936 popular web pages"
  - cryptojacking evasion | metric: blacklist detection rate | prevalence: less than 51% of malicious attacks detected | quote: "less than 51% malicious attacks are detected."
  - CPU throttling | metric: share of analyzed samples | prevalence: 70% set a throttle attribute | quote: "most of the cryptojacking samples (70%) set such an attribute, named "throttle""
  - code obfuscation | metric: share of analyzed samples | prevalence: 26 of 100 analyzed samples | quote: "26 of the 100 analyzed cryptojacking webpages obfuscate their code to hide their malicious intent."
  - payload hiding | metric: share of analyzed samples | prevalence: 43 of 100 analyzed samples | quote: "some pages hide malicious code into popular 3rd party library."
  - malicious miner lifecycle | metric: share vanishing before nine days | prevalence: about 20% vanish in less than 9 days | quote: "Among our evaluated samples, about 20% vanish in less than 9 days."
  - cryptojacking energy consumption | metric: daily electricity consumption | prevalence: at least 278K kWh per day | quote: "our experiment shows that the malicious mining pages consume at least 278K kWh electricity energy per day"
  - cryptojacking revenue | metric: estimated revenue | prevalence: more than 1.7 million US Dollars from more than 10 million users per month | quote: "our basic approximation shows that malicious miners can gain more than 1.7 million US Dollars, from more than 10 million users per month."

# CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense (8 tuples)
  - drive-by cryptocurrency mining | metric: share of crawled websites | prevalence: 1,735 websites (0.18%) | quote: "# of drive-by mining websites 1,735 (0.18%)"
  - cryptomining services and campaigns | metric: number of services and campaigns | prevalence: 28 services and 20 campaigns | quote: "we discovered 15 more Coinhive-like services ... for a total of 28 drive-by mining services in our dataset."
  - internal-page mining | metric: share of mining websites | prevalence: 744 of 1,735 websites (42.88%) | quote: "We found 744 out of 1,735 websites (42.88%) stealing the visitor's computational power only when she visits one of their internal pages."
  - code obfuscation | metric: share of services | prevalence: 23 of 28 services (82.14%) | quote: "we identified 23 (82.14%) of drive-by mining services using one or more of the following obfuscation techniques"
  - obfuscated Stratum communication | metric: share of mining websites | prevalence: 174 websites (10.03%) encoded communication | quote: "A common strategy to obfuscate the mining pool communication found in 174 (10.03%) websites is to encode the request, either as Hex code, or with salted Base64 encoding"
  - CPU throttling | metric: share of mining websites below threshold | prevalence: 197 websites (11.36%) below 50% CPU; 12 (0.69%) below 25% | quote: "at least 197 (11.36%) websites throttle their CPU usage to less than 50%, while for only 12 (0.69%) mining websites we observed a CPU load of less than 25%."
  - cryptomining Wasm payloads | metric: share of detected mining websites | prevalence: All 1,735 websites used Wasm and opened a WebSocket | quote: "all the websites (100.00%) use Wasm for the cryptomining payload and open a WebSocket."
  - MineSweeper cryptominer detection | metric: detection outcome on 40 unique samples | prevalence: Detected at least two primitives in all mining samples with no false positives | quote: "MineSweeper detected at least two of CryptoNight's primitives in all mining samples with no false positives."

# IMC/2018/digging-into-browser-based-crypto-mining (6 tuples)
  - browser-based mining prevalence | metric: share of probed domains | prevalence: less than 0.08% of probed sites | quote: "We indeed find websites that utilize browser-mining. Yet, the prevalence of browser mining is currently low at < 0.08% of the probed sites."
  - WebAssembly mining | metric: share of detected mining websites missed by block lists | prevalence: up to 82% not detected by block lists | quote: "We thus present a new technique based on WebAssembly fingerprinting to identify miners, up to 82% of thereby identified mining websites are not detected by block lists."
  - Coinhive prevalence | metric: share of mining sites | prevalence: used by 75% of mining sites | quote: "We identify Coinhive as the largest web-based mining provider used by 75% of the mining sites."
  - Coinhive short-link concentration | metric: share of all short links from top users | prevalence: 10 heavy users contribute over 80% of all short links | quote: "We find that 10 heavy users contribute over 80% of all short links mostly targeting streaming and filesharing services."
  - Coinhive-mined Monero blocks | metric: share of Monero blocks | prevalence: 1.18% of all Monero blocks | quote: "we find that Coinhive mines 1.18% of all Monero blocks"
  - Coinhive network hash rate | metric: combined median hash rate | prevalence: 5.5M h/s | quote: "their visitors have a combined median hash rate of 5.5M h/s."

# WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics (8 tuples)
  - analytics identifiers on malicious web pages | metric: unique analytics IDs | prevalence: 9,395 IDs associated with malicious pages | quote: "we were able to extract 9,395 analytics IDs associated with malicious content."
  - malicious domains sharing analytics IDs | metric: newly discovered live websites | prevalence: 14,267 live websites, 76.5% previously unseen | quote: "Overall, we were able to discover 14,267 live websites containing malicious analytic IDs, 76.5% of which were new, previously unseen domains"
  - technical-support scam analytics campaigns | metric: unique Google Analytics IDs | prevalence: 872 IDs across 3,185 domains | quote: "we were able to extract 872 unique Google Analytics IDs across 3,185 domain names."
  - analytics identifiers in browser extensions | metric: extensions containing Google Analytics IDs | prevalence: 120 of 255 downloaded extensions | quote: "Out of 255 extensions that we could successfully download and unpack, we found Google Analytics IDs on 120 extensions."
  - analytics identifiers in malicious Android apps | metric: unique identifiers and APK samples | prevalence: 18,734 identifiers across 273,232 malware APKs | quote: "Overall, from 477,829 malicious APKs, we retrieved 18,734 unique analytics identifiers over 273,232 samples."
  - malware discovery through analytics-ID matching | metric: flagged APKs | prevalence: 100,379 newer APKs flagged as malware | quote: "By matching analytics IDs found on previous malicious samples, 100,379 unique APKs were flagged as malware."
  - phishing campaigns | metric: campaigns identified | prevalence: 13 phishing campaigns | quote: "After applying Algorithm 1 to the two-week collection of “unknown” websites ... we could identify 13 phishing campaigns"
  - analytics-based actor deanonymization | metric: malicious actors deanonymized | prevalence: 59 malicious actors behind VirusTotal URLs | quote: "we were able to deanonymize 59 malicious actors behind VirusTotal URLs by finding public WHOIS records for other domains sharing the same analytics IDs."

# IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem (8 tuples)
  - third-party HTTP cookies | metric: share of pornographic websites | prevalence: 72% of the corpus contained third-party cookies | quote: "We now focus our study on the 30,247 HTTP cookies installed by 3,343 third-party domains in 72% of our corpus of pornographic sites."
  - canvas fingerprinting | metric: share of pornographic websites | prevalence: 245 scripts in 315 websites; third-party services appeared in 4% of sites | quote: "This allows us to find 245 different JavaScripts performing canvas fingerprinting in 315 porn websites."
  - cookie synchronization | metric: share of pornographic websites | prevalence: 2,867 websites, covering 58% of the top-100 popular sites | quote: "We study the use of cookie syncing in pornographic websites by checking if any of the observed HTTP cookies are later embedded in subsequent HTTP requests."
  - HTTPS support | metric: share of websites not fully HTTPS | prevalence: 4,663 websites (68%) were not fully HTTPS | quote: "we measure HTTPS support in porn websites by inspecting the requests triggered by our OpenWPM crawler. By default, we crawl each website using HTTPS"
  - potentially malicious domains | metric: number of pornographic websites | prevalence: 7 porn websites and 16 third-party services were classified as potentially malicious | quote: "There are 7 porn websites classified as a potentially malicious by VirusTotal. Further, malicious and deceptive behaviors also extend to 16 third-party services embedded in 41 porn websites."
  - privacy policies | metric: share of pornographic websites | prevalence: 16% had a privacy policy | quote: "Our crawler inspects the DOM of the landing page looking for a link to the privacy policy. We are able to find a privacy policy in 16% of the pornographic websites"
  - cookie consent banners | metric: share of pornographic websites | prevalence: 4.41% in the EU and 3.76% in the USA | quote: "The proportion of pornographic webpages with cookie banners is very small, being only 4% of the total."
  - age-verification mechanisms | metric: share of top-50 websites | prevalence: 20% in the USA, UK, and Spain; 14% in Russia | quote: "the same set of 20% of the pornographic websites implement and show to the end user the same age verification mechanism"

# IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att (5 tuples)
  - SEACMA campaigns | metric: number of campaigns | prevalence: 108 of 130 clusters represented SE attack campaigns | quote: "Out of the 130 clusters we obtained, 108 clusters appeared to be clearly representing various SE attack campaigns."
  - SE attack instances | metric: number of attack instances | prevalence: 28,923 SE attack instances | quote: "Overall, these campaigns included 11,341 unique domains of publisher sites and 28,923 SE attack instances"
  - SEACMA publisher prevalence | metric: share of crawled websites | prevalence: 11,341 of 70,541 publisher websites (16%) | quote: "Among the 70,541 publisher websites that we crawled, only 11,341 (16%) were observed to host SEACMA ads."
  - Google Safe Browsing detection | metric: final detection rate | prevalence: 16.21% of attack domains after two months | quote: "even after two months time, GSB detected only a small percentage (16.2% overall) of SE attack domains."
  - Downloaded malicious files | metric: number marked malicious | prevalence: more than 9,000 of 9,476 milked files | quote: "In the end, we found that more than 9,000 of the milked files were marked as malicious."

# USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web (6 tuples)
  - click interception by hyperlinks | metric: cases and affected websites | prevalence: 4,178 hyperlinks on 221 websites | quote: "In total, we observe that 4,178 hyperlinks on 221 websites were intercepted, which can lead a user to 2,695 distinct third-party URLs."
  - click interception by event handlers | metric: elements and affected websites | prevalence: 203 elements across 172 websites | quote: "Overall, we find 203 elements across 172 websites were attached with navigation event handlers, which would drive a user to a third-party URL upon click."
  - visual deception | metric: element groups and affected websites | prevalence: 286 visual-deception cases on 231 websites | quote: "We discover 140 mimic third-party element groups on 87 websites."
  - transparent overlay | metric: element groups and affected websites | prevalence: 146 groups on 144 websites | quote: "We detect 146 transparent overlay third-party element groups on 144 websites."
  - advertising-related click interception | metric: share of click-interception navigation URLs | prevalence: 1,183 (36.39%) out of 3,251 unique click-interception navigation URLs | quote: "Surprisingly, we find that 1,183 (36.39%) out of the 3,251 unique click interception navigation URLs are advertising URLs (Table 6)."
  - malicious landing content | metric: qualitative findings | prevalence: null | quote: "We were directed to some fake anti-virus (AV) software and drive-by download pages when we manually examined some of the click interception URLs."

# USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking (5 tuples)
  - active cryptojacking | metric: share of successfully crawled websites | prevalence: 10,100 websites actively mining without explicit consent | quote: "We have identified 21,022 websites with traces of cryptomining activities of which 10,100 websites are actively mining without the visitor's explicit consent."
  - cryptojacking campaigns | metric: number of campaigns | prevalence: 204 campaigns covering 5,733 websites | quote: "We have identified 204 cryptojacking campaigns, covering 5,733 websites, meaning that 57% of all cryptojacking websites encountered are part of a campaign."
  - Internet-wide cryptojacking prevalence | metric: share of sampled domains | prevalence: 0.011% of all domains, or one in 9,090 websites | quote: "We estimate that 0.011% of all domains are actively cryptomining without their visitors' explicit consent, meaning that one in every 9,090 websites is cryptojacking."
  - mining-service usage | metric: relative NetFlow traffic by mining application | prevalence: CoinImp proxy servers handled more than twice Coinhive's traffic | quote: "while Coinhive is found on most websites, CoinImp proxy servers handle more than twice as much traffic than the dominant application."
  - cryptojacking domain categories | metric: number of cryptojacking websites by category | prevalence: Adult content was the most prevalent category, with over 2,000 websites | quote: "adult content (such as pornography) as the most prevailing category within our dataset, with over 2,000 websites in this category."

# WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild (7 tuples)
  - in-browser cryptojacking | metric: true-positive and false-positive rates | prevalence: 6,302 cryptojacking websites across 5,128,117 URLs | quote: "In total, Outguard reported 6,302 cryptojacking websites across 5,128,117 URLs, as shown in Table 4."
  - cryptojacking detection performance | metric: 97.9% TPR and 1.1% FPR on the imbalanced dataset | prevalence: null | quote: "Outguard achieves a 97.9% TPR and 1.1% FPR"
  - new cryptojacking detections | metric: share of detected websites | prevalence: 3,600 of 6,302 detections were new | quote: "3,600 (57%) of the detected cryptojacking websites were new detections."
  - cryptojacking consent | metric: share automatically executed without consent | prevalence: 78% of reachable websites lacked user consent | quote: "We found that in the remaining 78% of websites, the JSECoin cryptojacking library was automatically executed without user consent."
  - cryptojacking website lifetime | metric: share becoming inactive in less than ten days | prevalence: 32% became inactive in less than 10 days | quote: "We performed 9 crawls over 3 months from May 20 to July 25, 2018 and found that 32% of the cryptojacking websites became inactive in less than 10 days."
  - cryptojacking families | metric: share assigned to known families | prevalence: 5,816 detected websites, or 92.3%, assigned to 14 known families | quote: "These two metrics were sufficient to label 5816 (92.3%) of the detected websites into the 14 known cryptojacking families encountered during training data labeling."
  - advertisement-delivered cryptojacking | metric: number of incidents | prevalence: 69 incidents | quote: "We did find 69 cryptojacking incidents in landing pages that resulted from clicking on an advertisement."

# IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising (5 tuples)
  - web-push notification collection | metric: number of WPN messages | prevalence: 21,541 push notification messages | quote: "we were able to collect a total of 21,541 push notification messages, including 12,441 notifications for the desktop environment and 9,100 for the mobile environment."
  - WPN advertising campaigns | metric: number of campaigns and ads | prevalence: 572 WPN ad campaigns and 5,143 WPN ads | quote: "PushAdMiner identified 572 WPN ad campaigns and a total of 5,143 WPN ads related to these campaigns."
  - malicious WPN advertising | metric: share of WPN ads confirmed malicious | prevalence: 51% of all WPN ads | quote: "Furthermore, PushAdMiner found 51% of all WPN ads as malicious."
  - URL-blacklist detection gaps | metric: share of URLs detected | prevalence: VirusTotal detected 11.31% after one month; GSB still flagged 1% | quote: "After one month, we submitted the same set of URLs once again, and we found that 1,388 (11.31%) of them were then detected by VT, though GSB still only flagged 1% of them."
  - ad-blocker effectiveness | metric: blocked Service Worker scripts and requests | prevalence: All tested blockers blocked 0 Service Worker scripts | quote: "both ad blocking mechanisms failed to block the registration of Service Worker scripts related to ad networks that support WPN ads"

# NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system (4 tuples)
  - Wasm-based cryptojacking | metric: prevalence among 682 websites | prevalence: 69 malicious and 613 benign websites | quote: "Our search returned a combined total of 682 websites from both sources with 613 being benign and 69 malicious."
  - Cryptojacking classification | metric: accuracy | prevalence: 98.97% on the in-the-wild dataset | quote: "M INOS was able to detect and correctly classify 67 malicious webpages, and 608 benign webpages, obtaining an overall accuracy of 98.97%."
  - Wasm binary extraction | metric: number of binaries | prevalence: 1,534 Wasm binaries from 682 websites | quote: "the Wasm Binary Auto-Collector extracted a total of 1534 Wasm binaries to be analyzed."
  - Obfuscated cryptojacking | metric: detection across obfuscation levels | prevalence: Detected regardless of obfuscation level | quote: "M INOS is able to detect the obfuscated binaries regardless of the level or degree of obfuscation."

# WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas (8 tuples)
  - WebAssembly source languages | metric: share of unique binaries | prevalence: 64.2% compiled from C, C++, or both; source language inferred for 91% | quote: "Overall, our methods infer the source language for 91% (7,698) of the 8,461 unique binaries."
  - Unmanaged stack usage | metric: share of binaries and functions | prevalence: 65% of binaries and 44% of functions use the unmanaged stack | quote: "Figure 6a shows that almost two thirds (65%) of all binaries use the unmanaged stack."
  - Statically linked allocators | metric: share of binaries | prevalence: 38.6% use custom allocators | quote: "WebAssembly binaries come with a variety of memory allocators, including many custom allocators (38.6%)"
  - Security-critical host API imports | metric: share of filtered binaries | prevalence: 21.2% import at least one potentially security-critical API | quote: "overall 21.2% of all binaries import at least one potentially security-critical API."
  - WebAssembly cryptomining | metric: share of web binaries | prevalence: about 1% of the web dataset are possible cryptominers | quote: "we identify only four binaries from our "web" dataset as possible cryptominers (about 1% of the dataset)"
  - WebAssembly application use cases | metric: number of sampled binaries by domain | prevalence: Games were the most common domain, with 25 of 100 sampled binaries | quote: "The most common domains are games, accounting for a quarter of all binaries. Text processing and applications in visualization and animation are also relatively common"
  - WebAssembly binary minification | metric: share of binaries | prevalence: 28.8% of web binaries are minified | quote: "among all binaries found on the web, only 13.3% contain a names section but 28.8% are minified."
  - WebAssembly binary reuse | metric: domains per unique binary | prevalence: 70 of 476 web binaries reused across at least two top-level domains | quote: "Out of all 476 unique binaries found on the web, 70 are reused across at least two different top-level domains."

# WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems (6 tuples)
  - user differentiation | metric: relative page counts and NRD scores | prevalence: 81% more malicious pages using six profiles than the best single profile | quote: "ODIN finds 81% more malicious and 96% more suspicious landing pages, compared to visiting pages only using the user profile which experienced the most malice."
  - IP-based cloaking | metric: malicious-page count | prevalence: More than twice as many malicious pages with multiple IP addresses | quote: "We find that using multiple IP addresses leads us to find more than twice as many malicious pages."
  - TDS infrastructure overlap | metric: traffic-broker domain overlap | prevalence: 19.2% to 44.1% overlap between non-pharmacy TDSs | quote: "we observe 19.2% to 44.1% traffic broker domains overlap between non-pharmacy TDSs."
  - malicious destination prevalence | metric: share of collected pages | prevalence: 26.5% after errors: 2.6% malicious, 4.0% suspicious, or 20.0% illicit | quote: "After removing errors, we find that 26.5% of all collected pages are malicious (2.6%), suspicious (4.0%) or illicit (20.0%)."
  - blacklist coverage | metric: coverage and detection delay | prevalence: GSB missed mobile-targeted malicious pages 76% of the time | quote: "GSB does not include malicious landing pages shown to mobile users 76% of the time."
  - malicious redirection prediction | metric: 10-fold accuracy and F1 score | prevalence: 99.0% accuracy and 92.7% F1 | quote: "Our classifier achieves an average 99.0% accuracy and 92.7% F 1 score (evaluated using 10-fold crossvalidation)"

# USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress (5 tuples)
  - malicious plugin installs | metric: number of installs and unique websites | prevalence: 47,337 malicious plugins on 24,931 unique websites | quote: "YODA uncovered 47,337 malicious plugins on 24,931 unique websites."
  - malicious behavior categories | metric: counts by behavior category | prevalence: 14 distinct malicious behaviors | quote: "We manually investigated all the plugins from above and identified 14 distinct malicious behaviors, listed in Table 2 Column 1."
  - post-deployment plugin infection | metric: infected plugin instances | prevalence: 40,533 infected plugin instances | quote: "It was concerning that over 40K plugin instances were infected post-deployment."
  - malicious plugin persistence | metric: share still infected at study end | prevalence: over 94% of websites with malicious plugins remained infected | quote: "Despite cleanup efforts, over 94% of all websites with malicious plugins remained infected."
  - malicious plugin temporal evolution | metric: first-seen dates and yearly evolution | prevalence: malicious plugins peaked in March 2020 | quote: "the number of malicious plugins peaked in March 2020"

# USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks (4 tuples)
  - SE-ad-related navigation | metric: accuracy, precision, recall, and F1 score | prevalence: 1,479 events resulting in SE attacks among 258,008 JavaScript-initiated navigation events | quote: "we crawled over 100K websites from October 2021 to January 2022 and collected 258,008 unique navigation events initiated by JavaScript (JS), including 1,479 events resulting in SE attacks."
  - Social-engineering attack types | metric: counts by attack category | prevalence: 857 unwanted-software downloads, 222 dating scams, 177 reward/lottery scams, 148 push notifications, 51 scareware, and 24 tech-support scams | quote: "We have six categories of SE attacks in total."
  - Concept drift | metric: accuracy, precision, and recall | prevalence: 97.37% accuracy, 98.25% precision, and 97.37% recall | quote: "we evaluated T RIDENT's accuracy over time by testing it on a dataset crawled in October 2022, almost one year after the initial model was trained."
  - Runtime overhead | metric: median page-load overhead | prevalence: 2.13% median overhead, corresponding to a 0.02-second increase | quote: "The median runtime overhead is 2.13% which results in a 0.02-second increase in the page load time"

225 detection tuples across 39 IN papers; papers with none: 0

=== PASS G — CONTEXT papers (reading list, not population), by code ===

scams (6): scams whose harm is a payment (security:online_scams)
  2014 CCS/2014/a-nearly-four-year-longitudinal-study-of-search-engine-poisoning — four years of search-redirection poisoning toward unlicensed pharmacies (IN on security:online_scams)
  2017 NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams — technical-support scams via malvertising (security:online_scams)
  2018 IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams — survey scams (security:online_scams)
  2018 WWW/2018/exposing-search-and-advertisement-abuse-tactics-and-infrastructure-of-technical — technical-support scams via search (security:online_scams)
  2023 IEEE-SP/2023/beyond-phish-toward-detecting-fraudulent-e-commerce-websites-at-scale — fraudulent e-commerce sites (security:online_scams)
  2023 NDSS/2023/double-and-nothing-understanding-and-detecting-cryptocurrency-giveaway-scams — crypto giveaway scams (security:online_scams)

phishing (9): credential theft (security:phishing)
  2016 CCS/2016/phisheye-live-monitoring-of-sandboxed-phishing-kits — phishing kits (security:phishing)
  2019 IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni — phishing-blacklist evasion
  2020 IMC/2020/are-you-human-resilience-of-phishing-detection-to-evasion-techniques-based-on-hu — CAPTCHA-gated phishing vs crawlers
  2021 IEEE-SP/2021/crawlphish-large-scale-analysis-of-client-side-cloaking-techniques-in-phishing — CrawlPhish: phishing cloaking (security:phishing)
  2022 CCS/2022/im-spartacus-no-im-spartacus-proactively-protecting-users-from-phishing-by-inten — phishing cloaking turned into a defence
  2022 IMC/2022/phishweb-a-progressive-multi-layered-system-for-phishing-websites-detection — phishing-site detector
  2024 WWW/2024/phishing-vs-legit-comparative-analysis-of-client-side-resources-of-phishing-and — phishing sites' client-side resources
  2025* IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e — wallet drainer kits on phishing sites (security:phishing)
  2026* WWW/2026/netting-phish-in-the-ipfs-ocean-real-time-monitoring-and-characterization-of-dec — phishing on IPFS gateways

javascript (10): script analysis, obfuscation or evasion technique, or intrusive script behaviour, without an in-the-wild malicious census (privacy:javascript)
  2017 WWW/2017/j-force-forced-execution-on-javascript — J-Force forced execution; exploit-kit samples as test set only
  2019 CCS/2019/hidenoseek-camouflaging-malicious-javascript-in-benign-asts — HideNoSeek: camouflaging malicious JS (attack technique)
  2019 WWW/2019/anything-to-hide-studying-minified-and-obfuscated-code-in-the-web — minified and obfuscated code (privacy:javascript)
  2020 IMC/2020/hiding-in-plain-site-detecting-javascript-obfuscation-through-concealed-browser — concealed browser-API usage (obfuscation)
  2021 IMC/2021/knock-and-talk-investigating-local-network-communications-on-websites — localhost and LAN requests by websites
  2021 USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild — JavaScript anti-debugging in the wild
  2022 IEEE-SP/2022/wobfuscator-obfuscating-javascript-malware-via-opportunistic-translation-to-weba — Wobfuscator: JS malware evasion via Wasm (attack technique)
  2023 WWW/2023/automated-webassembly-function-purpose-identification-with-semantics-aware-analy — WebAssembly function purpose (mining as one label)
  2024 USENIX/2024/fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniques — FV8 forced execution over extensions and npm
  2024 WWW/2024/detecting-and-understanding-self-deleting-javascript-code — self-deleting JavaScript

extension (2): malicious browser extensions
  2014 USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions — malicious browser extensions (Hulk)
  2020 CCS/2020/youve-changed-detecting-malicious-browser-extensions-through-their-update-deltas — malicious extension updates

host-mining (7): mining malware on hosts, routers, IoT devices, CI or cloud; mining pools and traffic
  2019 CCS/2019/just-the-tip-of-the-iceberg-internet-scale-exploitation-of-routers-for-cryptojac — router cryptojacking (out of scope by brief)
  2019 IMC/2019/a-first-look-at-the-crypto-mining-malware-ecosystem-a-decade-of-unrestricted-wea — crypto-mining malware binaries
  2022 CCS/2022/ready-raider-one-exploring-the-misuse-of-cloud-gaming-services — cloud gaming misuse incl. mining
  2022 IEEE-SP/2022/robbery-on-devops-understanding-and-mitigating-illicit-cryptomining-on-continuou — mining on CI platforms
  2022 NDSS/2022/auto-draft-196 — IoT cryptojacking detection (out of scope by brief)
  2023 CCS/2023/under-the-dark-a-systematical-study-of-stealthy-mining-pools-ab-use-in-the-wild — stealthy mining pools
  2025* NDSS/2025/mineshark-cryptomining-traffic-detection-at-scale — cryptomining network traffic

search-abuse (9): search poisoning or SEO abuse whose destinations are generic or not malware
  2016 IEEE-SP/2016/seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t — promotional infections (SEO content injected into sites)
  2016 USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black — wildcard-DNS spider pools for blackhat SEO
  2017 IEEE-SP/2017/how-to-learn-klingon-without-a-dictionary-detection-and-measurement-of-black-key — black keywords in Chinese SEO
  2019 IEEE-SP/2019/measuring-and-analyzing-search-engine-poisoning-of-linguistic-collisions — search poisoning of misspellings
  2021 USENIX/2021/scalable-detection-of-promotional-website-defacements-in-black-hat-seo-campaigns — promotional defacements injected for SEO (aimed at search engines, not visitors' browsers)
  2022 NDSS/2022/auto-draft-261 — local-business search poisoning for illicit drugs
  2024 USENIX/2024/into-the-dark-unveiling-internal-site-search-abused-for-black-hat-seo — internal-site-search abuse for SEO (Baidu traffic)
  2025* USENIX/2025/unsafe-llm-based-search-quantitative-analysis-and-mitigation-of-safety-risks-in — AI search engines returning malicious URLs
  2026* WWW/2026/unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma — LLM search engines and black-hat SEO

infra (7): malicious URL / domain / hosting infrastructure without the served content
  2013 WWW/2013/two-years-of-short-urls-internet-measurement-security-threats-and-countermeasure — short-URL threats and countermeasures
  2016 CCS/2016/predator-proactive-recognition-and-elimination-of-domain-abuse-at-time-of-regist — malicious domains at registration time
  2021 USENIX/2021/compromised-or-attacker-owned-a-large-scale-classification-and-study-of-hosting — hosting domains of malicious URLs: compromised vs attacker-owned
  2025* IEEE-SP/2025/mantis-detection-of-zero-day-malicious-domains-leveraging-low-reputed-hosting-in — zero-day malicious domains from hosting
  2025* IMC/2025/dive-into-the-cloud-unveiling-the-ab-usage-of-serverless-cloud-function-in-the-w — abuse of serverless function domains
  2025* NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service — URL-shortener abuse
  2026* NDSS/2026/indicator-of-benignity-an-industry-view-of-false-positive-in-malicious-domain-detection-and-its-mitigation — false positives in malicious-domain detection

site-compromise (6): how sites get compromised, web-server malware, compromise prediction
  2013 NDSS/2013/behind-the-scenes-of-online-attacks-an-analysis-of-exploitation-behaviors-on-the — attacks against web honeypots (how sites get compromised)
  2013 WWW/2013/the-role-of-web-hosting-providers-in-detecting-compromised-websites — hosting providers' detection of compromised accounts
  2014 USENIX/2014/automatically-detecting-vulnerable-websites-before-they-turn-malicious — predicting which sites become malicious (compromise risk)
  2016 WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells — PHP web shells: what an attacker installs on a compromised server (server side)
  2019 CCS/2019/malmax-multi-aspect-execution-for-automated-dynamic-web-server-malware-analysis — PHP web-server malware analysis
  2023 NDSS/2023/doitrust-dissecting-on-chain-compromised-internet-domains-via-graph-learning — compromised domains via hidden hyperlinks

notification (1): notifying compromised sites (practices:notifying_websites)
  2016 WWW/2016/remedying-web-hijacking-notification-effectiveness-and-webmaster-comprehension — web hijacking notification and cleanup (practices:notifying_websites)

third-party-risk (8): third-party dependency and library risk without malicious content measured
  2015 CCS/2015/the-sicilian-defense-signature-based-whitelisting-of-web-javascript — script whitelisting; three-month crawl of how often top-site scripts change (why raw SRI hashes break)
  2017 WWW/2017/security-challenges-in-an-increasingly-tangled-web — implicit trust in third-party resources (no malicious content measured)
  2017 WWW/2017/who-controls-the-internet-analyzing-global-threats-using-property-graph-traversa — service-dependency graph
  2019 WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading — third-party dependency chains; VirusTotal "suspicious" includes data-mishandling trackers
  2020 WWW/2020/an-empirical-study-of-the-use-of-integrity-verification-mechanisms-for-web-subre — Subresource Integrity adoption in Common Crawl (security:headers); the defence against a swapped third-party script
  2021 NDSS/2021/whos-hosting-the-block-party-studying-third-party-blockage-of-csp-and-sri — third parties that block CSP/SRI deployment (security:headers)
  2023 IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda — vulnerable client-side libraries over four years (counts polyfill.io and Flash)
  2026* PETS/2026/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government — government-site tracker archaeology; describes the 2024 polyfill.io compromise

supply-chain (3): malicious packages in software registries (not served to visitors)
  2021 NDSS/2021/towards-measuring-supply-chain-attacks-on-package-managers-for-interpreted-languages — malicious packages in PyPI/npm/RubyGems
  2024 USENIX/2024/donapi-malicious-npm-packages-detector-using-behavior-sequence-knowledge-mapping — malicious npm packages
  2026* USENIX/2026/cutting-the-gordian-knot-detecting-malicious-pypi-packages-via-a-knowledge-minin — malicious PyPI packages

mobile (6): malicious or devious in-app mobile ads
  2014 CCS/2014/poster-adhoneydroid-capture-malicious-android-advertisements — malicious Android in-app ads (poster)
  2019 WWW/2019/revisiting-mobile-advertising-threats-with-madlife — in-app mobile ads (MAdLife)
  2020 WWW/2020/maddroid-characterizing-and-detecting-devious-ad-contents-for-android-apps — devious in-app ad content (MadDroid)
  2023 WWW/2023/are-mobile-advertisements-in-compliance-with-apps-age-group — mobile ads and app age groups
  2024 IMC/2024/whatcha-lookin-at-investigating-third-party-web-content-in-popular-android-apps — third-party web content in Android apps
  2026* USENIX/2026/when-fun-turns-toxic-a-first-look-at-aggressive-advertising-in-mini-games — mini-game ads

defence-lab (2): defence or forensics evaluated on simulated attacks only
  2020 CCS/2020/mnemosyne-an-effective-and-efficient-postmortem-watering-hole-attack-investigati — watering-hole forensics evaluated on simulated attacks
  2021 NDSS/2021/c2sr-cybercrime-scene-reconstruction-for-post-mortem-forensic-analysis — cybercrime-scene forensics

attack-capability (7): proof-of-concept abuse of a browser feature, not measured in the wild
  2018 CCS/2018/pride-and-prejudice-in-progressive-web-apps-abusing-native-app-like-features-in — PWA feature abuse shown as proof of concept
  2019 NDSS/2019/master-of-web-puppets-abusing-web-browsers-for-persistent-and-stealthy-computation — service-worker persistent computation (proof of concept)
  2023 USENIX/2023/r-b-ransomware-over-modern-web-browsers — browser ransomware proof of concept
  2024 NDSS/2024/compromising-industrial-processes-using-web-based-programmable-logic-controller-malware — web-based PLC malware proof of concept
  2024 IEEE-SP/2024/mawseo-adversarial-wiki-search-poisoning-for-illicit-online-promotion — adversarial wiki edits for illicit promotion (attack demonstration)
  2025* USENIX/2025/shadowed-realities-an-investigation-of-ui-attacks-in-webxr — WebXR UI attacks
  2026* USENIX/2026/overcoming-the-retrieval-barrier-indirect-prompt-injection-in-the-wild-for-llm-s — indirect prompt injection planted for LLM retrieval (attack demonstration; content aimed at agents, not people)

user-exposure (2): users' exposure to malicious content from telemetry or logs
  2014 CCS/2014/an-epidemiological-study-of-malware-encounters-in-a-large-enterprise — enterprise malware encounters from AV and proxy logs
  2018 CCS/2018/predicting-impending-exposure-to-malicious-content-from-user-behavior — predicting users' exposure from cellular HTTP logs

social-url (5): malicious URLs posted on social platforms (the post, not the content)
  2010 CCS/2010/detecting-and-characterizing-social-spam-campaigns — malicious wall posts on Facebook; URLs, not served content
  2012 NDSS/2012/warningbird-detecting-suspicious-urls-in-twitter-stream — suspicious URLs in the Twitter stream
  2012 USENIX/2012/efficient-and-scalable-socware-detection-in-online-social-networks — socware posts on Facebook
  2020 NDSS/2020/deceptive-previews-a-study-of-the-link-preview-trustworthiness-in-social-platforms — link previews on social platforms
  2021 NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media — unintended URLs in social posts

domain-abuse (4): parking, typosquatting, name systems (security:domain_abuse)
  2014 USENIX/2014/understanding-the-dark-side-of-domain-parking — domain parking monetisation (security:domain_abuse)
  2015 NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains — parked domains
  2015 NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse — typosquatting
  2022 IMC/2022/challenges-in-decentralized-name-management-the-case-of-ens — ENS names

cloaking (1): cloaking against crawlers as a method (programming:crawler_detection)
  2016 IEEE-SP/2016/cloak-of-visibility-detecting-when-machines-browse-a-different-web — Cloak of Visibility: cloaking against crawlers (method cited)

ads (2): problematic ads measured as ad content (privacy:advertising)
  2024 IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites — children's-site ads, a few linking to malicious content (privacy:advertising)
  2025* PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic — problematic allowed ads

web-vuln (6): vulnerabilities in sites (security:web_vulnerabilities)
  2020 NDSS/2020/fuse-finding-file-upload-bugs-via-penetration-testing — file-upload bugs
  2020 NDSS/2020/melting-pot-of-origins-compromising-the-intermediary-web-services-that-rehost-websites — web rehosting services
  2022 USENIX/2022/web-cache-deception-escalates — web cache deception
  2025* CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the — DOM gadgets
  2025* USENIX/2025/xssky-detecting-xss-vulnerabilities-through-local-path-persistent-fuzzing — XSS fuzzing
  2025* NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection — client-side open redirects (security:web_vulnerabilities)

download (1): trojanised software the user seeks out
  2012 CCS/2012/vanity-cracks-and-malware-insights-into-the-anti-copy-protection-ecosystem — trojanised cracks and keygens the user seeks out (not content served to an unwitting visitor)

ecosystem (3): exploit-kit server code, exploit trade and underground markets
  2015 NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration — EKHUNTER: 30 leaked exploit kits' SERVER code analysed in a lab and attacked; nothing served to a visitor is collected (re-adjudicated 2026-10-08)
  2017 CCS/2017/economic-factors-of-vulnerability-trade-and-exploitation — exploit trade on a cybercrime forum
  2025* USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram — cybercriminal Telegram channels

on-path (1): malicious or ad content injected into page traffic by network operators, not served by the site
  2016 USENIX/2016/website-targeted-false-content-injection-by-network-operators — out-of-band injection of ads and some malicious content by network operators

Cited outside the candidate set (found by the recall probe; context, not verdicts):
  CCS/2020/continuous-and-multiregional-monitoring-of-malicious-hosts — poster: malicious hosts probed from seven AWS regions for 16 months; behaviour by region (design:crawling_location)

CONTEXT papers from 2024–2026: 28 of 108; by code: attack-capability 4, infra 4, phishing 3, search-abuse 3, web-vuln 3, ads 2, javascript 2, mobile 2, supply-chain 2, host-mining 1, third-party-risk 1, ecosystem 1

=== PASS H — overlap with security:online_scams ===
IN here and IN on security:online_scams: 5 — 2018 betrayed-by-your-dashboard-discovering-malici (general); 2019 what-you-see-is-not-what-you-get-discovering- (malvertising); 2020 when-push-comes-to-ads-measuring-the-rise-of- (malvertising); 2021 where-are-you-taking-me-understanding-abusive (general); 2023 trident-towards-detecting-and-mitigating-web- (malvertising)
IN here, CONTEXT there: 6 — 2011 fashion-crimes-trending-term-exploitation-on- (there: search-abuse); 2011 surf-detecting-and-measuring-search-poisoning (there: search-abuse); 2011 deseo-combating-search-result-poisoning (there: search-abuse); 2012 knowing-your-enemy-understanding-and-detectin (there: ads); 2012 evilseed-a-guided-approach-to-finding-malicio (there: search-abuse); 2016 towards-measuring-and-mitigating-social-engin (there: search-abuse)
CONTEXT 'scams' here: 6, each of them a candidate there (IN, IN, IN, IN, IN, IN)

=== PASS I — full-text mentions over the whole corpus (upper bounds: a mention is not a measurement) ===
/coin-?hive/i: 17 papers; 2010–2013 0, 2014–2017 0, 2018–2021 15, 2022–2024 2, 2025–2026* 0
Coinhive shutdown (/coin-?hive.{0,120}(shut|discontinu|ceased|closed|terminat)|(shut|discontinu|ceased|closed|terminat).{0,120}coin-?hive/i): 7 papers; 2010–2013 0, 2014–2017 0, 2018–2021 6, 2022–2024 1, 2025–2026* 0
    2018 CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense (IN)
    2019 CCS/2019/just-the-tip-of-the-iceberg-internet-scale-exploitation-of-routers-for-cryptojac (CONTEXT)
    2019 USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking (IN)
    2019 WWW/2019/revisiting-mobile-advertising-threats-with-madlife (CONTEXT)
    2021 NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system (IN)
    2021 WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas (IN)
    2022 IEEE-SP/2022/robbery-on-devops-understanding-and-mitigating-illicit-cryptomining-on-continuou (CONTEXT)
/magecart/i: 4 papers; 2010–2013 0, 2014–2017 0, 2018–2021 1, 2022–2024 3, 2025–2026* 0
    2019 CCS/2019/hidenoseek-camouflaging-malicious-javascript-in-benign-asts (CONTEXT:javascript)
    2022 USENIX/2022/web-cache-deception-escalates (CONTEXT:web-vuln)
    2024 IEEE-SP/2024/signing-in-four-public-software-package-registries-quantity-quality-and-influenc (not a candidate)
    2024 NDSS/2024/sharing-cyber-threat-intelligence-does-it-really-help (not a candidate)
/polyfill\.io/i: 3 papers; 2010–2013 0, 2014–2017 0, 2018–2021 0, 2022–2024 2, 2025–2026* 1
    2023 IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda (CONTEXT:third-party-risk)
    2024 WWW/2024/phishing-vs-legit-comparative-analysis-of-client-side-resources-of-phishing-and (CONTEXT:phishing)
    2026* PETS/2026/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government (CONTEXT:third-party-risk)
named exploit kits (/\b(Angler|Blackhole|Nuclear|Magnitude|Neutrino|Sweet Orange|Fiesta|RIG) (exploit )?kit|\bRIG EK\b/i): 9 papers; 2010–2013 3, 2014–2017 3, 2018–2021 2, 2022–2024 1, 2025–2026* 0
    by year: 2012 2, 2013 1, 2014 2, 2015 1, 2018 1, 2019 1, 2022 1

=== PASS J — the post-2023 question: did the topic fade, or did the probes / the funnel miss it? ===
J1. Candidates and verdicts per year (2025–2026* provisional: CCS/IMC 2026 not held, S&P/WWW 2026 abstracts largely un-indexed):
year   corpus papers  candidates  IN  CONTEXT  OUT  IN per 1,000
-----  -------------  ----------  --  -------  ---  ------------
2010   119            5           2   1        2    16.8
2011   116            8           5   0        3    43.1
2012   151            12          4   3        5    26.5
2013   125            11          4   3        4    32.0
2014   166            14          3   6        5    18.1
2015   190            11          3   4        4    15.8
2016   182            15          3   8        4    16.5
2017   231            18          0   6        12   0.0
2018   254            17          4   4        9    15.7
2019   402            26          5   10       11   12.4
2020   404            17          1   9        7    2.5
2021   379            22          3   9        10   7.9
2022   546            18          1   9        8    1.8
2023   719            20          1   8        11   1.4
2024   690            15          0   9        6    0.0
2025*  770            22          0   12       10   0.0
2026*  415            10          0   7        3    0.0
candidates 2024–2026: 47 (IN 0, CONTEXT 28, OUT 19); CONTEXT 2024–2026 by code: attack-capability 4, infra 4, phishing 3, search-abuse 3, web-vuln 3, ads 2, javascript 2, mobile 2, supply-chain 2, host-mining 1, third-party-risk 1, ecosystem 1

J2. The funnel: where every INDEX (title + abstract) hit in the venue index stops.
venue index: 16864 records in 117 venue-year files (excluded, added on 2026-10-08: IMC-2026.json)
all 140 hits: A no abstract 0; B unlabelled 0; C screened out 21; D selected, not extracted 2; E extracted 117
2024–2026: 28 hits: A no abstract 0; B unlabelled 0; C screened out 9; D selected, not extracted 1; E extracted 18
  [C] 2010 WWW Alhambra: a system for creating, enforcing, and testing browser security policies. -> off: browser policy system
  [D] 2012 CCS You are what you include: large-scale evaluation of remote javascript inclusions. -> ON: remote JavaScript inclusion on 3M pages (third-party-risk); selected, no PDF retrieved
  [C] 2012 NDSS Chrome Extensions: Threat Analysis and Countermeasures -> off: extensions
  [C] 2014 CCS POSTER: Enhancing Security and Privacy with Google Glass. -> off
  [C] 2014 NDSS Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks -> off: hybrid-app access control
  [C] 2015 CCS POSTER: Page Table Manipulation Attack. -> off
  [C] 2018 CCS AST-Based Deep Learning for Detecting Malicious PowerShell. -> off: PowerShell
  [C] 2019 CCS Traceback for End-to-End Encrypted Messaging. -> off
  [C] 2019 CCS Poster: Detecting WebAssembly-based Cryptocurrency Mining. -> ON: Wasm cryptojacking detector (poster)
  [C] 2019 USENIX Robust Website Fingerprinting Through the Cache Occupancy Channel -> off
  [C] 2020 WWW MineThrottle: Defending against Wasm In-Browser Cryptojacking. -> ON: in-browser Wasm cryptojacking defence
  [C] 2021 CCS Secure Complaint-Enabled Source-Tracking for Encrypted Messaging. -> off
  [C] 2022 CCS Poster: Adversarial Perturbation Attacks on the State-of-the-Art Cryptojacking Detection System -> off: IoT cryptojacking (out of scope by brief)
  [C] 2025* CCS What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Manageme -> ON: LiMS link-integrity defence for third-party web resources, evaluated by simulated deployment on 450 domains (would be CONTEXT third-party-risk / defence-lab)
  [C] 2025* CCS Pixnapping: Bringing Pixel Stealing out of the Stone Age. -> off: Android pixel stealing
  [C] 2025* CCS GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search. -> off: retrieval poisoning
  [C] 2025* WWW Peripheral Instinct: How External Devices Breach Browser Sandboxes. -> off
  [C] 2025* WWW WasmGuard: Enhancing Web Security through Robust Raw-Binary Detection of WebAssembly Malware. -> ON: adversarially robust Wasm malware (incl. cryptojacker) detector on the WasmMal-15K dataset
  [C] 2025* WWW Beast in the Cage: A Fine-grained and Object-oriented Permission System to Confine JavaScript O -> ON-adjacent: permission system confining (possibly malicious) included scripts; defence
  [C] 2026* IEEE-SP GraphRAG Under Fire. -> off
  [C] 2026* USENIX Confundo: Learning to Generate Robust Poison for Practical RAG Systems -> off
  [D] 2026* USENIX Shielding QR Codes: Unveiling the Real-World Illicit Promotion Behind Adversarial QR Codes -> off: adversarial QR codes; selected, not extracted
  [C] 2026* USENIX What You Decode Depends on Where You Stand: Distance-Based Optical QR Code -> off
never extracted and on topic (ON or ON-adjacent): 6; 2024–2026: 3 (CCS 2025, WWW 2025, WWW 2025); before 2024: CCS 2012, CCS 2019, WWW 2020
INDEX hits that reached extraction but no full-text channel caught: 44; IN among them: 0

J3. Wider full-text vocabularies over every 2024–2026 paper outside the candidate set (detail: mwc_recent_probe-output.txt):
2024–2026 papers outside the candidates: 1828; WIDE >= 5: 53; any NEW-phenomenon string: 24; web-platform must-read: 32, IN among them: 0
NEW-phenomenon strings (papers): technical support scams 21; technical support scam 6; tech support scams 3; wallet drainer 1; seo poisoning 1; crypto drainers 1; socgholish 1

J4. Named phenomena in full text, papers per year (any mention; a mention is not a measurement):
phrase                            2016  2017  2018  2019  2020  2021  2022  2023  2024  2025*  2026*
--------------------------------  ----  ----  ----  ----  ----  ----  ----  ----  ----  -----  -----
cryptojack*                       0     0     4     10    3     7     8     9     7     10     3
coinhive                          0     0     4     8     0     3     2     0     0     0      0
exploit kit                       6     8     4     5     1     2     3     1     4     2      0
drive-by download                 13    14    6     15    10    9     5     11    3     7      3
malvertis*                        6     10    5     12    9     12    5     5     7     5      1
magecart / web skimm*             0     0     0     2     0     0     1     0     3     0      0
polyfill.io                       0     0     0     0     0     0     0     1     1     0      1
ClickFix / fake CAPTCHA           1     0     0     1     0     1     0     0     0     0      0
fake browser update / SocGholish  1     1     0     1     0     0     0     0     0     1      0
wallet drainer                    0     0     0     0     0     0     0     1     1     2      0
corpus papers per year: 2016 182, 2017 231, 2018 254, 2019 402, 2020 404, 2021 379, 2022 546, 2023 719, 2024 690, 2025* 770, 2026* 415

=== PASS K — artifacts the IN papers released (extraction links; live status is checked by external_checks_mwc.sh) ===
  2010 blade-an-attack-agnostic-approach-for-preventing-d public                       www.blade-defender.org/eval-lab www.blade-defender.org http://www.alexa.com/topsites/category http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
  2010 detection-and-analysis-of-drive-by-download-attack public                       http://wepawet.cs.ucsb.edu http://htmlunit.sourceforge.net/ http://www.mozilla.org/rhino/ http://code.google.com/apis/safebrowsing/ http://www.spamcop.net/ https://projects.honeynet.org/capture-hpc http://www.clamav.net/ http://cve.mitre.org/
  2011 fashion-crimes-trending-term-exploitation-on-the-w none-mentioned               https://code.google.com/apis/websearch/ https://easylistdownloads.adblockplus.org/easylist.txt http://www.google.com/insights/search/ https://adwords.google.com/select/TrafficEstimatorSandbox http://www.google.com/trends/ http://dev.twitter.com/doc/get/trends/ http://siteexplorer.search.yahoo.com/
  2011 surf-detecting-and-measuring-search-poisoning      none-mentioned               http://www.google.com/trends. http://www.urlvoid.com/. http://www.mywot.com/wiki/API.
  2011 deseo-combating-search-result-poisoning            none-mentioned               http://s3.amazonaws.com/alexa-static/top-1m.csv.zip http://www.google.com/trends
  2011 arrow-generating-signatures-to-detect-drive-by-dow none-mentioned               http://blog.unmaskparasites.com/2009/11/11/hackers-usetwitter-api-to-trigger-malicious-scripts/
  2011 prophiler-a-fast-filter-for-the-large-scale-detect none-mentioned               http://wepawet.cs.ucsb.edu/ http://crawler.archive.org/ http://www.alexa.com/topsites/ http://nekohtml.sourceforge.net/ http://htmlparser.sourceforge.net/ http://www.mozilla.org/rhino/
  2012 knowing-your-enemy-understanding-and-detecting-mal none-mentioned               www.madtracer.org http://easylist.adblockplus.org/en/ http://www.whois.net/
  2012 manufacturing-compromise-the-emergence-of-exploit- none-mentioned               http://atlas.arbor.net https://sie.isc.org/ http://www.malwaredomainlist.com
  2012 evilseed-a-guided-approach-to-finding-malicious-we none-mentioned               http://goo.gl/vIYfk http://goo.gl/wGacG http://goo.gl/qmPA8
  2013 delta-automatic-identification-of-unknown-web-base none-mentioned               http://www.archive.org
  2013 shady-paths-leveraging-surfing-crowds-to-detect-ma none-mentioned               http://www.alexa.com
  2013 finding-the-linchpins-of-the-dark-web-a-study-on-t none-mentioned               http://www.alexa.com/topsites https://dev.twitter.com/docs/using-search https://easylist-downloads.adblockplus.org/easylist.txt https://easylist-downloads.adblockplus.org/easyprivacy.txt http://mirror1.malwaredomains.com/files/url_shorteners.txt https://dnsdb.isc.org/doc/isc-dnsdb-api.html https://sie.isc.org/ http://www.whois.net/
  2013 revolver-an-automated-approach-to-the-detection-of none-mentioned               http://htmlunit.sourceforge.net/ http://goo.gl/XzJ7M
  2014 hunting-the-red-fox-online-understanding-and-detec none-mentioned               https://developers.google.com/speed/libraries/devguide https://code.google.com/p/google-diff-match-patch/ http://http://windows.microsoft.com/en-us/windows/security-essentials-download/ https://developers.google.com/safe-browsing/ https://www.virustotal.com/ https://api.dnsdb.info/ https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/ http://www.codeproject.com/Articles/4617/A-JavaScript-Compression-Tool-for-Web-Applications
  2014 the-dark-alleys-of-madison-avenue-understanding-ma none-mentioned               https://easylist.adblockplus.org http://virustotal.com
  2014 cyberprobe-towards-internet-scale-active-detection none-mentioned               http://virusshare.com/ http://malicia-project.com/ http://urlquery.net/ http://www.routeviews.org/ http://www.alexa.com/ http://search.cpan.org/⇠xern/HTML-Similarity-0.2.0/lib/HTML/Similarity.pm/ http://www.snort.org/ http://suricata-ids.org/ http://libevent.org/ http://www.tcpdump.org/ http://malwaredomainlist.com/ http://vxvault.siri-urz.net
  2015 webwitness-investigating-categorizing-and-mitigati none-mentioned               https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms
  2015 understanding-malvertising-through-ad-injecting-br none-mentioned               https://chrome.google.com/webstore/ https://www.virustotal.com/ http://extensiondefender.com/submit.php http://extensiondefender.com/ http://nodejs.org/ http://docs.seleniumhq.org/ https://developers.google.com/chrome-developer-tools/docs/debugger-protocol http://w3techs.com/technologies/overview/top_level_domain/all
  2016 lurking-malice-in-the-cloud-understanding-and-dete none-mentioned               https://commoncrawl.org/ http://support.clean-mx.de/clean-mx/viruses.php https://www.virustotal.com/ http://www.morningstarsecurity.com/research/whatweb http://docs.scipy.org/doc/scipy/reference/generated/scipy.cluster.hierarchy.linkage.html http://scikit-learn.org/stable/modules/generated/sklearn.svm.SVC.html
  2016 towards-measuring-and-mitigating-social-engineerin none-mentioned               https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/nelms https://adblockplus.org/
  2016 automatic-extraction-of-indicators-of-compromise-f none-mentioned               https://developers.google.com/safe%2Dbrowsing/ https://www.virustotal.com https://meanpath.com/
  2018 how-you-get-shot-in-the-back-a-systematical-study- public                       https://github.com/deluser8/cmtracker https://github.com/cyrus-and/chrome-remote-interface https://github.com/easylist/easylist https://github.com/keraf/NoCoin https://github.com/xd4rker/MinerBlock https://www.similarweb.com/ https://coinhive.com/ https://www.eia.gov/tools/faqs/faq.php?id=97&t=3 https://www.coingecko.com/en/price_charts/monero/usd
  2018 minesweeper-an-in-depth-look-into-drive-by-cryptoc public                       https://github.com/vusec/minesweeper https://www.alexa.com https://github.com/WebAssembly/wabt https://perf.wiki.kernel.org/index.php/Main_Page https://www.similarweb.com https://minecryptonight.net https://github.com/1lastBr3ath/drmine https://zerodot1.gitlab.io/CoinBlockerListsWeb
  2018 digging-into-browser-based-crypto-mining           public                       https://doi.org/10.5281/zenodo.1421702 https://github.com/hoshsadiq/adblock-nocoin-list http://web.archive.org/web/20180516095136/https://www.symantec.com/products/rulespace http://pir.org/ verisign.com
  2018 betrayed-by-your-dashboard-discovering-malicious-c none-mentioned               https://publicwww.com http://spyonweb.com https://openphish.com/
  2019 tales-from-the-porn-a-comprehensive-privacy-analys none-mentioned               http://only4adults.com http://toppornsites.com/ mypornbible.com https://www.alexa.com/topsites/ http://alexa.com/topsites/category/Top/Adult https://easylist.to https://github.com/disconnectme/disconnect-tracking-protection https://www.virustotal.com https://nordvpn.com https://privatevpn.com/
  2019 what-you-see-is-not-what-you-get-discovering-and-t public                       https://github.com/phani-vadrevu/seacma
  2019 inadvertently-making-cyber-criminals-rich-a-compre public                       https://www.cyber-threatintelligence.com/cryptojacking-campaigns https://www.webshrinker.com/apis/ http://s3.amazonaws.com/alexa-static/top-1m.csv.zip http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip http://downloads.majestic.com/majestic_million.csv
  2019 outguard-detecting-in-browser-covert-cryptocurrenc public                       https://github.com/teamnsrg/outguard https://github.com/ZeroDot1/CoinBlockerLists https://github.com/xd4rker/MinerBlock/blob/master/assets/filters.txt https://github.com/keraf/NoCoin/blob/master/src/js/background.js http://easylist.to http://www.ghostery.com https://censys.io/ https://www.wappalyzer.com/download https://github.com/scikit-learn/scikit-learn https://chromedevtools.github.io/devtools-protocol/
  2020 when-push-comes-to-ads-measuring-the-rise-of-malic promised-not-yet-available   https://publicwww.com/examples/ads.html https://safebrowsing.google.com/ https://www.virustotal.com/ https://easylist.to/
  2021 minos-a-lightweight-real-time-cryptojacking-detect none-mentioned               https://github.com/notgiven688/webminerpool https://www.virustotal.com/ https://virusshare.com/ https://github.com/hoshsadiq/adblock-nocoin-list https://madewithwebassembly.com/ https://pptr.dev/ https://publicwww.com/
  2021 an-empirical-study-of-real-world-webassembly-binar public                       https://github.com/sola-st/WasmBench https://httparchive.org/ https://madewithwebassembly.com/ https://github.com/mbasso/awesome-wasm https://www.webassemblygames.com/ https://github.com/sola-st/wasm-binary-security
  2021 where-are-you-taking-me-understanding-abusive-traf on-request                   https://github.com/jszurdi/ODIN/ http://s3.amazonaws.com/alexa-static/top-1m.csv.zip https://developers.google.com/safe-browsing/v4/update-api https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.RandomForestClassifier.html https://keras.io/applications/
  2022 mistrust-plugins-you-must-a-large-scale-study-of-m public                       https://cyfi.ece.gatech.edu/ https://wordpress.org/plugins/ https://wordpress.org/themes/ https://github.com/ https://codecanyon.net/ https://themeforest.net/ https://premium.wpmudev.org/ https://easydigitaldownloads.com/ https://www.virustotal.com/en https://www.urlhaus.com
  2023 trident-towards-detecting-and-mitigating-web-based public                       https://github.com/ian7yang/trident https://publicwww.com/ https://virustotal.com https://developers.google.com/safe-browsing/ https://github.com/blocklistproject/Lists https://pptr.dev/ https://chromedevtools.github.io/devtools-protocol/ https://github.com/brave/adblock-rust https://man7.org/linux/man-pages/man1/ps.1.html
IN papers whose extracted links list is non-empty (third-party URLs included; NOT a release rate — use artifacts.availability): 36 of 39

=== PASS L — records added to the corpus on 2026-10-08, after this page's snapshot (probed, not counted) ===
extraction records: 5964 in the file, 5859 in the snapshot (extractedAt < 2026-10-08), 105 added; by venue-year: IEEE-SP 2024 11, IEEE-SP 2021 1, IEEE-SP 2023 1, IMC 2026 92
  IEEE-SP 2024 gap 2 mine 0 drive 0 malv 0 skim 0 | On SMS Phishing Tactics and Infrastructure.
  IEEE-SP 2024 gap 1 mine 1 drive 0 malv 0 skim 0 | SoK: A Comprehensive Analysis and Evaluation of Docker Container Attack and Defense Mechan
  IMC 2026 gap 0 mine 0 drive 0 malv 0 skim 2 | EU Digital Sovereignty in Practice: A Technical Assessment of Digital Infrastructure Depen
  IMC 2026 gap 1 mine 3 drive 0 malv 0 skim 0 | Dissecting Mellowtel: Bandwidth-as-a-Service Through Browser Extensions
  IMC 2026 gap 1 mine 0 drive 0 malv 0 skim 0 | Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment
  IMC 2026 gap 2 mine 2 drive 0 malv 0 skim 0 | The Long Road to Web Accessibility: Three Decades of Retrospective Analysis
  IMC 2026 gap 0 mine 0 drive 0 malv 0 skim 0 SCHEMA  <-- CROSSES A THRESHOLD; verdict: would be IN (section, injected): dangling-DNS names of legitimate domains serving attacker content; 55 (0.4%) of sampled hostnames flagged by >= 3 VirusTotal engines. Added to the corpus 2026-10-08, after the snapshot; named on the page, not counted | Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse
added records crossing a candidate threshold without a POST_VERDICTS entry: 0; with one: 1
</file>

===== Figure and quote verification, unedited =====

<file text verify_mwc_figures-output.txt>
OK   konoth2018_minesweeper     paper.cols.txt         "# of crawled websites 991,513 # of drive-by mining websites 1,735 (0.18%)"  [drive-by mining sites of crawled sites]
OK   konoth2018_minesweeper     paper.cols.txt         "March 19, 2018 # of crawled websites 991,513"  [crawled websites]
OK   konoth2018_minesweeper     paper.cols.txt         "Dr. Mine could only find 272 websites, while MineSweeper found 785 websites"  [CoinBlockerLists-based tool vs MineSweeper]
OK   konoth2018_minesweeper     paper.cols.txt         "relying only on pattern matching on the payload would result in 6.23% false negatives"  [signature FN]
OK   konoth2018_minesweeper     paper.cols.txt         "for detection would result in 11.36% false negatives"  [CPU-threshold FN]
OK   konoth2018_minesweeper     paper.cols.txt         "We only spend four seconds on each webpage"  [undercount: dwell]
OK   konoth2018_minesweeper     paper.cols.txt         "are not served on every visit"  [undercount: ad-served miners]
OK   rueth2018_digging          paper.cols.txt         "up to 82% of thereby identified mining websites are not detected by block lists"  [blocklist miss]
OK   rueth2018_digging          paper.cols.txt         "0.08% of the probed sites"  [prevalence]
OK   hong2018_shot              paper.cols.txt         "53.9% of these identified samples would have not been identified with current widely used detectors based on blacklists"  [blocklist miss]
OK   hong2018_shot              pypdf                  "2,770 unique cryptojacking samples from 853,936 popular web pages"  [census]
OK   bijmans2019_inadvertently  paper.cols.txt         "We have identified 21,022 websites with traces of cryptomining activities of which 10,100 websites are actively mining"  [census]
OK   kharraz2019_outguard       paper.cols.txt         "found 6,302 cryptojacking sites, of which 3,600 are new detections"  [census]
OK   naseem2021_minos           paper.cols.txt         "we were able to determine 34 unique websites (adult, streaming, forums, etc.) that still perform cryptojacking operations using Wasm"  [sites still mining after April 2020]
OK   naseem2021_minos           paper.cols.txt         "try to use the obsolete Coinhive mining service. Since Coinhive is no longer maintained, these samples do not perform any mining operations"  [AV labels obsolete samples]
OK   hilbig2021_real            pypdf                  "Among the 352 analyzed binaries, VirusTotal reports four files to contain malicious content"  [Wasm census]
OK   vadrevu2019_discovering    pypdf                  "only 11,341 (16%) were observed to host SEACMA ads"  [single-visit undercount]
OK   vadrevu2019_discovering    paper.cols.txt         "GSB detected only a small percentage (16.2% overall)"  [blocklist miss]
OK   vadrevu2019_discovering    pypdf                  "respond to ad requests from our institution"  [vantage filtering]
OK   subramani2020_push         paper.cols.txt         "51% of all WPN ads we collected are malicious"  [prevalence]
OK   subramani2020_push         paper.cols.txt         "less than 1% of the URLs were detected as malicious by GSB or VT"  [blocklist miss]
OK   szurdi2021_where           paper.cols.txt         "81% more malicious pages"  [profiles]
OK   szurdi2021_where           paper.cols.txt         "only labels 92 out of the 3,746 malicious pages"  [GSB same day]
OK   szurdi2021_where           paper.cols.txt         "could decrease by half the number of malicious pages observed"  [cloaking halves]
OK   lu2011_surf                paper.cols.txt         "failed to detect 78.9% of malicious terminal pages"  [scanner miss]
OK   lu2011_surf                paper.cols.txt         "the average life time of a rogue landing page involved in search poisoning is only 1.7 days"  [lifetime]
OK   li2012_knowing             paper.cols.txt         "more than 1% of these well-maintained sites have been exploited"  [prevalence]
OK   li2012_knowing             paper.cols.txt         "15 times as many as Google Safe Browsing and Microsoft Forefront"  [blocklist miss]
OK   grier2012_manufacturing    paper.cols.txt         "Blackhole accounting for 29% of all malicious URLs"  [exploit-kit share]
OK   grier2012_manufacturing    paper.cols.txt         "77,000 malicious URLs"  [feed size]
OK   lu2010_blade               pypdf                  "The average detection rate of these binaries from virustotal.com was only 28.43%"  [AV miss]
OK   lu2010_blade               pypdf                  "Only about half of the malicious URLs were observed to be delivering drive-by download attacks when tested"  [feed rot]
OK   nappa2014_cyberprobe       paper.cols.txt         "VirusTotal, which knows 25.7% of the servers found by CyberProbe (50/194)"  [feed miss]
OK   nelms2015_webwitness       pypdf                  "less than 10% of these domains ever appeared on a public blacklist"  [blocklist miss]
OK   nelms2015_webwitness       paper.cols.txt         "64% of the download paths started with a search"  [search origin]
PART nelms2016_mitigating       PARTIAL pypdf 4/5      "of all malicious executables were labeled by the AVs"  [AV coverage]
OK   cova2010_detection         paper.cols.txt         "ClamAV missed most of the attacks (80.6%)"  [AV miss]
OK   starov2018_betrayed        pypdf                  "only 18.9% of the newly discovered websites are marked as malicious"  [feed miss]
OK   moore2011_fashion          paper.cols.txt         "are not blocked by the Safe Browsing API"  [blocklist miss]
OK   kolbitsch2012_rozzle       paper.cols.txt         "served only once to a given IP address/subnet or only once within a given time period"  [one-shot serving]
OK   kolbitsch2012_rozzle       paper.cols.txt         "most malicious code contains at least some form of cloaking, environment matching, or fingerprinting"  [environment checks]
OK   invernizzi2012_evilseed    pypdf                  "26.2% of the URLs tested were in fact cloaked"  [cloaking share]
OK   li2013_finding             paper.cols.txt         "76.2% of the malicious paths"  [dedicated hosts]
OK   li2013_finding             paper.cols.txt         "later give 404 responses or forward the crawler to google.com on subsequent visits"  [TDS IP filtering]
OK   kasturi2022_mistrust       paper.cols.txt         "47,337 malicious plugins on 24,931 unique websites"  [census from backups]
OK   zhang2019_your             pypdf                  "437 third-party scripts that intercepted user clicks on 613 websites"  [census]
OK   zarras2014_dark            paper.cols.txt         "673,596 unique advertisements"  [ads crawled]
OK   zarras2014_dark            paper.cols.txt         "we identified 6,601 incidents in which the advertisements triggered our detection framework"  [incidents]
OK   kapravelos2013_revolver    paper.cols.txt         "4,147 evasive scripts"  [evasions found]
OK   vallina2019_porn           paper.cols.txt         "There are 7 porn websites classified as a potentially malicious by VirusTotal"  [section]
OK   li2014_hunting             paper.cols.txt         "436,869 unique compromised files"  [census]
OK   liao2016_lurking           paper.cols.txt         "694 malicious or compromised repositories"  [census]
OK   yang2023_trident           pypdf                  "258,008 navigation events initiated by JS code"  [navigations]
OK   canali2011_prophiler       paper.cols.txt         "18,939,908 pages"  [scale]
OK   xing2015_malvertising      paper.cols.txt         "18,030 Chrome extensions"  [scale]
OK   john2011_deseo             paper.cols.txt         "these links were not blocked by either the Google Safebrowsing API or Internet Explorer"  [blocklist miss]
OK   stringhini2013_shady       paper.cols.txt         "SpiderWeb detected 778 URLs as malicious that went undetected by the AV vendor"  [AV miss]
OK   borgolte2013_delta         pypdf                  "26,459,103 distinct web site pairs"  [scale]
OK   zhang2011_arrow            paper.cols.txt         "3.5 billion HTTPTraces"  [scale]
OK   hilbig2021_real            paper.cols.txt         "cryptomining, which once accounted for the majority of all WebAssembly code, has been marginalized (less than 1% of all binaries found on the web)"  [mining marginal by 2020]
OK   lim2023_longitudinal       paper.cols.txt         "99.7% of websites have at least one externally-hosted JavaScript library without the integrity attribute"  [SRI absent]
OK   lim2023_longitudinal       paper.cols.txt         "Polyfill.io [93] 6,755 (0.9%)"  [polyfill.io as a library]
OK   singh2026_empire           paper.cols.txt         "polyfill.io (41)"  [government sites in 41 countries]
OK   singh2026_empire           paper.cols.txt         "The polyfill.io compromise: In June 2024"  [describes the incident]
OK   konoth2018_minesweeper     paper.cols.txt         "# of drive-by mining campaigns 20"  [campaigns]
OK   konoth2018_minesweeper     paper.cols.txt         "visit three random internal pages of each website"  [crawl design]
OK   konoth2018_minesweeper     paper.cols.txt         "The crawler stayed for four seconds on each visited page"  [crawl design]
OK   konoth2018_minesweeper     paper.cols.txt         "March 12, 2018 - March 19, 2018"  [window]
OK   kolbitsch2012_rozzle       paper.cols.txt         "almost seven times"  [offline gain]
OK   vadrevu2019_discovering    paper.cols.txt         "93,427 distinct publisher websites"  [publisher population]
OK   vadrevu2019_discovering    pypdf                  "will not always result in displaying"  [single visit]
OK   vadrevu2019_discovering    pypdf                  "our institution's machines, Tor exit nodes, and Amazon AWS IP ranges"  [vantage filtering]
OK   vadrevu2019_discovering    pypdf                  "avoiding multiple visits to publisher websites using the same user agent"  [ethics]
OK   vadrevu2019_discovering    paper.cols.txt         "USD $4.8"  [ethics cost]
OK   vadrevu2019_discovering    paper.cols.txt         "visit each milkable URL once every 15 minutes"  [milking]
OK   lu2010_blade               pypdf                  "Prior to visiting each URL, the testbed reverts the VM"  [isolation]
OK   rueth2018_digging          paper.cols.txt         "crawls of 137M .com/.net/.org domains and the Alexa Top 1M list"  [population]
OK   rueth2018_digging          paper.cols.txt         "< 0.08% of the probed sites"  [prevalence, as printed]
OK   liao2016_lurking           paper.cols.txt         "we found around 1 million sites utilizing 6,885 repositories hosted on these clouds"  [denominator]
OK   kasturi2022_mistrust       paper.cols.txt         "47,337 malicious plugin installs on 24,931 unique websites"  [census]
OK   kasturi2022_mistrust       paper.cols.txt         "nightly backups of over 400K unique WordPress websites"  [data source]
OK   kasturi2022_mistrust       paper.cols.txt         "collected from July 2012 to July 2020"  [window]
OK   li2014_hunting             paper.cols.txt         "1,558,690 doorway URLs"  [denominator]
OK   zhang2019_your             paper.cols.txt         "the Alexa top 250K websites"  [population]
OK   zhang2019_your             paper.cols.txt         "228,614 (91.45%)"  [valid data]
OK   kharraz2019_outguard       paper.cols.txt         "deploying it across the Alexa Top 1M websites"  [population]
OK   yang2023_trident           paper.cols.txt         "we crawled over 100K … websites from October 2021 to January 2022"  [crawl]
OK   li2012_knowing             paper.cols.txt         "among them 53,100 are publisher pages"  [denominator]
OK   li2013_finding             paper.cols.txt         "nearly 4 million malicious URL paths"  [denominator]
OK   subramani2020_push         paper.cols.txt         "572 WPN ad campaigns, for a total of 5,143 WPN-based ads"  [denominator]
OK   vadrevu2019_discovering    paper.cols.txt         "Total 2042 1.42% 16.21%"  [GSB denominator and rates (Table 4; the page prints 2,042)]
OK   naseem2021_minos           paper.cols.txt         "shared publicly on the 21st of April, 2020"  [date of the sample source]
OK   bijmans2019_inadvertently  paper.cols.txt         "# websites crawled 1,769,183 (93%) # potential cryptojacking websites 21,022"  [first-crawl denominator]
OK   bijmans2019_inadvertently  paper.cols.txt         "The crawl started on the December 24, 2018 and completed on January 9, 2019"  [first-crawl window]
OK   bijmans2019_inadvertently  paper.cols.txt         "random sample of ~20% of the websites in 1,136 TLDs"  [TLD sample]
OK   bijmans2019_inadvertently  paper.cols.txt         "random sample of 49M domains, ~20% of the Internet, we conclude that cryptojacking is present on 0.011% of all domains"  [TLD-sample prevalence]
OK   rueth2018_digging          paper.cols.txt         "Alexa 993 129 737 129 608 (82%)"  [Alexa row of Table 2]
OK   rueth2018_digging          paper.cols.txt         ".org 978 450 1372 450 922 (67%)"  [.org zone row of Table 2 (the 82% is the Alexa row)]
OK   li2012_knowing             paper.cols.txt         "By crawling just the top 90,000 Alexa home pages"  [denominator]
OK   li2012_knowing             paper.cols.txt         "have been exploited to deliver malicious contents or to conduct fraudulent clicks"  [includes click fraud]
OK   cova2010_detection         paper.cols.txt         "Total 823 2 (0.2%) 664 (80.6%)"  [known-bad datasets row]
OK   invernizzi2012_evilseed    paper.cols.txt         "Total 1,219,090 319,949 26.2%"  [all URLs from the search gadgets]
OK   grier2012_manufacturing    paper.cols.txt         "along with a crowd-sourced feed of blacklisted URLs known to direct to exploit kits"  [second feed]
OK   subramani2020_push         paper.cols.txt         "1,388 (11.31%)"  [VT a month later]
OK   yang2023_trident           paper.cols.txt         "we obtained 1,479 positive samples for the training dataset, of which Brave Shields missed 14.74%"  [list caught most]
OK   stringhini2013_shady       paper.cols.txt         "In total, these graphs led to 3,368 URLs"  [denominator]
OK   nelms2016_mitigating       paper.cols.txt         "even after "aging" and rescanning"  [AV coverage clause]
OK   kharraz2019_outguard       paper.cols.txt         "had approximately 40% more coverage than MinerBlock"  [list comparison]
OK   szurdi2021_where           paper.cols.txt         "miss the vast majority of malicious pages targeting mobile users"  [mobile]
OK   (post-snapshot, footnote)  paper.cols.txt         "55 (0.4%) of the 13.5 k dangling DNS domains studied are flagged as malicious by"  [post-snapshot IMC 2026 section]
mutant rejected: "Dr. Mine could only find 273 websites, while MineSweeper found 785 websites"
mutant rejected: "up to 83% of thereby identified mining websites are not detected by block lists"
mutant rejected: "only labels 93 out of the 3,746 malicious pages"
needles under 20 characters: 6 — "18,939,908 pages", "polyfill.io (41)", "almost seven times", "USD $4.8", "228,614 (91.45%)", "1,388 (11.31%)"

110 needles over 40 papers: 109 exact, 1 partial (column splice), 0 FAILED
</file>

<file text mwc_page_quotes_check-output.txt>
needle   "will not always result in displaying"
needle   "only once to a given IP address/subnet"
own      "We crawled the top million for malicious JavaScript"
needle   "drive-by download"
external "by a single threat actor that leverages adult traffic schemes"
external "five full iOS exploit chains and a total of 23 exploits"
external "as a hidden iFrame on many compromised Ukrainian websites"
external "only delivered to selected iPhone users from a specific geolocation"
external "a very large set of fake Chinese websites mostly related to finance"
external "discontinue our service on March 8, 2019"
needle   "less than 1% of all binaries found on the web"
external "spread across 3,500+ infected websites"
external "impacted nearly one million devices globally"
external "originated from illegal streaming websites embedded with malvertising redirectors"
external "malware disguised as software downloads"
external "from compromised legitimate websites, an atypical method for ransomware actors"
external "a web inject activity cluster that compromises legitimate websites with malicious HTML and JavaScript"
external "distributing fake browser updates via compromised websites"
external "14.971 websites infected with SocGholish malware were remediated"
external "have increased significantly"
external "We observed attempted misuse of 15 of the 50 payment cards."
own      "No paper since 2023"
external "against recent supply chain attacks"
external "simulating deployments on a representative sample of 450 domains"
needle   "55 (0.4%) of the 13.5 k dangling DNS domains studied are flagged as malicious by"
needle   "relying only on pattern matching on the payload would result in 6.23% false negatives"
needle   "for detection would result in 11.36% false negatives"
external "on hold indefinitely"
needle   "try to use the obsolete Coinhive mining service. Since Coinhive is no longer maintained, these samples do not perform any mining operations"
needle   "up to 82% of thereby identified mining websites are not detected by block lists"
needle   "53.9% of these identified samples would have not been identified"
needle   "less than 1% of the URLs"
needle   "only 18.9% of the newly discovered websites are marked as malicious"
needle   "15 times as many"
needle   "failed to detect 78.9%"
needle   "are not blocked by the Safe Browsing API"
needle   "ClamAV missed most of the attacks (80.6%)"
needle   "less than 10% of these domains ever appeared on a public blacklist"
needle   "Brave Shields missed 14.74%"
needle   "went undetected by the AV vendor"
needle   "had approximately 40% more coverage than MinerBlock"
external "as of 2021, 60% of sites that deliver attacks live less than 10 minutes"
external "dedicated to sharing malicious URLs that are being used for malware distribution"
needle   "will not always result in displaying"
needle   "are not served on every visit"
needle   "our institution's machines, Tor exit nodes, and Amazon AWS IP ranges"
needle   "only once to a given IP address/subnet or only once within a given time period"
needle   "later give 404 responses or forward the crawler to google.com on subsequent visits"
needle   "could decrease by half the number of malicious pages observed"
needle   "Most malicious code contains at least some form of cloaking, environment matching, or fingerprinting"
needle   "were in fact cloaked"
needle   "miss the vast majority of malicious pages targeting mobile users"
needle   "only about half of the malicious URLs were observed to be delivering drive-by download attacks when tested"
external "the transition of the domain polyfill.io to a new provider (Funnull)"
external "100K+ sites embed it using the cdn.polyfill.io domain"
external "only activates on specific mobile devices at specific hours"
external "does not activate when it detects an admin user"
external "rewrite any link to polyfill.io found in a website proxied by Cloudflare"
external "still detects 384,773 hosts embedding a polyfill JS script linking to the malicious domain"
external "purchased a repository of code used by web developers and maliciously altered the code to redirect visitors of legitimate websites to scam websites and online gambling sites"
needle   "99.7% of websites have at least one externally-hosted JavaScript library without the integrity attribute"
external "not susceptible to attacks from scripts"
needle   "< 0.08% of the probed sites"
needle   "less than 1% of all binaries found on the web"
needle   "more than 1% of these well-maintained sites have been exploited"
needle   "51% of all WPN ads we collected are malicious"
needle   "accounting for 29% of all malicious URLs"
needle   "76.2% of the malicious paths"
own      "not malicious"
own      "not shown to us"

70 quoted spans; 0 not inside any needle or external phrase
</file>

===== External checks, unedited =====

<file text external_checks_mwc-output.txt>
== 1. What ended in-browser mining and mass exploit kits ==
OK   [200] Coinhive discontinuation (Wayback copy of operator blog) — "We will discontinue our service on March 8, 2019." (https://web.archive.org/web/20190227043456/https://coinhive.com/blog/en/discontinuation-of-coinhive)
OK   [200] Coinhive: Monero hard fork and XMR crash — "The drop in hash rate (over 50%) after the last Monero hard fork hit us hard." (https://web.archive.org/web/20190227043456/https://coinhive.com/blog/en/discontinuation-of-coinhive)
OK   [200] Adobe Flash EOL (Wayback copy of Adobe FAQ) — "Adobe will stop distributing and updating Flash Player after December 31, 2020" (https://web.archive.org/web/20200516040705/https://www.adobe.com/products/flashplayer/end-of-life.html)
OK   [200] Chromium Flash removal — "Flash Support Removed from Chromium (Target: Chrome 88+ - Jan 2021)" (https://www.chromium.org/flash-roadmap/)
OK   [200] Firefox ends Flash — "On January 26, 2021, Firefox will end support for Adobe Flash." (https://blog.mozilla.org/futurereleases/2020/11/17/ending-firefox-support-for-flash/)
OK   [200] IE11 desktop app permanently disabled — "permanently disabled on certain versions of Windows 10 on February 14, 2023" (https://techcommunity.microsoft.com/blog/windows-itpro-blog/internet-explorer-11-desktop-app-retirement-faq/2366549)
OK   [200] Exploit kits still seen in 2023 (Malwarebytes/ThreatDown, vendor) — "The RIG exploit kit continues to be used by a single threat actor that leverages adult traffic schemes." (https://www.threatdown.com/blog/old-exploit-kits-still-kicking-around-in-2023/)
OK   [200] Firefox 69 blocks cryptominers by default — "empower and protect all our users by blocking third-party tracking cookies and cryptominers" (https://blog.mozilla.org/en/firefox/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/)
OK   chromestatus 4800491902992384 Heavy Ad Intervention summary (60 s main thread, 4 MB)
OK   [200] BlueMoon exploit kit (Proofpoint, vendor, 2026) — "Proofpoint is tracking the exploit kit used in this activity as BlueMoon" (https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit)
OK   [200] Coruna iOS exploit kit (Google GTIG, 2026-03-03) — "five full iOS exploit chains and a total of 23 exploits" (https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
OK   [200] Coruna: compromised Ukrainian sites — "a website loaded as a hidden iFrame on many compromised Ukrainian websites" (https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
OK   [200] Coruna: selected iPhone users — "only delivered to selected iPhone users from a specific geolocation" (https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
OK   [200] Coruna: fake finance sites — "a very large set of fake Chinese websites mostly related to finance" (https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
OK   [200] In-browser miner on 3,500+ sites (c/side, vendor, 2025) — "spread across 3,500+ infected websites" (https://cside.dev/blog/cryptojacking-is-dead-long-live-cryptojacking)

== 2. Miner block lists today ==
OK   github.com/keraf/NoCoin archived=True pushed_at=2020-09-10T09:44:44Z
OK   github.com/hoshsadiq/adblock-nocoin-list archived=False pushed_at=2026-09-12T06:31:16Z
OK   hoshsadiq/adblock-nocoin-list last commit: 2026-09-12T06:31:16Z | Remove fastspot.go again (fixes #476)
OK   [200] CoinBlockerLists suspended (maintainer statement) — "temporarily suspend all work on this project" (https://zerodot1.gitlab.io/CoinBlockerListsWeb/info.txt)
OK   [200] CoinBlockerLists: on hold indefinitely — "the project is now on hold indefinitely" (https://zerodot1.gitlab.io/CoinBlockerListsWeb/info.txt)
OK   [200] CoinBlockerLists mirror README dates it to 2024 (secondary) — "the indefinite suspension of the project in 2024 due to health reasons" (https://raw.githubusercontent.com/AstroMash/ZeroDot1_CoinBlockerLists/main/README.md)

== 3. polyfill.io, 2024 ==
OK   [200] Cloudflare cdnjs mirror (Feb 2024) — "following the transition of the domain polyfill.io to a new provider (Funnull)" (https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk/)
OK   [200] Sansec first report: 100K+ sites — "100K+ sites embed it using the cdn.polyfill.io domain" (https://sansec.io/research/polyfill-supply-chain-attack)
OK   [200] Sansec: conditional activation — "only activates on specific mobile devices at specific hours" (https://sansec.io/research/polyfill-supply-chain-attack)
OK   [200] Sansec: not for admins — "It also does not activate when it detects an admin user." (https://sansec.io/research/polyfill-supply-chain-attack)
OK   [200] Sansec: Namecheap hold (Sansec's own update line) — "Namecheap has put the domain on hold altogether" (https://sansec.io/research/polyfill-supply-chain-attack)
OK   [200] Cloudflare automatic rewrite (June 2024) — "rewrite any link to polyfill.io found in a website proxied by Cloudflare" (https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet/)
OK   [200] Censys hosts still embedding (vendor) — "Censys still detects 384,773 hosts embedding a polyfill JS script linking to the malicious domain" (https://censys.com/blog/july-2-polyfill-io-supply-chain-attack-digging-into-the-web-of-compromised-domains/)
OK   [200] US Treasury OFAC on Funnull (2025-05-29) — "In 2024, Funnull purchased a repository of code used by web developers and maliciously altered the code to redirect visitors of legitimate websites to scam websites and online gambling sites" (https://home.treasury.gov/news/press-releases/sb0149)

== 4. Skimming and payment-page scripts ==
OK   [200] PCI SSC: 6.4.3/11.6.1 effective — "PCI DSS v4.0.1 Requirements 6.4.3, 11.6.1, and 12.3.1 become effective as of 31 March 2025." (https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a)
OK   [200] PCI SSC: SAQ A eligibility change — "confirm their site is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s)." (https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a)
OK   [200] PCI SSC: e-skimming increased — "commonly known as e-skimming attacks, have increased significantly" (https://blog.pcisecuritystandards.org/new-information-supplement-payment-page-security-and-preventing-e-skimming)
OK   [200] Sansec: Magecart on 99 Magento stores (vendor, 2026) — "a large-scale Magecart campaign using invisible SVG elements to inject a fake checkout overlay on 99 Magento stores" (https://sansec.io/research/svg-onload-magecart-skimmer)
OK   [200] FTC eCrime 2020 web-skimming study (outside corpus) — "We observed attempted misuse of 15 of the 50 payment cards." (https://docs.apwg.org/ecrimeresearch/2020/40_WebSkimming-draft-20201110.pdf)

== 5. Compromised-site injects and malvertising, 2024-2026 ==
OK   [200] CISA/FBI AA25-203A: drive-by from compromised sites — "from compromised legitimate websites, an atypical method for ransomware actors" (https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a)
OK   [200] CISA/FBI AA25-203A: ClickFix — "Actors were also observed using the ClickFix social engineering technique for initial access" (https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a)
OK   [200] Microsoft: ClickFix via compromised websites (vendor) — "Some threat actors have also been observed to leverage compromised websites to deliver" (https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
OK   [200] Proofpoint: ClearFake web injects (vendor) — "ClearFake is a web inject activity cluster that compromises legitimate websites with malicious HTML and JavaScript" (https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication)
OK   [200] Europol: SocGholish fake browser updates — "distributing fake browser updates via compromised websites" (https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks)
OK   [200] Operation Endgame: 14,971 sites remediated — "14.971 websites infected with SocGholish malware were remediated" (https://www.operation-endgame.com/news/)
OK   [200] Microsoft: malvertising to ~1M devices (vendor) — "detected a large-scale malvertising campaign that impacted nearly one million devices globally" (https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/)
OK   [200] Microsoft: from illegal streaming sites — "The attack originated from illegal streaming websites embedded with malvertising redirectors" (https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/)
OK   [200] Malwarebytes: search ads for utility software (vendor) — "returning to malvertising to drop malware disguised as software downloads" (https://www.malwarebytes.com/blog/threat-intel/2024/10/large-scale-google-ads-campaign-targets-utility-software)

== 6. Safe Browsing as a label ==
OK   [200] URLhaus (abuse.ch) — "dedicated to sharing malicious URLs that are being used for malware distribution" (https://urlhaus.abuse.ch/)
OK   [200] Europol: primarily WordPress — "is primarily done by hacking websites built with WordPress" (https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks)
OK   [200] Safe Browsing v4 deprecated — "The Safe Browsing APIs (v4) are deprecated." (https://developers.google.com/safe-browsing/v4)
OK   [200] Google: attack sites live under 10 minutes — "as of 2021, 60% of sites that deliver attacks live less than 10 minutes" (https://developers.google.com/safe-browsing/reference/Migration.From.V4)

== 7. Papers outside the corpus that the page names ==
OK   [200] LiMS (CCS 2025, screened out of the corpus): 450 domains — "simulating deployments on a representative sample of 450 domains" (https://arxiv.org/abs/2509.14583)
OK   [200] LiMS: supply chain attacks — "against recent supply chain attacks" (https://arxiv.org/abs/2509.14583)
OK   [200] LiMS: CCS 2025 — "that will be published in ACM CCS 2025" (https://arxiv.org/abs/2509.14583)
OK   [200] WasmGuard / WasmMal-15K (WWW 2025, screened out) — "WasmGuard: Enhancing Web Security through Robust Raw-Binary Detection of WebAssembly Malware. In Proceedings of the ACM Web Conference 2025" (https://raw.githubusercontent.com/Yuxia-Sun/WasmMal/main/README.md)
OK   [200] Web cryptojacking infrastructure (WISA 2024) — "A dataset of 887 websites, previously identified as cryptojacking sites" (https://arxiv.org/abs/2408.03426)
OK   [200] WasmGuard DOI in the dataset README — "https://doi.org/10.1145/3696410.3714696" (https://raw.githubusercontent.com/Yuxia-Sun/WasmMal/main/README.md)
OK   [200] FTC eCrime 2020: method — "Over an eleven-month study period, we monitored the payment cards for signs of abuse." (https://docs.apwg.org/ecrimeresearch/2020/40_WebSkimming-draft-20201110.pdf)
OK   [200] Is Cryptojacking Dead after Coinhive Shutdown? (ICICT 2020) — "1\% of websites still run 8 unique mining scripts" (https://arxiv.org/abs/2001.02975)
OK   [200] In-page push ads via service workers (PAM 2022) — "in 65.08% of the SWs that connect with 3rd parties" (https://arxiv.org/abs/2110.11241)
OK   [302] ICWE 2024 chapter DOI 10.1007/978-3-031-62362-2_31 resolves
OK   [200] Ad-malware via DNS and VirusTotal (ICWE 2024) — "only about 0.7% to 3.2% of these domains are categorized as ad-malware" (https://arxiv.org/abs/2404.14190)

== 8. Artifacts of papers in the population ==
OK   github.com/vusec/minesweeper archived=False pushed_at=2021-05-05T10:36:28Z
OK   github.com/teamnsrg/outguard archived=False pushed_at=2019-09-06T14:37:57Z
OK   github.com/phani-vadrevu/seacma archived=False pushed_at=2019-10-21T14:20:41Z
OK   github.com/ian7yang/trident archived=False pushed_at=2023-09-19T02:03:32Z
OK   github.com/deluser8/cmtracker archived=False pushed_at=2018-10-08T12:24:53Z
OK   github.com/jszurdi/ODIN archived=False pushed_at=2021-02-08T05:24:47Z
OK   github.com/sola-st/WasmBench archived=False pushed_at=2022-07-20T07:00:37Z
OK   github.com/Yuxia-Sun/WasmMal archived=False pushed_at=2025-02-03T06:49:29Z
OK   [302] Rüth et al. Zenodo DOI 10.5281/zenodo.1421702 resolves

external checks: 0 failed
</file>

===== Funnel probe and 2024–2026 probe, unedited =====

<file text mwc_screening_probe-output.txt>
venue index: 16864 records; title+abstract probe hits: 140
  C screened out: 21
  D selected, not extracted (no PDF / failed): 2
  E extracted: 117

extracted hits that are NOT malicious-web-content candidates: 0 of 117

every hit that did NOT reach extraction (stage, year, venue, title):
  [C] 2010 WWW Alhambra: a system for creating, enforcing, and testing browser security policies.
        -> off: browser policy system
  [D] 2012 CCS You are what you include: large-scale evaluation of remote javascript inclusions.
        -> ON: remote JavaScript inclusion on 3M pages (third-party-risk); selected, no PDF retrieved
  [C] 2012 NDSS Chrome Extensions: Threat Analysis and Countermeasures
        -> off: extensions
  [C] 2014 CCS POSTER: Enhancing Security and Privacy with Google Glass.
        -> off
  [C] 2014 NDSS Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks
        -> off: hybrid-app access control
  [C] 2015 CCS POSTER: Page Table Manipulation Attack.
        -> off
  [C] 2018 CCS AST-Based Deep Learning for Detecting Malicious PowerShell.
        -> off: PowerShell
  [C] 2019 CCS Traceback for End-to-End Encrypted Messaging.
        -> off
  [C] 2019 CCS Poster: Detecting WebAssembly-based Cryptocurrency Mining.
        -> ON: Wasm cryptojacking detector (poster)
  [C] 2019 USENIX Robust Website Fingerprinting Through the Cache Occupancy Channel
        -> off
  [C] 2020 WWW MineThrottle: Defending against Wasm In-Browser Cryptojacking.
        -> ON: in-browser Wasm cryptojacking defence
  [C] 2021 CCS Secure Complaint-Enabled Source-Tracking for Encrypted Messaging.
        -> off
  [C] 2022 CCS Poster: Adversarial Perturbation Attacks on the State-of-the-Art Cryptojacking Detection System in IoT Network
        -> off: IoT cryptojacking (out of scope by brief)
  [C] 2025* CCS What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Management System.
        -> ON: LiMS link-integrity defence for third-party web resources, evaluated by simulated deployment on 450 domains (would be CONTEXT third-party-risk / defence-lab)
  [C] 2025* CCS Pixnapping: Bringing Pixel Stealing out of the Stone Age.
        -> off: Android pixel stealing
  [C] 2025* CCS GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search.
        -> off: retrieval poisoning
  [C] 2025* WWW Peripheral Instinct: How External Devices Breach Browser Sandboxes.
        -> off
  [C] 2025* WWW WasmGuard: Enhancing Web Security through Robust Raw-Binary Detection of WebAssembly Malware.
        -> ON: adversarially robust Wasm malware (incl. cryptojacker) detector on the WasmMal-15K dataset
  [C] 2025* WWW Beast in the Cage: A Fine-grained and Object-oriented Permission System to Confine JavaScript Operations on th
        -> ON-adjacent: permission system confining (possibly malicious) included scripts; defence
  [C] 2026* IEEE-SP GraphRAG Under Fire.
        -> off
  [C] 2026* USENIX Confundo: Learning to Generate Robust Poison for Practical RAG Systems
        -> off
  [D] 2026* USENIX Shielding QR Codes: Unveiling the Real-World Illicit Promotion Behind Adversarial QR Codes
        -> off: adversarial QR codes; selected, not extracted
  [C] 2026* USENIX What You Decode Depends on Where You Stand: Distance-Based Optical QR Code
        -> off

not extracted and on topic (ON / ON-adjacent): 6 — 2012 CCS, 2019 CCS, 2020 WWW, 2025 CCS, 2025 WWW, 2025 WWW; of them 2024–2026: 3

2024–2026 hits: 28; by stage: C 9, D 1, E 18
  [E] 2024 IEEE-SP OUT:mention | From Chatbots to Phishbots?: Phishing Scam Generation in Commercial Large Language Models.
  [E] 2024 IEEE-SP CONTEXT:attack-capability | MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotion.
  [E] 2024 USENIX CONTEXT:search-abuse | Into the Dark: Unveiling Internal Site Search Abused for Black Hat SEO
  [C] 2025* CCS - | What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Management System.
  [C] 2025* CCS - | Pixnapping: Bringing Pixel Stealing out of the Stone Age.
  [C] 2025* CCS - | GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search.
  [E] 2025* IMC CONTEXT:infra | Dive into the Cloud: Unveiling the (Ab)Usage of Serverless Cloud Function in the Wild.
  [E] 2025* IMC CONTEXT:phishing | Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum.
  [E] 2025* IMC OUT:non-web | Quantifying the Threat of Sandwiching MEV on Jito: A Measurement of Solana's Leading Validator Client.
  [E] 2025* NDSS CONTEXT:web-vuln | Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection
  [E] 2025* NDSS CONTEXT:host-mining | MineShark: Cryptomining Traffic Detection at Scale
  [E] 2025* NDSS OUT:mention | THEMIS: Regulating Textual Inversion for Personalized Concept Censorship
  [E] 2025* USENIX OUT:mention | URL Inspection Tasks: Helping Users Detect Phishing Links in Emails
  [E] 2025* USENIX OUT:mention | DNS FLaRE: A Flush-Reload Attack on DNS Forwarders
  [E] 2025* USENIX OUT:mention | "I Cannot Write This Because It Violates Our Content Policy": Understanding Content Moderation Policies and User Experie
  [E] 2025* USENIX CONTEXT:ecosystem | DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram
  [E] 2025* USENIX CONTEXT:search-abuse | Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search
  [C] 2025* WWW - | Peripheral Instinct: How External Devices Breach Browser Sandboxes.
  [C] 2025* WWW - | WasmGuard: Enhancing Web Security through Robust Raw-Binary Detection of WebAssembly Malware.
  [C] 2025* WWW - | Beast in the Cage: A Fine-grained and Object-oriented Permission System to Confine JavaScript Operations on the Web.
  [C] 2026* IEEE-SP - | GraphRAG Under Fire.
  [E] 2026* NDSS OUT:mention | Cache Me, Catch You: Cache Related Security Threats in LLM Serving Frameworks
  [E] 2026* NDSS OUT:mention | Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography
  [C] 2026* USENIX - | Confundo: Learning to Generate Robust Poison for Practical RAG Systems
  [E] 2026* USENIX CONTEXT:attack-capability | Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems
  [D] 2026* USENIX - | Shielding QR Codes: Unveiling the Real-World Illicit Promotion Behind Adversarial QR Codes
  [C] 2026* USENIX - | What You Decode Depends on Where You Stand: Distance-Based Optical QR Code
  [E] 2026* WWW CONTEXT:phishing | Netting Phish in the IPFS Ocean: Real-Time Monitoring and Characterization of Decentralized Phishing Campaigns.
</file>

<file text mwc_recent_probe-output.txt>
2024–2026 papers: 1875 (2024 690, 2025* 770, 2026* 415); with paper.cols.txt: 1875
of them already candidates: 47; EXTRA_CONTEXT: 0

outside the candidate set, hit by WIDE >= 5 OR any NEW-phenomenon hit OR a title/summary match: 159
  WIDE >= 5: 53; NEW >= 1: 24; title/summary: 104
NEW-phenomenon strings, papers outside candidates: technical support scams 21; technical support scam 6; tech support scams 3; wallet drainer 1; seo poisoning 1; crypto drainers 1; socgholish 1
NEW-phenomenon strings, papers inside candidates: polyfill.io 2; wallet drainers 1; wallet drainer 1; crypto drainers 1

must-read (web platform AND (WIDE >= 5 OR a NEW hit)): 32; verdicts (mwc_fold.mjs RECENT_READ):
  by verdict head: OUT 14; CONTEXT scams 8; CONTEXT phishing 4; CONTEXT web-vuln 2; CONTEXT third-party-risk 1; CONTEXT extension 1; CONTEXT attack-capability 1; CONTEXT ads 1
  2024 CCS     breaching-security-keys-without-root-fido2-deception-attacks OUT: Android overlay attack
  2024 CCS     characterizing-and-mitigating-phishing-attacks-at-cctld-scal CONTEXT phishing (security:phishing)
  2024 CCS     peeking-through-the-window-fingerprinting-browser-extensions OUT: extension fingerprinting
  2024 CCS     the-big-brothers-new-playground-unmasking-the-illusion-of-pr OUT: metaverse privacy
  2024 IEEE-SP break-the-wall-from-bottom-automated-discovery-of-protocol-l OUT: WAF evasion
  2024 IEEE-SP c-frame-characterizing-and-measuring-in-the-wild-captcha-att OUT: CAPTCHA farms
  2024 IMC     give-and-take-an-end-to-end-investigation-of-giveaway-scam-c CONTEXT scams
  2024 NDSS    like-comment-get-scammed-characterizing-comment-scams-on-med CONTEXT scams
  2024 USENIX  malla-demystifying-real-world-large-language-model-integrate OUT: LLM-integrated malicious services sold underground
  2024 USENIX  the-imitation-game-exploring-brand-impersonation-attacks-on- CONTEXT scams / impersonation
  2024 USENIX  trust-me-if-you-can-how-usable-is-trusted-types-in-practice  CONTEXT third-party-risk: Trusted Types usability (security:headers)
  2024 WWW     adflush-a-real-world-deployable-machine-learning-solution-fo OUT: ML ad and tracker blocking (privacy:javascript, programming:filter_lists)
  2024 WWW     experimental-security-analysis-of-sensitive-data-access-by-b CONTEXT extension: extensions reading password fields
  2024 WWW     in-security-of-file-uploads-in-node-js                       CONTEXT web-vuln: file-upload vulnerabilities
  2025* CCS     be-aware-of-what-you-let-pass-demystifying-url-based-authent CONTEXT web-vuln: authentication bypass
  2025* CCS     passwords-and-fido2-are-meant-to-be-secret-a-practical-secur OUT: authentication channel design
  2025* IMC     exploration-of-the-dynamics-of-buy-and-sale-of-social-media- OUT: account markets
  2025* IMC     fishing-for-smishing-understanding-sms-phishing-infrastructu CONTEXT phishing (SMS); names SocGholish once
  2025* NDSS    cross-origin-web-attacks-via-http-2-server-push-and-signed-h CONTEXT attack-capability: HTTP/2 push and SXG attack, controlled tests
  2025* NDSS    ctrlaltdeceive-quantifying-user-exposure-to-online-scams     CONTEXT scams: users' exposure to scam pages (security:online_scams)
  2025* NDSS    scammagnifier-piercing-the-veil-of-fraudulent-shopping-websi CONTEXT scams (security:online_scams)
  2025* PETS    more-and-scammier-ads-the-perils-of-youtubes-ad-privacy-sett CONTEXT ads: predatory YouTube pre-roll ads (privacy:advertising)
  2025* PETS    unmasking-the-shadows-a-cross-country-study-of-online-tracki OUT: tracking on piracy sites; malvertising and malware appear only in related work (read 2026-10-08)
  2025* USENIX  make-agent-defeat-agent-automatic-detection-of-taint-style-v OUT: LLM-agent vulnerabilities
  2025* USENIX  nokescam-understanding-and-rectifying-non-sense-keywords-spe CONTEXT scams via search
  2025* USENIX  scanned-and-scammed-insecurity-by-obsqrity-measuring-user-su OUT: QR-code user study
  2025* WWW     the-poorest-man-in-babylon-a-longitudinal-study-of-cryptocur CONTEXT scams
  2025* WWW     whats-in-phishers-a-longitudinal-study-of-security-configura CONTEXT phishing (security:phishing)
  2026* NDSS    achieving-interpretable-dl-based-web-attack-detection-throug OUT: attack payloads in HTTP requests to servers (WAF side)
  2026* NDSS    are-your-sites-truly-isolated-automatically-detecting-logic- OUT: browser site-isolation bugs
  2026* NDSS    ctphishcapture-uncovering-credential-theft-based-phishing-sc CONTEXT phishing (crypto wallets)
  2026* NDSS    loki-proactively-discovering-online-scams-by-mining-toxic-se CONTEXT scams
IN among them: 0 (no verdict above is IN)

every selected paper (year venue | WIDE hits | NEW strings | title-or-summary match | web? | title):
  2026* NDSS    | W  90 | - | TS | web | achieving-interpretable-dl-based-web-attack-detection-through-malicious-payload-localization | Achieving Interpretable DL-based Web Attack Detection through Malicious Payload Localization
  2024 USENIX  | W  75 | - | TS | web | malla-demystifying-real-world-large-language-model-integrated-malicious-services | Malla: Demystifying Real-world Large Language Model Integrated Malicious Services
  2024 CCS     | W  42 | - | -- | web | peeking-through-the-window-fingerprinting-browser-extensions-through-page-visibl | Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Intera
  2024 WWW     | W  40 | - | TS | web | in-security-of-file-uploads-in-node-js | (In)Security of File Uploads in Node.js.
  2024 IEEE-SP | W  35 | - | -- | web | break-the-wall-from-bottom-automated-discovery-of-protocol-level-evasion-vulnera | Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application F
  2024 CCS     | W  29 | - | -- |     | toward-understanding-the-security-of-plugins-in-continuous-integration-services | Toward Understanding the Security of Plugins in Continuous Integration Services.
  2025* NDSS    | W  22 | - | TS |     | understanding-miniapp-malware-identification-dissection-and-characterization | Understanding Miniapp Malware: Identification, Dissection, and Characterization
  2025* IEEE-SP | W  19 | - | TS |     | my-model-is-malware-to-you-transforming-ai-models-into-malware-by-abusing-tensor | My Model is Malware to You: Transforming AI Models into Malware by Abusing TensorFlow APIs.
  2026* WWW     | W  19 | - | TS |     | bridging-expert-reasoning-and-llm-detection-a-knowledge-driven-framework-for-mal | Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages.
  2024 IEEE-SP | W  18 | - | -- |     | more-haste-less-speed-cache-related-security-threats-in-continuous-integration-s | More Haste, Less Speed: Cache Related Security Threats in Continuous Integration Services.
  2025* IEEE-SP | W  17 | - | -- |     | on-the-in-security-of-llm-app-stores | On the (In)Security of LLM App Stores.
  2025* USENIX  | W  13 | - | TS |     | vapd-an-anomaly-detection-model-for-pdf-malware-forensics-with-adversarial-robus | VAPD: An Anomaly Detection Model for PDF Malware Forensics with Adversarial Robustness
  2025* USENIX  | W  11 | - | -- | web | scanned-and-scammed-insecurity-by-obsqrity-measuring-user-susceptibility-and-awa | Scanned and Scammed: Insecurity by ObsQRity? Measuring User Susceptibility and Awareness of QR Code-Based Atta
  2024 CCS     | W  10 | - | TS |     | inbox-invasion-exploiting-mime-ambiguities-to-evade-email-attachment-detectors | Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors.
  2024 CCS     | W   9 | - | TS |     | swide-a-semantic-aware-detection-engine-for-successful-web-injection-attacks | SWIDE: A Semantic-aware Detection Engine for Successful Web Injection Attacks.
  2024 USENIX  | W   9 | - | -- |     | rise-of-inspectron-automated-black-box-auditing-of-cross-platform-electron-apps | Rise of Inspectron: Automated Black-box Auditing of Cross-platform Electron Apps
  2025* CCS     | W   9 | - | TS |     | pickleball-secure-deserialization-of-pickle-based-machine-learning-models | PickleBall: Secure Deserialization of Pickle-based Machine Learning Models.
  2025* NDSS    | W   9 | - | -- | web | cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange | Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange
  2025* USENIX  | W   9 | - | TS |     | malguard-towards-real-time-accurate-and-actionable-detection-of-malicious-packag | MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem
  2025* USENIX  | W   9 | - | -- |     | principled-and-automated-approach-for-investigating-ar-vr-attacks | Principled and Automated Approach for Investigating AR/VR Attacks
  2024 USENIX  | W   8 | - | -- |     | guardians-of-the-galaxy-content-moderation-in-the-interplanetary-file-system | Guardians of the Galaxy: Content Moderation in the InterPlanetary File System
  2025* IEEE-SP | W   8 | - | -- |     | make-a-feint-to-the-east-while-attacking-in-the-west-blinding-llm-based-code-aud | Make a Feint to the East While Attacking in the West: Blinding LLM-Based Code Auditors with Flashboom Attacks.
  2025* NDSS    | W   8 | - | TS |     | hitchhiking-vaccine-enhancing-botnet-remediation-with-remote-code-deployment-reuse | Hitchhiking Vaccine: Enhancing Botnet Remediation With Remote Code Deployment Reuse
  2026* IEEE-SP | W   8 | - | -- |     | behind-the-curtain-how-shared-hosting-providers-respond-to-vulnerability-notific | Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications.
  2024 CCS     | W   7 | - | -- | web | characterizing-and-mitigating-phishing-attacks-at-cctld-scale | Characterizing and Mitigating Phishing Attacks at ccTLD Scale.
  2025* CCS     | W   7 | - | -- | web | be-aware-of-what-you-let-pass-demystifying-url-based-authentication-bypass-vulne | Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applicat
  2025* NDSS    | W   7 | - | -- |     | too-subtle-to-notice-investigating-executable-stack-issues-in-linux-systems | Too Subtle to Notice: Investigating Executable Stack Issues in Linux Systems
  2025* NDSS    | W   7 | - | -- |     | welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem | Welcome to Jurassic Park: A Comprehensive Study of Security Risks in Deno and its Ecosystem
  2026* USENIX  | W   7 | - | -- |     | when-updates-backfire-a-black-box-security-analysis-of-desktop-software-update-m | When Updates Backfire: A Black-Box Security Analysis of Desktop Software Update Mechanisms
  2024 USENIX  | W   6 | - | TS |     | dva-extracting-victims-and-abuse-vectors-from-android-accessibility-malware | DVa: Extracting Victims and Abuse Vectors from Android Accessibility Malware
  2025* CCS     | W   6 | - | -- | web | passwords-and-fido2-are-meant-to-be-secret-a-practical-secure-authentication-cha | Passwords and FIDO2 Are Meant To Be Secret: A Practical Secure Authentication Channel for Web Browsers.
  2025* WWW     | W   6 | - | -- | web | whats-in-phishers-a-longitudinal-study-of-security-configurations-in-phishing-we | What's in Phishers: A Longitudinal Study of Security Configurations in Phishing Websites and Kits.
  2026* USENIX  | W   6 | - | TS |     | the-art-of-hide-and-seek-making-pickle-based-model-supply-chain-poisoning-stealt | The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again
  2025* WWW     | W   6 | - | -- |     | dr-docker-a-large-scale-security-measurement-of-docker-image-ecosystem | Dr. Docker: A Large-Scale Security Measurement of Docker Image Ecosystem.
  2025* PETS    | W   6 | - | -- | web | unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie | Unmasking the Shadows: A Cross-Country Study of Online Tracking in Illegal Movie Streaming Services
  2025* CCS     | W   6 | - | -- |     | a-decade-long-landscape-of-advanced-persistent-threats-longitudinal-analysis-and | A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends.
  2026* IEEE-SP | W   6 | - | -- |     | on-the-in-security-of-loading-machine-learning-models | On the (In)Security of Loading Machine Learning Models.
  2024 IEEE-SP | W   6 | - | -- |     | wears-my-data-understanding-the-cross-device-runtime-permission-model-in-wearabl | Wear's my Data? Understanding the Cross-Device Runtime Permission Model in Wearables.
  2024 CCS     | W   5 | - | -- | web | breaching-security-keys-without-root-fido2-deception-attacks-via-overlays-exploi | Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays exploiting Limited Display Authenti
  2024 CCS     | W   5 | - | TS | web | the-big-brothers-new-playground-unmasking-the-illusion-of-privacy-in-web-metaver | The Big Brother's New Playground: Unmasking the Illusion of Privacy in Web Metaverses from a Malicious User's 
  2024 IEEE-SP | W   5 | - | -- |     | poisoned-chatgpt-finds-work-for-idle-hands-exploring-developers-coding-practices | Poisoned ChatGPT Finds Work for Idle Hands: Exploring Developers' Coding Practices with Insecure Suggestions f
  2024 USENIX  | W   5 | - | -- | web | trust-me-if-you-can-how-usable-is-trusted-types-in-practice | Trust Me If You Can – How Usable Is Trusted Types In Practice?
  2024 WWW     | W   5 | - | -- | web | experimental-security-analysis-of-sensitive-data-access-by-browser-extensions | Experimental Security Analysis of Sensitive Data Access by Browser Extensions.
  2024 WWW     | W   5 | - | -- |     | phishinwebview-analysis-of-anti-phishing-entities-in-mobile-apps-with-webview-ta | PhishinWebView: Analysis of Anti-Phishing Entities in Mobile Apps with WebView Targeted Phishing.
  2025* IMC     | W   5 | - | TS |     | poster-measuring-algorithmic-systems-resilience-against-generative-ai-powered-at | Poster: Measuring Algorithmic Systems' Resilience Against Generative AI-Powered Attacks - Case Study on Exploi
  2025* NDSS    | W   5 | - | -- |     | dissecting-payload-based-transaction-phishing-on-ethereum | Dissecting Payload-based Transaction Phishing on Ethereum
  2025* USENIX  | W   5 | - | -- | web | make-agent-defeat-agent-automatic-detection-of-taint-style-vulnerabilities-in-ll | Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents
  2025* NDSS    | W   5 | technical support scams | -- | web | scammagnifier-piercing-the-veil-of-fraudulent-shopping-website-campaigns | SCAMMAGNIFIER: Piercing the Veil of Fraudulent Shopping Website Campaigns
  2025* NDSS    | W   5 | - | TS |     | ghostshot-manipulating-the-image-of-ccd-cameras-with-electromagnetic-interference | GhostShot: Manipulating the Image of CCD Cameras with Electromagnetic Interference
  2026* NDSS    | W   5 | - | -- |     | better-safe-than-sorry-uncovering-the-insecure-resource-management-in-app-in-app-cloud-services | Better Safe than Sorry: Uncovering the Insecure Resource Management in App-in-App Cloud Services
  2026* NDSS    | W   5 | - | -- | web | are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations | Are your Sites Truly Isolated? Automatically Detecting Logic Bugs in Site Isolation Implementations
  2026* NDSS    | W   5 | - | TS |     | rtrace-towards-better-visibility-of-shared-library-execution | RTrace: Towards Better Visibility of Shared Library Execution
  2026* NDSS    | W   5 | - | -- |     | when-cache-poisoning-meets-llm-systems-semantic-cache-poisoning-and-its-countermeasures | When Cache Poisoning Meets LLM Systems: Semantic Cache Poisoning and Its Countermeasures
  2025* NDSS    | W   4 | - | TS |     | careful-about-what-app-promotion-ads-recommend-detecting-and-explaining-malware-promotion-via-app-promotion-graph | Careful About What App Promotion Ads Recommend! Detecting and Explaining Malware Promotion via App Promotion G
  2025* NDSS    | W   4 | technical support scams,tech support scams,technical support scam | -- | web | ctrlaltdeceive-quantifying-user-exposure-to-online-scams | Ctrl+Alt+Deceive: Quantifying User Exposure to Online Scams
  2025* NDSS    | W   4 | - | TS |     | revisiting-concept-drift-in-windows-malware-detection-adaptation-to-real-drifted-malware-with-minimal-samples | Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples
  2025* USENIX  | W   4 | - | TS |     | watch-out-your-tv-box-reversing-and-blocking-a-p2p-based-illegal-streaming-ecosy | Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem
  2026* NDSS    | W   4 | - | TS |     | a-hard-label-black-box-evasion-attack-against-ml-based-malicious-traffic-detection-systems | A Hard-Label Black-Box Evasion Attack against ML-based Malicious Traffic Detection Systems
  2026* NDSS    | W   4 | - | TS |     | cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews | Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews
  2025* NDSS    | W   4 | - | TS |     | the-philosophers-stone-trojaning-plugins-of-large-language-models | The Philosopher’s Stone: Trojaning Plugins of Large Language Models
  2026* IEEE-SP | W   4 | - | TS |     | banshee-target-switch-attacks-on-gimbal-stabilized-visual-tracking-systems-via-a | Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection.
  2024 IEEE-SP | W   4 | - | TS | web | understanding-the-privacy-practices-of-political-campaigns-a-perspective-from-th | Understanding the Privacy Practices of Political Campaigns: A Perspective from the 2020 US Election Websites.
  2024 USENIX  | W   3 | - | TS | web | argus-all-your-php-injection-sinks-are-belong-to-us | Argus: All your (PHP) Injection-sinks are belong to us.
  2024 WWW     | W   3 | seo poisoning | -- | web | adflush-a-real-world-deployable-machine-learning-solution-for-effective-advertis | AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevent
  2025* NDSS    | W   3 | - | TS | web | attributing-open-source-contributions-is-critical-but-difficult-a-systematic-analysis-of-github-practices-and-their-impact-on-software-supply-chain-security | Attributing Open-Source Contributions is Critical but Difficult: A Systematic Analysis of GitHub Practices and
  2025* USENIX  | W   3 | - | TS |     | taptrap-animation-driven-tapjacking-on-android | TapTrap: Animation-Driven Tapjacking on Android
  2025* WWW     | W   3 | crypto drainers,technical support scams,technical support scam | -- |     | pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms | Pirates of Charity: Exploring Donation-based Abuses in Social Media Platforms.
  2025* WWW     | W   3 | technical support scams | -- | web | the-poorest-man-in-babylon-a-longitudinal-study-of-cryptocurrency-investment-sca | The Poorest Man in Babylon: A Longitudinal Study of Cryptocurrency Investment Scams.
  2026* NDSS    | W   3 | technical support scams,technical support scam | -- | web | loki-proactively-discovering-online-scams-by-mining-toxic-search-queries | LOKI: Proactively Discovering Online Scam Websites by Mining Toxic Search Queries
  2025* IEEE-SP | W   3 | - | TS |     | rushing-at-spdz-on-the-practical-security-of-malicious-mpc-implementations | Rushing at SPDZ: On the Practical Security of Malicious MPC Implementations.
  2025* IEEE-SP | W   3 | - | TS | web | you-have-to-ignore-the-dangers-user-perceptions-of-the-security-and-privacy-bene | "You Have to Ignore the Dangers": User Perceptions of the Security and Privacy Benefits of WhatsApp Mods.
  2025* IMC     | W   3 | - | TS |     | attacks-come-to-those-who-wait-long-term-observations-in-an-ssh-honeynet | Attacks Come to Those Who Wait: Long-Term Observations in an SSH Honeynet.
  2025* IMC     | W   3 | socgholish | TS | web | fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by | Fishing for Smishing: Understanding SMS Phishing Infrastructure and Strategies by Mining Public User Reports.
  2025* USENIX  | W   3 | technical support scams | -- | web | nokescam-understanding-and-rectifying-non-sense-keywords-spear-scam-in-search-en | NOKEScam: Understanding and Rectifying Non-Sense Keywords Spear Scam in Search Engines
  2025* CCS     | W   2 | - | TS |     | badaml-exploiting-legacy-firmware-interfaces-to-compromise-confidential-virtual | BadAML: Exploiting Legacy Firmware Interfaces to Compromise Confidential Virtual Machines.
  2025* NDSS    | W   2 | technical support scams | -- |     | all-your-database-are-belong-to-us-characterizing-database-ransomware-attacks | All your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks
  2025* USENIX  | W   2 | - | TS | web | detecting-compromise-of-passkey-storage-on-the-cloud | Detecting Compromise of Passkey Storage on the Cloud
  2025* PETS    | W   2 | technical support scams | -- | web | more-and-scammier-ads-the-perils-of-youtubes-ad-privacy-settings | More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings
  2025* USENIX  | W   2 | - | TS |     | im-regretting-that-i-hit-run-in-situ-assessment-of-potential-malware | "I'm regretting that I hit run": In-situ Assessment of Potential Malware
  2024 IEEE-SP | W   2 | - | TS |     | undefined-oriented-programming-detecting-and-chaining-prototype-pollution-gadget | Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines
  2024 IEEE-SP | W   1 | - | TS |     | wesee-using-malicious-vc-interrupts-to-break-amd-sev-snp | WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP.
  2024 NDSS    | W   1 | technical support scams,technical support scam | -- | web | like-comment-get-scammed-characterizing-comment-scams-on-media-platforms | Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms
  2024 IMC     | W   1 | - | TS |     | poster-the-state-of-malware-loaders | Poster: The State of Malware Loaders.
  2024 USENIX  | W   1 | - | TS |     | exploiting-leakage-in-password-managers-via-injection-attacks | Exploiting Leakage in Password Managers via Injection Attacks
  2025* CCS     | W   1 | - | TS |     | training-with-only-1-0-samples-malicious-traffic-detection-via-cross-modality-fe | Training with Only 1.0 ‰ Samples: Malicious Traffic Detection via Cross-Modality Feature Fusion.
  2025* CCS     | W   1 | - | TS | web | walking-the-last-mile-studying-decompiler-output-correction-in-practice | Walking The Last Mile: Studying Decompiler Output Correction in Practice.
  2025* USENIX  | W   1 | - | TS |     | an-industry-interview-study-of-software-signing-for-supply-chain-security | An Industry Interview Study of Software Signing for Supply Chain Security
  2025* USENIX  | W   1 | - | TS |     | catch-22-uncovering-compromised-hosts-using-ssh-public-keys | Catch-22: Uncovering Compromised Hosts using SSH Public Keys
  2026* NDSS    | W   1 | - | TS |     | unveiling-byovd-threats-malwares-use-and-abuse-of-kernel-drivers | Unveiling BYOVD Threats: Malware’s Use and Abuse of Kernel Drivers
  2026* USENIX  | W   1 | - | TS |     | arguzz-testing-zkvms-for-soundness-and-completeness-bugs | Arguzz: Testing zkVMs for Soundness and Completeness Bugs
  2026* NDSS    | W   1 | technical support scams | -- | web | ctphishcapture-uncovering-credential-theft-based-phishing-scams-targeting-cryptocurrency-wallets | CtPhishCapture: Uncovering Credential-Theft-Based Phishing Scams Targeting Cryptocurrency Wallets
  2026* USENIX  | W   1 | - | TS | web | from-mirai-to-gorilla-deep-dive-into-a-long-lasting-ddos-for-hire-botnet | From Mirai to Gorilla: Deep Dive into a Long-Lasting DDoS-for-Hire Botnet
  2026* NDSS    | W   1 | - | TS |     | understanding-the-status-and-strategies-of-the-code-signing-abuse-ecosystem | Understanding the Status and Strategies of the Code Signing Abuse Ecosystem
  2026* USENIX  | W   1 | - | TS |     | cracks-in-the-walled-garden-dissecting-the-gray-market-of-unauthorized-ios-app-d | Cracks in the Walled Garden: Dissecting the Gray-Market of Unauthorized iOS App Distribution via Ad Hoc Sidelo
  2026* USENIX  | W   1 | - | TS |     | you-know-why-but-still-rely-the-impact-of-explainable-ai-on-trust-task-load-and | You Know Why, but Still Rely: The Impact of Explainable AI on Trust, Task Load, and Performance in Cybersecuri
  2026* WWW     | W   1 | - | TS | web | hidden-in-plain-text-a-benchmark-for-social-web-indirect-prompt-injection-in-rag | Hidden-in-Plain-Text: A Benchmark for Social-Web Indirect Prompt Injection in RAG.
  2025* CCS     | W   1 | - | TS |     | evaluating-the-robustness-of-a-production-malware-detection-system-to-transferab | Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks.
  2025* IMC     | W   1 | tech support scams,technical support scams | -- | web | exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts | Exploration of the Dynamics of Buy and Sale of Social Media Accounts.
  2025* IMC     | W   1 | - | TS |     | do-spammers-dream-of-electric-sheep-characterizing-the-prevalence-of-llm-generat | Do Spammers Dream of Electric Sheep? Characterizing the Prevalence of LLM-Generated Malicious Emails.
  2026* USENIX  | W   1 | technical support scams | -- |     | lost-in-blockchain-address-misuse-hidden-cross-platform-risks-and-their-security | Lost in Blockchain Address Misuse: Hidden Cross-Platform Risks and Their Security Impact
  2024 IEEE-SP | W   1 | - | TS |     | efficient-detection-of-java-deserialization-gadget-chains-via-bottom-up-gadget-s | Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Paylo
  2024 NDSS    | W   0 | wallet drainer | TS |     | drainclog-detecting-rogue-accounts-with-illegally-obtained-nfts-using-classifiers-learned-on-graphs | DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs
  2024 NDSS    | W   0 | - | TS |     | low-quality-training-data-only-a-robust-framework-for-detecting-encrypted-malicious-network-traffic | Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic
  2024 CCS     | W   0 | - | TS |     | optimization-based-prompt-injection-attack-to-llm-as-a-judge | Optimization-based Prompt Injection Attack to LLM-as-a-Judge.
  2024 CCS     | W   0 | - | TS |     | poster-pgpnet-classify-apt-malware-using-prediction-guided-prototype-network | Poster: PGPNet: Classify APT Malware Using Prediction-Guided Prototype Network.
  2024 IEEE-SP | W   0 | - | TS |     | e-vote-your-conscience-perceptions-of-coercion-and-vote-buying-and-the-usability | E-Vote Your Conscience: Perceptions of Coercion and Vote Buying, and the Usability of Fake Credentials in Onli
  2024 IEEE-SP | W   0 | - | TS |     | injection-attacks-against-end-to-end-encrypted-applications | Injection Attacks Against End-to-End Encrypted Applications.
  2024 IEEE-SP | W   0 | - | TS |     | multi-instance-adversarial-attack-on-gnn-based-malicious-domain-detection | Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection.
  2024 IMC     | W   0 | technical support scams | -- | web | give-and-take-an-end-to-end-investigation-of-giveaway-scam-conversion-rates | Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates.
  2024 IMC     | W   0 | - | TS |     | poster-empirical-analysis-of-lifespan-increase-of-iot-c-c-domains | Poster: Empirical Analysis of Lifespan Increase of IoT C&C Domains.
  2024 NDSS    | W   0 | - | TS |     | reqsminer-automated-discovery-of-cdn-forwarding-request-inconsistencies-and-dos-attacks-with-grammar-based-fuzzing | ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fu
  2024 NDSS    | W   0 | - | TS |     | faults-in-our-bus-novel-bus-fault-attack-to-break-arm-trustzone | Faults in Our Bus: Novel Bus Fault Attack to Break ARM TrustZone
  2024 NDSS    | W   0 | - | TS |     | ghosttype-the-limits-of-using-contactless-electromagnetic-interference-to-inject-phantom-keys-into-analog-circuits-of-keyboards | GhostType: The Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Cir
  2024 USENIX  | W   0 | - | TS |     | how-does-endpoint-detection-use-the-mitre-att-ck-framework | How does Endpoint Detection use the MITRE ATT&CK Framework?
  2024 USENIX  | W   0 | - | TS |     | lr-miner-static-race-detection-in-os-kernels-by-mining-locking-rules | LR-Miner: Static Race Detection in OS Kernels by Mining Locking Rules
  2024 USENIX  | W   0 | - | TS |     | ihunter-hunting-privacy-violations-at-scale-in-the-software-supply-chain-on-ios | iHunter: Hunting Privacy Violations at Scale in the Software Supply Chain on iOS
  2024 USENIX  | W   0 | technical support scams,technical support scam | -- | web | the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor | The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms
  2024 USENIX  | W   0 | - | TS |     | micguard-a-comprehensive-detection-system-against-out-of-band-injection-attacks | MicGuard: A Comprehensive Detection System against Out-of-band Injection Attacks for Different Level Microphon
  2024 WWW     | W   0 | - | TS |     | fingerprinting-the-shadows-unmasking-malicious-servers-with-machine-learning-pow | Fingerprinting the Shadows: Unmasking Malicious Servers with Machine Learning-Powered TLS Analysis.
  2024 USENIX  | W   0 | - | TS |     | wireless-signal-injection-attacks-on-vsat-satellite-modems | Wireless Signal Injection Attacks on VSAT Satellite Modems
  2024 WWW     | W   0 | - | TS |     | message-injection-attack-on-rumor-detection-under-the-black-box-evasion-setting | Message Injection Attack on Rumor Detection under the Black-Box Evasion Setting Using Large Language Model.
  2025* CCS     | W   0 | - | TS |     | empirical-security-analysis-of-software-based-fault-isolation-through-controlled | Empirical Security Analysis of Software-based Fault Isolation through Controlled Fault Injection.
  2025* IEEE-SP | W   0 | - | TS |     | pfortifier-mitigating-php-object-injection-through-automatic-patch-generation | PFortifier: Mitigating PHP Object Injection Through Automatic Patch Generation.
  2025* CCS     | W   0 | - | TS | web | hidden-in-plain-bytes-investigating-interpersonal-account-compromise-with-data-e | Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports.
  2025* IMC     | W   0 | - | TS |     | poster-the-potential-of-erroneous-outbound-traffic-analysis-to-unveil-silent-int | Poster: The Potential of Erroneous Outbound Traffic Analysis to Unveil Silent Internal Anomalies.
  2025* NDSS    | W   0 | - | TS |     | rethink-reveal-the-threat-of-electromagnetic-interference-on-power-inverters | ReThink: Reveal the Threat of Electromagnetic Interference on Power Inverters
  2025* NDSS    | W   0 | - | TS |     | wallbleed-a-memory-disclosure-vulnerability-in-the-great-firewall-of-china | Wallbleed: A Memory Disclosure Vulnerability in the Great Firewall of China
  2025* NDSS    | W   0 | - | TS |     | phantomlidar-cross-modality-signal-injection-attacks-against-lidar | PhantomLiDAR: Cross-modality Signal Injection Attacks against LiDAR
  2025* NDSS    | W   0 | - | TS |     | lightantenna-characterizing-the-limits-of-fluorescent-lamp-induced-electromagnetic-interference | LightAntenna: Characterizing the Limits of Fluorescent Lamp-Induced Electromagnetic Interference
  2025* USENIX  | W   0 | - | TS |     | chainfuzz-exploiting-upstream-vulnerabilities-in-open-source-supply-chains | ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains
  2025* USENIX  | W   0 | technical support scams | -- |     | hey-mum-i-dropped-my-phone-down-the-toilet-investigating-hi-mum-and-dad-sms-scam | 'Hey mum, I dropped my phone down the toilet': Investigating Hi Mum and Dad SMS Scams in the United Kingdom
  2025* USENIX  | W   0 | - | TS |     | irblock-a-large-scale-measurement-study-of-the-great-firewall-of-iran | IRBlock: A Large-Scale Measurement Study of the Great Firewall of Iran
  2025* USENIX  | W   0 | technical support scams | -- |     | please-dont-send-that-bot-anything-a-mixed-methods-study-of-personal-impersonati | "Please don't send that bot anything": A Mixed-methods Study of Personal Impersonation Attacks Targeting Digit
  2025* USENIX  | W   0 | - | TS |     | choicejacking-compromising-mobile-devices-through-malicious-chargers-like-a-deca | ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
  2025* USENIX  | W   0 | - | TS |     | sni5gect-a-practical-approach-to-inject-anrchy-into-5g-nr | SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR
  2025* WWW     | W   0 | - | TS |     | do-not-trust-what-they-tell-exposing-malicious-accomplices-in-tor-via-anomalous | Do Not Trust What They Tell: Exposing Malicious Accomplices in Tor via Anomalous Circuit Detection.
  2025* USENIX  | W   0 | - | TS |     | automated-discovery-of-semantic-attacks-in-multi-robot-navigation-systems | Automated Discovery of Semantic Attacks in Multi-Robot Navigation Systems
  2025* WWW     | W   0 | - | TS | web | welcome-to-the-dark-side-analyzing-the-revenue-flows-of-fraud-in-the-online-ad-e | Welcome to the Dark Side: Analyzing the Revenue Flows of Fraud in the Online Ad Ecosystem.
  2026* NDSS    | W   0 | technical support scams | -- |     | honeysat-a-network-based-satellite-honeypot-framework | HoneySat: A Network-based Satellite Honeypot Framework
  2026* NDSS    | W   0 | - | TS |     | prompt-injection-attack-to-tool-selection-in-llm-agents | Prompt Injection Attack to Tool Selection in LLM Agents
  2026* NDSS    | W   0 | - | TS |     | obliinjection-order-oblivious-prompt-injection-attack-to-llm-agents-with-multi-source-data | ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
  2026* NDSS    | W   0 | - | TS |     | tipso-gan-malicious-network-traffic-detection-using-a-novel-optimized-generative-adversarial-network | TIPSO-GAN: Malicious Network Traffic Detection Using a Novel Optimized Generative Adversarial Network
  2026* NDSS    | W   0 | - | TS |     | vulsca-a-community-level-sca-approach-for-accurate-c-c-supply-chain-vulnerability-analysis | VulSCA: A Community-Level SCA Approach for Accurate C/C++ Supply Chain Vulnerability Analysis
  2026* NDSS    | W   0 | - | TS |     | phantommotion-laser-based-motion-injection-attacks-on-wireless-security-surveillance-systems | PhantomMotion: Laser-Based Motion Injection Attacks on Wireless Security Surveillance Systems
  2025* USENIX  | W   0 | - | TS |     | system-register-hijacking-compromising-kernel-integrity-by-turning-system-regist | System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System
  2026* NDSS    | W   0 | technical support scams | TS |     | tbtrackerx-fantastic-trigger-bots-and-where-to-find-malicious-campaigns-on-x | TBTrackerX: Fantastic Trigger Bots and Where to Find Malicious Campaigns on X
  2025* IEEE-SP | W   0 | - | TS |     | space-radsim-binary-agnostic-fault-injection-to-evaluate-cosmic-radiation-impact | Space RADSIM: Binary-Agnostic Fault Injection to Evaluate Cosmic Radiation Impact on Exploit Mitigation Techni
  2025* USENIX  | W   0 | - | TS |     | high-stakes-low-certainty-evaluating-the-efficacy-of-high-level-indicators-of-co | High Stakes, Low Certainty: Evaluating the Efficacy of High-Level Indicators of Compromise in Ransomware Attri
  2025* USENIX  | W   0 | - | TS |     | elfuzz-efficient-input-generation-via-llm-driven-synthesis-over-fuzzer-space | ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
  2026* IEEE-SP | W   0 | - | TS |     | exploiting-leaderboards-for-large-scale-distribution-of-malicious-models | Exploiting Leaderboards for Large-Scale Distribution of Malicious Models.
  2026* IEEE-SP | W   0 | technical support scams | -- |     | international-students-and-scams-at-risk-abroad | International Students and Scams: At Risk Abroad.
  2026* NDSS    | W   0 | - | TS |     | dualstrike-accurate-real-time-eavesdropping-and-injection-of-keystrokes-on-commodity-keyboards | DualStrike: Accurate, Real-time Eavesdropping and Injection of Keystrokes on Commodity Keyboards
  2026* PETS    | W   0 | technical support scams,tech support scams,technical support scam | -- |     | ai-in-the-loop-privacy-preserving-real-time-scam-detection-and-conversational-sc | AI-in-the-Loop: Privacy Preserving Real-Time Scam Detection and Conversational Scam-baiting by Leveraging LLMs
  2026* USENIX  | W   0 | - | TS |     | wild-attack-stealthy-undermining-of-wi-fi-based-geolocation-through-remote-crowd | WILD Attack: Stealthy Undermining of Wi-Fi-Based Geolocation Through Remote Crowdsourced Data Injection
  2025* USENIX  | W   0 | - | TS | web | malicious-llm-based-conversational-ai-makes-users-reveal-personal-information | Malicious LLM-Based Conversational AI Makes Users Reveal Personal Information
  2024 IEEE-SP | W   0 | - | TS |     | app-miner-detecting-api-misuses-via-automatically-mining-api-path-patterns | APP-Miner: Detecting API Misuses via Automatically Mining API Path Patterns.
  2024 IEEE-SP | W   0 | - | TS |     | video-based-cryptanalysis-extracting-cryptographic-keys-from-video-footage-of-a | Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device's Power LED Captured b
  2024 IEEE-SP | W   0 | - | TS |     | breach-extraction-attacks-exposing-and-addressing-the-leakage-in-second-generati | Breach Extraction Attacks: Exposing and Addressing the Leakage in Second Generation Compromised Credential Che
  2024 IEEE-SP | W   0 | technical support scams | -- | web | c-frame-characterizing-and-measuring-in-the-wild-captcha-attacks | C-Frame: Characterizing and measuring in-the-wild CAPTCHA attacks.
</file>

===== Probes, inclusion rule, verdicts and hand codes =====

<file javascript mwc_fold.mjs>
// mwc_fold.mjs — probes, inclusion rule and hand verdicts behind
// security:malicious_web_content ("Malicious web content: cryptojacking,
// exploit kits, malvertising and skimmers"). Imported by
// report_malicious_web_content.mjs; nothing here is computed, it is the audit surface.
//
// The probes produce a CANDIDATE set. The population is the hand verdict below,
// and the report throws if a candidate has no verdict or a verdict names a paper
// that is not a candidate.

// The 2026-09-22 gap pass's regex, unchanged (gap_probe_fulltext_20260922.mjs, family "malicious_web_content").
export const GAP_RE = /malvertis|cryptojack|crypto-?mining script|coinhive|drive-by download|exploit kit|web skimm|magecart|formjack|malicious JavaScript|malicious (web ?site|page)s?\b/gi;
// In-browser mining vocabulary, including the service and product names of 2017–2019.
export const MINE_RE = /cryptojack\w*|crypto-jack\w*|coin-?hive|(in-browser|browser-based|web-based|drive-by|browser) (crypto(currency)? )?(coin )?min(ing|ers?)\b|crypto-?loot|coinimp|jsecoin|web ?miners?\b|(crypto)?mining scripts?/gi;
// Exploit delivery: drive-by downloads, exploit kits, honeyclients, malicious JavaScript.
export const DRIVE_RE = /drive-?by(-| )?downloads?|drive-?by (attack|exploit|infection|malware)s?|exploit[- ]kits?\b|honey-?clients?|heap[- ]spray\w*|malicious javascript|javascript malware|malicious JS\b|web-?based malware|malware distribution (sites?|networks?|campaigns?)/gi;
// Malicious advertising.
export const MALV_RE = /malvertis\w*|malicious (ad|advertisement|advertising)s?\b|malicious ad (network|campaign)s?/gi;
// Web skimming and third-party script compromise. Also matches physical card skimmers — the verdicts sort that out.
export const SKIM_RE = /(web|e-|digital|online|card|credit[- ]card|payment|javascript|js)[- ]?skimm\w*|magecart|formjack\w*|skimming (script|code|attack|malware)s?|polyfill\.io|(javascript|script|web|third-party script) supply[- ]chain (attacks?|compromises?)/gi;
// Schema channel: the extraction's own free-text fields (detection phenomenon/technique,
// classification resourceName/targetDetail, population sourceList).
export const SCHEMA_RE = /malvertis|cryptojack|crypto-?min|coinhive|in-browser min|drive-?by|exploit[- ]kit|malicious (javascript|js|web ?page|web ?site|page|site|url|ad|advertis|content|script|iframe|redirect)|skimm|magecart|formjack|malware (url|distribution|download|hosting)|compromised (web ?site|site)|honey-?client|web-?based malware|injected (script|code)/i;
// ---- Snapshot pin (added 2026-10-08). The corpus grew WHILE this page was written: at 11:35 that day 94
// records were appended to extractions.jsonl (IMC 2026: 81; IEEE S&P 2024: 11, 2021: 1, 2023: 1, all with
// extractedAt 2026-10-08) and IMC-2026.json (99 records) was added to the venue index. Every other page on the
// wiki, and literature:corpus, describe the 5,859-paper / 16,864-record snapshot, so this page is pinned to it.
// The 94 are probed separately (report PASS L) and the report throws if any crosses a candidate threshold.
export const SNAPSHOT_DATE = '2026-10-08';
export const inSnapshot = (p) => p.extractedAt < SNAPSHOT_DATE;
export const META_EXCLUDE = new Set(['IMC-2026.json']);
// Post-snapshot records that cross a candidate threshold, read and verdicted but NOT counted on the page
// (they are outside the snapshot every figure uses). The report throws on any crosser not listed here.
export const POST_VERDICTS = {
  'IMC/2026/honey-configs-measuring-the-emerging-exploitation-of-cloud-ip-address-reuse': 'would be IN (section, injected): dangling-DNS names of legitimate domains serving attacker content; 55 (0.4%) of sampled hostnames flagged by >= 3 VirusTotal engines. Added to the corpus 2026-10-08, after the snapshot; named on the page, not counted',
};
export const THRESH = { GAP: 5, MINE: 5, DRIVE: 5, MALV: 3, SKIM: 3 };
// Seventh channel, added 2026-10-08 when the "nothing after 2023" finding was re-checked: topic phrases over
// TITLE + ABSTRACT of the whole 16,864-record venue index (data/corpus2/.meta). Its extracted hits join the
// candidate set; its non-extracted hits are printed by mwc_screening_probe.mjs as funnel losses. No bare
// "malicious"/"malware": they fire on MPC "malicious adversaries" and binary malware.
export const INDEX_RE = /cryptojack\w*|crypto-?jack\w*|coin-?hive|(in-browser|browser-based|web-based|drive-by) (crypto(currency)? )?(coin )?min(ing|ers?)\b|malvertis\w*|malicious (web )?(ad|ads|advertisements?|advertising)\b|skimm\w*|magecart|formjack\w*|drive-?by(-| )?(downloads?|attacks?|malware|infections?)|exploit[- ]kits?|malicious (javascript|js|web ?pages?|web ?sites?|scripts?|web content|content|redirect\w*|iframes?)|web-?based malware|polyfill\.io|link integrity|subresource integrity|(third-party|javascript|web|front-?end) (script )?supply[- ]chain|compromised (web ?sites?|sites)|watering[- ]hole|search (result )?poisoning|seo poisoning|traffic distribution systems?|click-?fix|fake (captcha|browser update)s?|(wallet|crypto) drainers?/i;

export const INCLUSION_RULE = `INCLUSION RULE (written before the verdicts were counted):
IN      — the paper's measured objects include malicious code or content that websites, ads or
          redirect chains serve to a visitor's browser and that acts against the visitor without
          consent: exploit pages and exploit kits (drive-by download), malicious JavaScript,
          deceptive or forced malware downloads, malicious advertising, search poisoning whose
          destinations deliver malware, in-browser cryptomining without consent (cryptojacking),
          payment-form skimming, and malicious code injected into or included by an otherwise
          legitimate site (compromise, malicious third-party script or plugin). The paper collects
          instances in the wild (crawl, honeyclient, feed, network trace, passive DNS, telemetry,
          site backups) and measures, detects, clusters or labels them. A detector or defence counts
          only if it is evaluated on in-the-wild web content, not only on synthetic samples.
          SCOPE: P = the paper is about it; S = one section of a paper about something else.
CONTEXT — the adjacent subject, owned elsewhere or outside the visitor frame: scams whose harm is a
          payment (security:online_scams), phishing (security:phishing), script-analysis and evasion
          technique without an in-the-wild malicious census (privacy:javascript), malicious browser
          extensions, mining malware on hosts, routers, IoT, CI or cloud (out of scope by the brief),
          search abuse with generic destinations, malicious URL/domain infrastructure without the
          served content, how sites get compromised, notification, third-party dependency risk
          without malicious content, package-registry supply chain, mobile in-app ads, lab-only
          defences, proof-of-concept browser-feature abuse, and users' exposure from telemetry.
OUT     — incidental, non-web malware, physical card skimmers (a homonym), fraud against a platform.
Boundary with security:online_scams: a malicious-ad or redirect paper whose measured destinations
include malware, exploit or unwanted-download delivery is IN here and may also be IN there; one whose
destinations are only scams is CONTEXT scams here.`;

export const IN_TYPES = {
  exploit: 'exploit pages, exploit kits, drive-by downloads, malicious JavaScript found on web pages',
  download: 'deceptive or forced malware / unwanted-software downloads from web pages',
  search: 'search poisoning whose destinations deliver malware',
  malvertising: 'malicious ads, ad chains and push ads',
  mining: 'in-browser cryptomining without consent (cryptojacking)',
  injected: 'malicious code injected into or included by legitimate sites (compromise, third-party script, plugin, cloud bucket)',
  general: 'several kinds of malicious destination, grouped into campaigns or redirect systems',
  skimming: 'payment-form (web) skimming',
};
export const CONTEXT_CODES = {
  scams: 'scams whose harm is a payment (security:online_scams)',
  phishing: 'credential theft (security:phishing)',
  javascript: 'script analysis, obfuscation or evasion technique, or intrusive script behaviour, without an in-the-wild malicious census (privacy:javascript)',
  extension: 'malicious browser extensions',
  'host-mining': 'mining malware on hosts, routers, IoT devices, CI or cloud; mining pools and traffic',
  'search-abuse': 'search poisoning or SEO abuse whose destinations are generic or not malware',
  infra: 'malicious URL / domain / hosting infrastructure without the served content',
  'site-compromise': 'how sites get compromised, web-server malware, compromise prediction',
  notification: 'notifying compromised sites (practices:notifying_websites)',
  'third-party-risk': 'third-party dependency and library risk without malicious content measured',
  'supply-chain': 'malicious packages in software registries (not served to visitors)',
  mobile: 'malicious or devious in-app mobile ads',
  'defence-lab': 'defence or forensics evaluated on simulated attacks only',
  'attack-capability': 'proof-of-concept abuse of a browser feature, not measured in the wild',
  'user-exposure': "users' exposure to malicious content from telemetry or logs",
  'social-url': 'malicious URLs posted on social platforms (the post, not the content)',
  'domain-abuse': 'parking, typosquatting, name systems (security:domain_abuse)',
  cloaking: 'cloaking against crawlers as a method (programming:crawler_detection)',
  ads: 'problematic ads measured as ad content (privacy:advertising)',
  'web-vuln': 'vulnerabilities in sites (security:web_vulnerabilities)',
  download: 'trojanised software the user seeks out',
  ecosystem: 'exploit-kit server code, exploit trade and underground markets',
  'on-path': 'malicious or ad content injected into page traffic by network operators, not served by the site',
};
export const OUT_CODES = {
  mention: 'malicious web content incidental to another topic',
  'non-web': 'malware or attacks outside the web platform',
  homonym: 'physical card skimmers and card scanning',
  mobile: 'mobile app security without served web content',
  'other-fraud': 'fraud against a platform or advertiser',
};

// [key, verdict, code (IN: type; CONTEXT/OUT: code), scope (IN only: P primary / S section), note]
export const VERDICTS = [
  ["USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths", "IN", "download", "P", "WebWitness: malware download paths on an academic network"],
  ["USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks", "IN", "download", "P", "social-engineering software download attacks on a live academic network"],
  ["CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections", "IN", "exploit", "P", "drive-by defence evaluated against daily-harvested in-the-wild malicious URLs"],
  ["CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service", "IN", "exploit", "P", "exploit-as-a-service: exploit kits, malicious URL feeds, passive DNS traffic estimates"],
  ["CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages", "IN", "exploit", "P", "SpiderWeb: crowd-sourced redirection chains classify malicious pages"],
  ["CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti", "IN", "exploit", "P", "poster: malicious pages by redirection-chain similarity, honeyclient labels"],
  ["IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages", "IN", "exploit", "P", "EvilSeed: guided search for malicious pages from seed URLs"],
  ["IEEE-SP/2012/rozzle-de-cloaking-internet-malware", "IN", "exploit", "P", "Rozzle: multi-path JavaScript execution to de-cloak environment-sensitive malware on live URLs"],
  ["IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o", "IN", "exploit", "P", "dedicated malicious hosts and TDSes in 5.5M-URL redirection graphs"],
  ["NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers", "IN", "exploit", "S", "CyberProbe: Internet-wide probing for malicious servers, exploit servers among them"],

  ["USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware", "IN", "exploit", "P", "Revolver: evasive web malware via AST similarity over Wepawet submissions"],
  ["WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod", "IN", "exploit", "P", "JSAND: emulation + anomaly detection of drive-by JavaScript on 140K+ pages (Wepawet)"],
  ["WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads", "IN", "exploit", "P", "ARROW: signatures for drive-by downloads from 3.5B honeyclient HTTP traces"],
  ["WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages", "IN", "exploit", "P", "Prophiler: static filter for malicious pages ahead of a dynamic honeyclient"],
  ["WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics", "IN", "general", "P", "analytics IDs link malicious URLs (malware, phishing, scams) into campaigns"],
  ["WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems", "IN", "general", "P", "abusive traffic distribution systems: malicious redirections (downloads, scams) by profile and vantage"],
  ["CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns", "IN", "injected", "P", "Delta: DOM-tree deltas of changed sites identify web-based infection campaigns"],
  ["CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma", "IN", "injected", "P", "malicious cloud repositories (buckets) that websites load resources from"],
  ["IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i", "IN", "injected", "P", "mass redirect-script injections on compromised sites (JsRED)"],
  ["USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web", "IN", "injected", "P", "third-party scripts intercepting clicks on 613 of 250K sites"],
  ["USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress", "IN", "injected", "P", "malicious WordPress plugins across eight years of site backups"],
  ["WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications", "IN", "injected", "P", "remotely included JavaScript in compromised web applications as indicators of compromise"],
  ["CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising", "IN", "malvertising", "P", "Knowing your enemy: malvertising on Alexa top-90K, ad redirection chains, MadTracer"],
  ["IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements", "IN", "malvertising", "P", "673,596 ads crawled and labelled with Wepawet, blacklists, VirusTotal"],
  ["IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att", "IN", "malvertising", "P", "social-engineering ad campaigns (fake software, scams) on low-tier ad networks"],
  ["IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising", "IN", "malvertising", "P", "malicious web-push ad campaigns"],
  ["USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks", "IN", "malvertising", "P", "TRIDENT: social-engineering ads (malicious downloads, scams) detected on 100K+ crawled sites"],
  ["WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions", "IN", "malvertising", "P", "malvertising delivered through ad-injecting extensions"],
  ["CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea", "IN", "mining", "P", "CMTracker: cryptojacking on 853,936 pages"],
  ["CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense", "IN", "mining", "P", "MineSweeper: drive-by mining on Alexa top 1M, Wasm/cache detector"],
  ["IMC/2018/digging-into-browser-based-crypto-mining", "IN", "mining", "P", "browser-based mining: crawl, Coinhive short links, pools"],
  ["IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem", "IN", "mining", "S", "porn-site privacy census; a section finds miners and VirusTotal-flagged third parties, per country"],
  ["NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system", "IN", "mining", "P", "MINOS: Wasm cryptojacking detector, in-the-wild sites"],
  ["USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking", "IN", "mining", "P", "cryptojacking campaigns at Internet scale: crawl plus NetFlow"],
  ["WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild", "IN", "mining", "P", "Outguard: cryptojacking detector and census on Alexa top 1M"],
  ["WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas", "IN", "mining", "S", "WebAssembly census: a section measures cryptomining's share of Wasm on live sites"],
  ["CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web", "IN", "search", "P", "trending-term search and Twitter results leading to malware-distributing and ad-filled sites"],
  ["CCS/2011/surf-detecting-and-measuring-search-poisoning", "IN", "search", "P", "SURF: search-poisoning redirection chains to fake AV, malware and scams"],
  ["USENIX/2011/deseo-combating-search-result-poisoning", "IN", "search", "P", "deSEO: search-result poisoning that spreads malware via compromised servers"],
  ["IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites", "CONTEXT", "ads", "-", "children's-site ads, a few linking to malicious content (privacy:advertising)"],
  ["PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic", "CONTEXT", "ads", "-", "problematic allowed ads"],
  ["CCS/2018/pride-and-prejudice-in-progressive-web-apps-abusing-native-app-like-features-in", "CONTEXT", "attack-capability", "-", "PWA feature abuse shown as proof of concept"],
  ["NDSS/2019/master-of-web-puppets-abusing-web-browsers-for-persistent-and-stealthy-computation", "CONTEXT", "attack-capability", "-", "service-worker persistent computation (proof of concept)"],
  ["NDSS/2024/compromising-industrial-processes-using-web-based-programmable-logic-controller-malware", "CONTEXT", "attack-capability", "-", "web-based PLC malware proof of concept"],
  ["USENIX/2023/r-b-ransomware-over-modern-web-browsers", "CONTEXT", "attack-capability", "-", "browser ransomware proof of concept"],
  ["USENIX/2025/shadowed-realities-an-investigation-of-ui-attacks-in-webxr", "CONTEXT", "attack-capability", "-", "WebXR UI attacks"],
  ["IEEE-SP/2016/cloak-of-visibility-detecting-when-machines-browse-a-different-web", "CONTEXT", "cloaking", "-", "Cloak of Visibility: cloaking against crawlers (method cited)"],
  ["CCS/2020/mnemosyne-an-effective-and-efficient-postmortem-watering-hole-attack-investigati", "CONTEXT", "defence-lab", "-", "watering-hole forensics evaluated on simulated attacks"],
  ["NDSS/2021/c2sr-cybercrime-scene-reconstruction-for-post-mortem-forensic-analysis", "CONTEXT", "defence-lab", "-", "cybercrime-scene forensics"],
  ["IMC/2022/challenges-in-decentralized-name-management-the-case-of-ens", "CONTEXT", "domain-abuse", "-", "ENS names"],
  ["NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains", "CONTEXT", "domain-abuse", "-", "parked domains"],
  ["NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse", "CONTEXT", "domain-abuse", "-", "typosquatting"],
  ["USENIX/2014/understanding-the-dark-side-of-domain-parking", "CONTEXT", "domain-abuse", "-", "domain parking monetisation (security:domain_abuse)"],
  ["CCS/2012/vanity-cracks-and-malware-insights-into-the-anti-copy-protection-ecosystem", "CONTEXT", "download", "-", "trojanised cracks and keygens the user seeks out (not content served to an unwitting visitor)"],
  ["NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration", "CONTEXT", "ecosystem", "-", "EKHUNTER: 30 leaked exploit kits' SERVER code analysed in a lab and attacked; nothing served to a visitor is collected (re-adjudicated 2026-10-08)"],
  ["CCS/2017/economic-factors-of-vulnerability-trade-and-exploitation", "CONTEXT", "ecosystem", "-", "exploit trade on a cybercrime forum"],
  ["CCS/2020/youve-changed-detecting-malicious-browser-extensions-through-their-update-deltas", "CONTEXT", "extension", "-", "malicious extension updates"],
  ["USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions", "CONTEXT", "extension", "-", "malicious browser extensions (Hulk)"],
  ["CCS/2019/just-the-tip-of-the-iceberg-internet-scale-exploitation-of-routers-for-cryptojac", "CONTEXT", "host-mining", "-", "router cryptojacking (out of scope by brief)"],
  ["CCS/2022/ready-raider-one-exploring-the-misuse-of-cloud-gaming-services", "CONTEXT", "host-mining", "-", "cloud gaming misuse incl. mining"],
  ["CCS/2023/under-the-dark-a-systematical-study-of-stealthy-mining-pools-ab-use-in-the-wild", "CONTEXT", "host-mining", "-", "stealthy mining pools"],
  ["IEEE-SP/2022/robbery-on-devops-understanding-and-mitigating-illicit-cryptomining-on-continuou", "CONTEXT", "host-mining", "-", "mining on CI platforms"],
  ["IMC/2019/a-first-look-at-the-crypto-mining-malware-ecosystem-a-decade-of-unrestricted-wea", "CONTEXT", "host-mining", "-", "crypto-mining malware binaries"],
  ["NDSS/2022/auto-draft-196", "CONTEXT", "host-mining", "-", "IoT cryptojacking detection (out of scope by brief)"],
  ["NDSS/2025/mineshark-cryptomining-traffic-detection-at-scale", "CONTEXT", "host-mining", "-", "cryptomining network traffic"],
  ["CCS/2016/predator-proactive-recognition-and-elimination-of-domain-abuse-at-time-of-regist", "CONTEXT", "infra", "-", "malicious domains at registration time"],
  ["IEEE-SP/2025/mantis-detection-of-zero-day-malicious-domains-leveraging-low-reputed-hosting-in", "CONTEXT", "infra", "-", "zero-day malicious domains from hosting"],
  ["IMC/2025/dive-into-the-cloud-unveiling-the-ab-usage-of-serverless-cloud-function-in-the-w", "CONTEXT", "infra", "-", "abuse of serverless function domains"],
  ["NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service", "CONTEXT", "infra", "-", "URL-shortener abuse"],
  ["NDSS/2026/indicator-of-benignity-an-industry-view-of-false-positive-in-malicious-domain-detection-and-its-mitigation", "CONTEXT", "infra", "-", "false positives in malicious-domain detection"],
  ["USENIX/2021/compromised-or-attacker-owned-a-large-scale-classification-and-study-of-hosting", "CONTEXT", "infra", "-", "hosting domains of malicious URLs: compromised vs attacker-owned"],
  ["WWW/2013/two-years-of-short-urls-internet-measurement-security-threats-and-countermeasure", "CONTEXT", "infra", "-", "short-URL threats and countermeasures"],
  ["CCS/2019/hidenoseek-camouflaging-malicious-javascript-in-benign-asts", "CONTEXT", "javascript", "-", "HideNoSeek: camouflaging malicious JS (attack technique)"],
  ["IEEE-SP/2022/wobfuscator-obfuscating-javascript-malware-via-opportunistic-translation-to-weba", "CONTEXT", "javascript", "-", "Wobfuscator: JS malware evasion via Wasm (attack technique)"],
  ["IMC/2020/hiding-in-plain-site-detecting-javascript-obfuscation-through-concealed-browser", "CONTEXT", "javascript", "-", "concealed browser-API usage (obfuscation)"],
  ["IMC/2021/knock-and-talk-investigating-local-network-communications-on-websites", "CONTEXT", "javascript", "-", "localhost and LAN requests by websites"],
  ["USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild", "CONTEXT", "javascript", "-", "JavaScript anti-debugging in the wild"],
  ["USENIX/2024/fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniques", "CONTEXT", "javascript", "-", "FV8 forced execution over extensions and npm"],
  ["WWW/2017/j-force-forced-execution-on-javascript", "CONTEXT", "javascript", "-", "J-Force forced execution; exploit-kit samples as test set only"],
  ["WWW/2019/anything-to-hide-studying-minified-and-obfuscated-code-in-the-web", "CONTEXT", "javascript", "-", "minified and obfuscated code (privacy:javascript)"],
  ["WWW/2023/automated-webassembly-function-purpose-identification-with-semantics-aware-analy", "CONTEXT", "javascript", "-", "WebAssembly function purpose (mining as one label)"],
  ["WWW/2024/detecting-and-understanding-self-deleting-javascript-code", "CONTEXT", "javascript", "-", "self-deleting JavaScript"],
  ["CCS/2014/poster-adhoneydroid-capture-malicious-android-advertisements", "CONTEXT", "mobile", "-", "malicious Android in-app ads (poster)"],
  ["IMC/2024/whatcha-lookin-at-investigating-third-party-web-content-in-popular-android-apps", "CONTEXT", "mobile", "-", "third-party web content in Android apps"],
  ["USENIX/2026/when-fun-turns-toxic-a-first-look-at-aggressive-advertising-in-mini-games", "CONTEXT", "mobile", "-", "mini-game ads"],
  ["WWW/2019/revisiting-mobile-advertising-threats-with-madlife", "CONTEXT", "mobile", "-", "in-app mobile ads (MAdLife)"],
  ["WWW/2020/maddroid-characterizing-and-detecting-devious-ad-contents-for-android-apps", "CONTEXT", "mobile", "-", "devious in-app ad content (MadDroid)"],
  ["WWW/2023/are-mobile-advertisements-in-compliance-with-apps-age-group", "CONTEXT", "mobile", "-", "mobile ads and app age groups"],
  ["WWW/2016/remedying-web-hijacking-notification-effectiveness-and-webmaster-comprehension", "CONTEXT", "notification", "-", "web hijacking notification and cleanup (practices:notifying_websites)"],
  ["CCS/2016/phisheye-live-monitoring-of-sandboxed-phishing-kits", "CONTEXT", "phishing", "-", "phishing kits (security:phishing)"],
  ["CCS/2022/im-spartacus-no-im-spartacus-proactively-protecting-users-from-phishing-by-inten", "CONTEXT", "phishing", "-", "phishing cloaking turned into a defence"],
  ["IEEE-SP/2021/crawlphish-large-scale-analysis-of-client-side-cloaking-techniques-in-phishing", "CONTEXT", "phishing", "-", "CrawlPhish: phishing cloaking (security:phishing)"],
  ["WWW/2024/phishing-vs-legit-comparative-analysis-of-client-side-resources-of-phishing-and", "CONTEXT", "phishing", "-", "phishing sites' client-side resources"],
  ["IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams", "CONTEXT", "scams", "-", "survey scams (security:online_scams)"],
  ["IEEE-SP/2023/beyond-phish-toward-detecting-fraudulent-e-commerce-websites-at-scale", "CONTEXT", "scams", "-", "fraudulent e-commerce sites (security:online_scams)"],
  ["NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams", "CONTEXT", "scams", "-", "technical-support scams via malvertising (security:online_scams)"],
  ["NDSS/2023/double-and-nothing-understanding-and-detecting-cryptocurrency-giveaway-scams", "CONTEXT", "scams", "-", "crypto giveaway scams (security:online_scams)"],
  ["WWW/2018/exposing-search-and-advertisement-abuse-tactics-and-infrastructure-of-technical", "CONTEXT", "scams", "-", "technical-support scams via search (security:online_scams)"],
  ["IEEE-SP/2016/seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t", "CONTEXT", "search-abuse", "-", "promotional infections (SEO content injected into sites)"],
  ["IEEE-SP/2017/how-to-learn-klingon-without-a-dictionary-detection-and-measurement-of-black-key", "CONTEXT", "search-abuse", "-", "black keywords in Chinese SEO"],
  ["IEEE-SP/2019/measuring-and-analyzing-search-engine-poisoning-of-linguistic-collisions", "CONTEXT", "search-abuse", "-", "search poisoning of misspellings"],
  ["USENIX/2025/unsafe-llm-based-search-quantitative-analysis-and-mitigation-of-safety-risks-in", "CONTEXT", "search-abuse", "-", "AI search engines returning malicious URLs"],
  ["WWW/2026/unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma", "CONTEXT", "search-abuse", "-", "LLM search engines and black-hat SEO"],
  ["CCS/2019/malmax-multi-aspect-execution-for-automated-dynamic-web-server-malware-analysis", "CONTEXT", "site-compromise", "-", "PHP web-server malware analysis"],
  ["NDSS/2013/behind-the-scenes-of-online-attacks-an-analysis-of-exploitation-behaviors-on-the", "CONTEXT", "site-compromise", "-", "attacks against web honeypots (how sites get compromised)"],
  ["NDSS/2023/doitrust-dissecting-on-chain-compromised-internet-domains-via-graph-learning", "CONTEXT", "site-compromise", "-", "compromised domains via hidden hyperlinks"],
  ["USENIX/2014/automatically-detecting-vulnerable-websites-before-they-turn-malicious", "CONTEXT", "site-compromise", "-", "predicting which sites become malicious (compromise risk)"],
  ["WWW/2013/the-role-of-web-hosting-providers-in-detecting-compromised-websites", "CONTEXT", "site-compromise", "-", "hosting providers' detection of compromised accounts"],
  ["CCS/2010/detecting-and-characterizing-social-spam-campaigns", "CONTEXT", "social-url", "-", "malicious wall posts on Facebook; URLs, not served content"],
  ["NDSS/2012/warningbird-detecting-suspicious-urls-in-twitter-stream", "CONTEXT", "social-url", "-", "suspicious URLs in the Twitter stream"],
  ["NDSS/2020/deceptive-previews-a-study-of-the-link-preview-trustworthiness-in-social-platforms", "CONTEXT", "social-url", "-", "link previews on social platforms"],
  ["NDSS/2021/towards-measuring-supply-chain-attacks-on-package-managers-for-interpreted-languages", "CONTEXT", "supply-chain", "-", "malicious packages in PyPI/npm/RubyGems"],
  ["USENIX/2024/donapi-malicious-npm-packages-detector-using-behavior-sequence-knowledge-mapping", "CONTEXT", "supply-chain", "-", "malicious npm packages"],
  ["USENIX/2026/cutting-the-gordian-knot-detecting-malicious-pypi-packages-via-a-knowledge-minin", "CONTEXT", "supply-chain", "-", "malicious PyPI packages"],
  ["IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda", "CONTEXT", "third-party-risk", "-", "vulnerable client-side libraries over four years (counts polyfill.io and Flash)"],
  ["PETS/2026/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government", "CONTEXT", "third-party-risk", "-", "government-site tracker archaeology; describes the 2024 polyfill.io compromise"],
  ["WWW/2017/security-challenges-in-an-increasingly-tangled-web", "CONTEXT", "third-party-risk", "-", "implicit trust in third-party resources (no malicious content measured)"],
  ["WWW/2017/who-controls-the-internet-analyzing-global-threats-using-property-graph-traversa", "CONTEXT", "third-party-risk", "-", "service-dependency graph"],
  ["WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading", "CONTEXT", "third-party-risk", "-", "third-party dependency chains; VirusTotal \"suspicious\" includes data-mishandling trackers"],
  ["CCS/2014/an-epidemiological-study-of-malware-encounters-in-a-large-enterprise", "CONTEXT", "user-exposure", "-", "enterprise malware encounters from AV and proxy logs"],
  ["CCS/2018/predicting-impending-exposure-to-malicious-content-from-user-behavior", "CONTEXT", "user-exposure", "-", "predicting users' exposure from cellular HTTP logs"],
  ["CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the", "CONTEXT", "web-vuln", "-", "DOM gadgets"],
  ["NDSS/2020/fuse-finding-file-upload-bugs-via-penetration-testing", "CONTEXT", "web-vuln", "-", "file-upload bugs"],
  ["NDSS/2020/melting-pot-of-origins-compromising-the-intermediary-web-services-that-rehost-websites", "CONTEXT", "web-vuln", "-", "web rehosting services"],
  ["USENIX/2022/web-cache-deception-escalates", "CONTEXT", "web-vuln", "-", "web cache deception"],
  ["USENIX/2025/xssky-detecting-xss-vulnerabilities-through-local-path-persistent-fuzzing", "CONTEXT", "web-vuln", "-", "XSS fuzzing"],
  ["IEEE-SP/2019/kiss-from-a-rogue-evaluating-detectability-of-pay-at-the-pump-card-skimmers", "OUT", "homonym", "-", "pay-at-the-pump card skimmers"],
  ["IEEE-SP/2021/doing-good-by-fighting-fraud-ethical-anti-fraud-systems-for-mobile-payments", "OUT", "homonym", "-", "mobile-payment card scanning"],
  ["USENIX/2018/fear-the-reaper-characterization-and-fast-detection-of-card-skimmers", "OUT", "homonym", "-", "physical card skimmers (NYPD reports), not web skimming"],
  ["USENIX/2019/please-pay-inside-evaluating-bluetooth-based-detection-of-gas-pump-skimmers", "OUT", "homonym", "-", "gas-pump Bluetooth skimmers"],
  ["USENIX/2020/boxer-preventing-fraud-by-scanning-credit-cards", "OUT", "homonym", "-", "credit-card scanning in apps"],
  ["CCS/2010/dieharder-securing-the-heap", "OUT", "mention", "-", "heap allocator; heap spraying as motivation"],
  ["CCS/2012/the-devil-is-in-the-implementation-details-an-empirical-analysis-of-oauth-sso-sy", "OUT", "mention", "-", "OAuth SSO implementation flaws"],
  ["CCS/2013/cross-origin-pixel-stealing-timing-attacks-using-css-filters", "OUT", "mention", "-", "CSS timing attack"],
  ["CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis", "OUT", "mention", "-", "1M-site tracking census"],
  ["CCS/2018/printracker-fingerprinting-3d-printers-using-commodity-scanners", "OUT", "mention", "-", "3D printer fingerprinting"],
  ["CCS/2018/property-inference-attacks-on-fully-connected-neural-networks-using-permutation", "OUT", "mention", "-", "neural-network property inference"],
  ["CCS/2019/adversarial-perceptual-ad-blocking-meets-adversarial-machine-learning", "OUT", "mention", "-", "perceptual ad blocking"],
  ["CCS/2019/watching-you-watch-the-tracking-ecosystem-of-over-the-top-tv-streaming-devices", "OUT", "mention", "-", "OTT tracking"],
  ["CCS/2022/an-extensive-study-of-residential-proxies-in-china", "OUT", "mention", "-", "residential proxies"],
  ["CCS/2022/distinct-identity-theft-using-in-browser-communications-in-dual-window-single-si", "OUT", "mention", "-", "dual-window SSO"],
  ["CCS/2022/watch-your-back-identifying-cybercrime-financial-relationships-in-bitcoin-throug", "OUT", "mention", "-", "bitcoin tracing"],
  ["CCS/2023/cybercrime-bitcoin-revenue-estimations-quantifying-the-impact-of-methodology-and", "OUT", "mention", "-", "bitcoin revenue methods"],
  ["CCS/2024/stealing-trust-unraveling-blind-message-attacks-in-web3-authentication", "OUT", "mention", "-", "Web3 authentication"],
  ["CCS/2025/deep-dive-into-in-app-browsers-uncovering-hidden-pitfalls-in-certificate-validat", "OUT", "mention", "-", "in-app browser certificates"],
  ["IEEE-SP/2010/a-practical-attack-to-de-anonymize-social-network-users", "OUT", "mention", "-", "history-stealing de-anonymisation"],
  ["IEEE-SP/2012/off-path-tcp-sequence-number-inference-attack-how-firewall-middleboxes-reduce-se", "OUT", "mention", "-", "TCP sequence inference"],
  ["IEEE-SP/2013/cookieless-monster-exploring-the-ecosystem-of-web-based-device-fingerprinting", "OUT", "mention", "-", "fingerprinting ecosystem"],
  ["IEEE-SP/2016/sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-with-public", "OUT", "mention", "-", "SMS gateways"],
  ["IEEE-SP/2021/reading-between-the-lines-an-extensive-evaluation-of-the-security-and-privacy-im", "OUT", "mention", "-", "EPUB readers"],
  ["IEEE-SP/2021/real-world-snapshots-vs-theory-questioning-the-t-probing-security-model", "OUT", "mention", "-", "hardware snapshots"],
  ["IEEE-SP/2023/aem-facilitating-cross-version-exploitability-assessment-of-linux-kernel-vulnera", "OUT", "mention", "-", "kernel exploits"],
  ["IEEE-SP/2024/shedding-light-on-cvss-scoring-inconsistencies-a-user-centric-study-on-evaluatin", "OUT", "mention", "-", "CVSS"],
  ["IEEE-SP/2025/only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on", "OUT", "mention", "-", "brokered SSO"],
  ["IMC/2017/ethical-issues-in-research-using-datasets-of-illicit-origin", "OUT", "mention", "-", "ethics of illicit-origin datasets"],
  ["IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n", "OUT", "mention", "-", "political ads"],
  ["IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls", "OUT", "mention", "-", "stale TLS certificates"],
  ["IMC/2025/decoy-databases-analyzing-attacks-on-public-facing-databases", "OUT", "mention", "-", "database honeypots"],
  ["NDSS/2019/graph-based-security-and-privacy-analytics-via-collective-classification-with-joint-weight-learning-and-propagation", "OUT", "mention", "-", "collective classification"],
  ["NDSS/2024/understanding-and-analyzing-appraisal-systems-in-the-underground-marketplaces", "OUT", "mention", "-", "underground appraisal systems"],
  ["NDSS/2025/power-related-side-channel-attacks-using-the-android-sensor-framework", "OUT", "mention", "-", "sensor side channel"],
  ["NDSS/2026/sok-take-a-deep-step-into-linux-kernel-hardening-effectiveness-from-the-offensive-defensive-perspective", "OUT", "mention", "-", "kernel hardening"],
  ["PETS/2016/near-optimal-fingerprinting-with-constraints", "OUT", "mention", "-", "fingerprinting algorithms"],
  ["PETS/2017/detecting-anti-ad-blockers-in-the-wild", "OUT", "mention", "-", "anti-ad-blockers"],
  ["PETS/2017/on-the-privacy-and-security-of-the-ultrasound-ecosystem", "OUT", "mention", "-", "ultrasound beacons"],
  ["PETS/2020/in-depth-evaluation-of-redirect-tracking-and-link-usage", "OUT", "mention", "-", "redirect tracking"],
  ["PETS/2020/sok-anatomy-of-data-breaches", "OUT", "mention", "-", "data breach SoK"],
  ["PETS/2021/awareness-adoption-and-misconceptions-of-web-privacy-tools", "OUT", "mention", "-", "privacy-tool survey"],
  ["USENIX/2011/permission-re-delegation-attacks-and-defenses", "OUT", "mention", "-", "Android permission re-delegation"],
  ["USENIX/2012/an-evaluation-of-the-google-chrome-extension-security-architecture", "OUT", "mention", "-", "Chrome extension security architecture"],
  ["USENIX/2014/from-the-aether-to-the-ethernet-attacking-the-internet-using-broadcast-digital-t", "OUT", "mention", "-", "HbbTV broadcast attacks"],
  ["USENIX/2018/fuze-towards-facilitating-exploit-generation-for-kernel-use-after-free-vulnerabi", "OUT", "mention", "-", "kernel exploit generation"],
  ["USENIX/2018/sad-thug-structural-anomaly-detection-for-transmissions-of-high-value-informatio", "OUT", "mention", "-", "image steganography anomaly detection"],
  ["USENIX/2020/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime", "OUT", "mention", "-", "ad-blocker lab study"],
  ["USENIX/2021/alpaca-application-layer-protocol-confusion-analyzing-and-mitigating-cracks-in-t", "OUT", "mention", "-", "TLS protocol confusion"],
  ["USENIX/2021/swiped-analyzing-ground-truth-data-of-a-marketplace-for-stolen-debit-and-credit", "OUT", "mention", "-", "stolen-card marketplace"],
  ["USENIX/2022/hand-me-your-pin-inferring-atm-pins-of-users-typing-with-a-covered-hand", "OUT", "mention", "-", "ATM PIN inference"],
  ["USENIX/2022/playing-for-k-h-eaps-understanding-and-improving-linux-kernel-exploit-reliabilit", "OUT", "mention", "-", "kernel exploit reliability"],
  ["USENIX/2023/a-research-framework-and-initial-study-of-browser-security-for-the-visually-impa", "OUT", "mention", "-", "visually impaired users and warnings"],
  ["USENIX/2023/back-to-school-on-the-in-security-of-academic-vpns", "OUT", "mention", "-", "academic VPNs"],
  ["USENIX/2023/isolated-and-exhausted-attacking-operating-systems-via-site-isolation-in-the-bro", "OUT", "mention", "-", "site isolation attacks"],
  ["USENIX/2024/in-wallet-we-trust-bypassing-the-digital-wallets-payment-security-for-free-shopp", "OUT", "mention", "-", "digital wallets"],
  ["USENIX/2024/windows-into-the-past-exploiting-legacy-crypto-in-modern-oss-kerberos-implementa", "OUT", "mention", "-", "Kerberos"],
  ["USENIX/2025/dns-flare-a-flush-reload-attack-on-dns-forwarders", "OUT", "mention", "-", "DNS forwarder attack"],
  ["USENIX/2025/i-have-no-idea-how-to-make-it-safer-studying-security-and-privacy-mindsets-of-br", "OUT", "mention", "-", "extension developers"],
  ["WWW/2015/no-escape-from-reality-security-and-privacy-of-augmented-reality-browsers", "OUT", "mention", "-", "AR browsers"],
  ["WWW/2015/rethinking-security-of-web-based-system-applications", "OUT", "mention", "-", "web-based system applications"],
  ["WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide", "OUT", "mention", "-", "redirection trails and HTTPS"],
  ["WWW/2020/autonav-evaluation-and-automatization-of-web-navigation-policies", "OUT", "mention", "-", "navigation policies"],
  ["WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field", "OUT", "mention", "-", "third-party dynamics"],
  ["WWW/2020/de-kodi-understanding-the-kodi-ecosystem", "OUT", "mention", "-", "Kodi add-ons"],
  ["WWW/2022/conspiracy-brokers-understanding-the-monetization-of-youtube-conspiracy-theories", "OUT", "mention", "-", "YouTube monetisation"],
  ["WWW/2023/cashing-in-on-contacts-characterizing-the-onlyfans-ecosystem", "OUT", "mention", "-", "OnlyFans"],
  ["CCS/2014/code-injection-attacks-on-html5-based-mobile-apps-characterization-detection-and", "OUT", "mobile", "-", "HTML5 mobile app code injection"],
  ["CCS/2017/unleashing-the-walking-dead-understanding-cross-app-remote-infections-on-mobile", "OUT", "mobile", "-", "remotely controllable WebViews"],
  ["USENIX/2022/identity-confusion-in-webview-based-mobile-app-in-app-ecosystems", "OUT", "mobile", "-", "app-in-app identity"],
  ["USENIX/2023/medusa-attack-exploring-security-hazards-of-in-app-qr-code-scanning", "OUT", "mobile", "-", "QR scanning"],
  ["CCS/2013/cross-platform-malware-write-once-infect-everywhere", "OUT", "non-web", "-", "cross-platform malware"],
  ["CCS/2015/the-dropper-effect-insights-into-malware-distribution-with-downloader-graph-anal", "OUT", "non-web", "-", "downloader graphs from host telemetry"],
  ["CCS/2019/effective-and-light-weight-deobfuscation-and-semantic-aware-attack-detection-for", "OUT", "non-web", "-", "PowerShell"],
  ["IEEE-SP/2012/dissecting-android-malware-characterization-and-evolution", "OUT", "non-web", "-", "Android malware"],
  ["IEEE-SP/2014/practical-evasion-of-a-learning-based-classifier-a-case-study", "OUT", "non-web", "-", "PDF malware classifier evasion"],
  ["IEEE-SP/2017/a-lustrum-of-malware-network-communication-evolution-and-insights", "OUT", "non-web", "-", "malware network communication"],
  ["IEEE-SP/2017/spotless-sandboxes-evading-malware-analysis-systems-using-wear-and-tear-artifact", "OUT", "non-web", "-", "sandbox evasion artefacts"],
  ["IEEE-SP/2019/holmes-real-time-apt-detection-through-correlation-of-suspicious-information-flo", "OUT", "non-web", "-", "APT detection"],
  ["IMC/2018/characterizing-the-internet-host-population-using-deep-learning-a-universal-and", "OUT", "non-web", "-", "host embeddings"],
  ["NDSS/2013/the-core-of-the-matter-analyzing-malicious-traffic-in-cellular-carriers", "OUT", "non-web", "-", "cellular malicious traffic"],
  ["NDSS/2017/a-broad-view-of-the-ecosystem-of-socially-engineered-exploit-documents", "OUT", "non-web", "-", "exploit documents"],
  ["NDSS/2017/catching-worms-trojan-horses-and-pups-unsupervised-detection-of-silent-delivery", "OUT", "non-web", "-", "silent delivery campaigns from host download events"],
  ["USENIX/2011/shellos-enabling-fast-detection-and-forensic-analysis-of-code-injection-attacks", "OUT", "non-web", "-", "code-injection network attacks and malicious PDFs"],
  ["USENIX/2014/targeted-threat-index-characterizing-and-quantifying-politically-motivated-targe", "OUT", "non-web", "-", "targeted malware against civil society"],
  ["USENIX/2014/when-governments-hack-opponents-a-look-at-actors-and-technology", "OUT", "non-web", "-", "government spyware"],
  ["USENIX/2016/measuring-pup-prevalence-and-pup-distribution-through-pay-per-install-services", "OUT", "non-web", "-", "PUP pay-per-install from AV telemetry"],
  ["USENIX/2019/attack2vec-leveraging-temporal-word-embeddings-to-understand-the-evolution-of-cy", "OUT", "non-web", "-", "IPS alert embeddings"],
  ["USENIX/2021/fragment-and-forge-breaking-wi-fi-through-frame-aggregation-and-fragmentation", "OUT", "non-web", "-", "Wi-Fi"],
  ["USENIX/2021/the-circle-of-life-a-large-scale-study-of-the-iot-malware-lifecycle", "OUT", "non-web", "-", "IoT malware"],
  ["WWW/2018/adbudgetkiller-online-advertising-budget-draining-attack", "OUT", "other-fraud", "-", "ad budget draining"],
  // ---- added 2026-10-08: extracted hits of the INDEX (title + abstract) channel that no full-text probe caught
  ["CCS/2014/a-nearly-four-year-longitudinal-study-of-search-engine-poisoning", "CONTEXT", "scams", "-", "four years of search-redirection poisoning toward unlicensed pharmacies (IN on security:online_scams)"],
  ["CCS/2015/the-sicilian-defense-signature-based-whitelisting-of-web-javascript", "CONTEXT", "third-party-risk", "-", "script whitelisting; three-month crawl of how often top-site scripts change (why raw SRI hashes break)"],
  ["WWW/2020/an-empirical-study-of-the-use-of-integrity-verification-mechanisms-for-web-subre", "CONTEXT", "third-party-risk", "-", "Subresource Integrity adoption in Common Crawl (security:headers); the defence against a swapped third-party script"],
  ["NDSS/2021/whos-hosting-the-block-party-studying-third-party-blockage-of-csp-and-sri", "CONTEXT", "third-party-risk", "-", "third parties that block CSP/SRI deployment (security:headers)"],
  ["WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells", "CONTEXT", "site-compromise", "-", "PHP web shells: what an attacker installs on a compromised server (server side)"],
  ["USENIX/2016/website-targeted-false-content-injection-by-network-operators", "CONTEXT", "on-path", "-", "out-of-band injection of ads and some malicious content by network operators"],
  ["IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni", "CONTEXT", "phishing", "-", "phishing-blacklist evasion"],
  ["IMC/2020/are-you-human-resilience-of-phishing-detection-to-evasion-techniques-based-on-hu", "CONTEXT", "phishing", "-", "CAPTCHA-gated phishing vs crawlers"],
  ["IMC/2022/phishweb-a-progressive-multi-layered-system-for-phishing-websites-detection", "CONTEXT", "phishing", "-", "phishing-site detector"],
  ["IMC/2025/unmasking-the-shadow-economy-a-deep-dive-into-drainer-as-a-service-phishing-on-e", "CONTEXT", "phishing", "-", "wallet drainer kits on phishing sites (security:phishing)"],
  ["WWW/2026/netting-phish-in-the-ipfs-ocean-real-time-monitoring-and-characterization-of-dec", "CONTEXT", "phishing", "-", "phishing on IPFS gateways"],
  ["NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media", "CONTEXT", "social-url", "-", "unintended URLs in social posts"],
  ["USENIX/2012/efficient-and-scalable-socware-detection-in-online-social-networks", "CONTEXT", "social-url", "-", "socware posts on Facebook"],
  ["NDSS/2022/auto-draft-261", "CONTEXT", "search-abuse", "-", "local-business search poisoning for illicit drugs"],
  ["USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black", "CONTEXT", "search-abuse", "-", "wildcard-DNS spider pools for blackhat SEO"],
  ["USENIX/2021/scalable-detection-of-promotional-website-defacements-in-black-hat-seo-campaigns", "CONTEXT", "search-abuse", "-", "promotional defacements injected for SEO (aimed at search engines, not visitors' browsers)"],
  ["USENIX/2024/into-the-dark-unveiling-internal-site-search-abused-for-black-hat-seo", "CONTEXT", "search-abuse", "-", "internal-site-search abuse for SEO (Baidu traffic)"],
  ["NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection", "CONTEXT", "web-vuln", "-", "client-side open redirects (security:web_vulnerabilities)"],
  ["USENIX/2025/darkgram-a-large-scale-analysis-of-cybercriminal-activity-channels-on-telegram", "CONTEXT", "ecosystem", "-", "cybercriminal Telegram channels"],
  ["USENIX/2026/overcoming-the-retrieval-barrier-indirect-prompt-injection-in-the-wild-for-llm-s", "CONTEXT", "attack-capability", "-", "indirect prompt injection planted for LLM retrieval (attack demonstration; content aimed at agents, not people)"],
  ["IEEE-SP/2024/mawseo-adversarial-wiki-search-poisoning-for-illicit-online-promotion", "CONTEXT", "attack-capability", "-", "adversarial wiki edits for illicit promotion (attack demonstration)"],
  ["CCS/2012/collaborative-tcp-sequence-number-inference-attack-how-to-crack-sequence-number", "OUT", "non-web", "-", "TCP sequence inference"],
  ["CCS/2017/poised-spotting-twitter-spam-off-the-beaten-paths", "OUT", "mention", "-", "Twitter spam"],
  ["CCS/2019/poster-understanding-users-decision-to-interact-with-potential-phishing-posts-on", "OUT", "mention", "-", "vignette study of phishing posts"],
  ["IEEE-SP/2011/repriv-re-imagining-content-personalization-and-in-browser-privacy", "OUT", "mention", "-", "in-browser personalisation"],
  ["IEEE-SP/2019/breaking-lte-on-layer-two", "OUT", "non-web", "-", "LTE layer two"],
  ["IEEE-SP/2023/blues-clues-practical-discovery-of-non-discoverable-bluetooth-devices", "OUT", "non-web", "-", "Bluetooth discovery"],
  ["IEEE-SP/2023/privacy-leakage-via-unrestricted-motion-position-sensors-in-the-age-of-virtual-r", "OUT", "mention", "-", "VR sensor side channel"],
  ["IEEE-SP/2024/from-chatbots-to-phishbots-phishing-scam-generation-in-commercial-large-language", "OUT", "mention", "-", "LLM-generated phishing"],
  ["IMC/2025/quantifying-the-threat-of-sandwiching-mev-on-jito-a-measurement-of-solanas-leadi", "OUT", "non-web", "-", "Solana MEV"],
  ["NDSS/2025/themis-regulating-textual-inversion-for-personalized-concept-censorship", "OUT", "mention", "-", "diffusion-model concept censorship"],
  ["NDSS/2026/cache-me-catch-you-cache-related-security-threats-in-llm-serving-frameworks", "OUT", "mention", "-", "LLM serving caches"],
  ["NDSS/2026/odysseus-jailbreaking-commercial-multimodal-llm-integrated-systems-via-dual-steganography", "OUT", "mention", "-", "multimodal LLM jailbreak"],
  ["USENIX/2015/evilcohort-detecting-communities-of-malicious-accounts-on-online-services", "OUT", "mention", "-", "malicious accounts"],
  ["USENIX/2018/off-path-tcp-exploit-how-wireless-routers-can-jeopardize-your-secrets", "OUT", "non-web", "-", "off-path TCP"],
  ["USENIX/2021/effective-notification-campaigns-on-the-web-a-matter-of-trust-framing-and-suppor", "OUT", "mention", "-", "notifications about Google Analytics IP anonymisation"],
  ["USENIX/2022/targeted-deanonymization-via-the-cache-side-channel-attacks-and-defenses", "OUT", "mention", "-", "cache side channel"],
  ["USENIX/2025/url-inspection-tasks-helping-users-detect-phishing-links-in-emails", "OUT", "mention", "-", "user study on phishing links"],
  ["USENIX/2025/i-cannot-write-this-because-it-violates-our-content-policy-understanding-content", "OUT", "mention", "-", "LLM content policies"],
  ["WWW/2017/smartgen-exposing-server-urls-of-mobile-apps-with-selective-symbolic-execution", "OUT", "mobile", "-", "mobile app server URLs"],
  ["WWW/2017/detecting-collusive-spamming-activities-in-community-question-answering", "OUT", "mention", "-", "CQA spam"],
  ["WWW/2018/collective-classification-of-spam-campaigners-on-twitter-a-hierarchical-meta-pat", "OUT", "mention", "-", "Twitter spam campaigners"],
  ["WWW/2019/a-large-scale-study-on-the-risks-of-the-html5-webapi-for-mobile-sensor-based-att", "OUT", "mention", "-", "HTML5 sensor API risks"],
  ["WWW/2023/a-passage-level-reading-behavior-model-for-mobile-search", "OUT", "mention", "-", "reading behaviour model"],
];

// Papers the recall probe found OUTSIDE the candidate set that the page cites as context.
export const EXTRA_CONTEXT = [
  ['CCS/2020/continuous-and-multiregional-monitoring-of-malicious-hosts', 'poster: malicious hosts probed from seven AWS regions for 16 months; behaviour by region (design:crawling_location)'],
];

// Hand codes for the IN papers, read from each paper's full text (notes/mwc_papers_{A,B,C}.md hold
// the verbatim quotes each code rests on). Multi-valued fields are arrays.
export const HAND_FIELDS = {
  detect: {
    honeyclient: 'executes the page in an instrumented browser, emulator or VM and looks for exploitation or infection (Wepawet, Capture-HPC, custom honeyclient)',
    behavioural: 'runtime signals of what the code does, in an instrumented browser: CPU, WebAssembly, WebSocket / Stratum traffic, cache, API traces, navigations',
    signature: 'known-bad matching: script signatures, filter lists (NoCoin, CoinBlockerLists), URL or domain blacklists, YARA or regex rules',
    'static-ml': 'a learned classifier over static features of the page, script, URL or ad',
    graph: 'redirect-chain, dependency, hosting or campaign graph analysis',
    network: 'passive network traces, NetFlow, DNS or proxy logs',
    av: 'antivirus or VirusTotal verdicts used as the detector',
    manual: 'manual analysis is the detector',
  },
  gt: {
    blocklist: 'blacklists, threat feeds or filter lists',
    av: 'VirusTotal or antivirus verdicts',
    honeyclient: "a dynamic analyser's verdict (Wepawet and the like)",
    manual: 'researchers hand-checked a sample',
    vendor: "a partner's production data (search engine, ad network, AV vendor, hosting backups)",
    'own-rule': "only the paper's own detector or rule; no independent label",
  },
  visits: {
    single: 'each site or URL visited once (one snapshot)',
    repeated: 'sites revisited over time',
    'multi-config': 'sites visited under several configurations, profiles or vantage points',
    passive: 'no active visits: traces, telemetry, feeds, backups',
    'not-stated': 'not stated',
  },
  vantage: {
    single: 'one location or network stated',
    multi: 'several locations, networks or IP types',
    passive: 'observed from a network or partner, not a crawler',
    'not-stated': 'not stated',
  },
  cloak: {
    measured: 'compared configurations or vantages, or quantified evasion, on their own data',
    addressed: 'took a countermeasure (IP rotation, real browser, emulation, forced execution) without measuring the difference',
    none: 'not discussed as affecting their count',
  },
};

// [key, detect[], gt[], visits, vantage, cloak, reportsBlocklistOrAVMiss, dataWindow]
export const HAND = [
  // assembled 2026-10-08 from notes/mwc_hand_{A,B,C}.md (three sonnet coders, one per notes file; each row's
  // justification quotes are in those files). EKHUNTER's row dropped when it was re-adjudicated CONTEXT.
  ["CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections", ["honeyclient"], ["own-rule", "av"], "multi-config", "not-stated", "none", true, "not stated"],
  ["CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense", ["signature", "behavioural"], ["manual"], "single", "single", "none", true, "2018-03 to 2018-05"],
  ["IEEE-SP/2012/rozzle-de-cloaking-internet-malware", ["honeyclient", "static-ml"], ["honeyclient", "manual"], "multi-config", "not-stated", "measured", false, "not stated"],
  ["IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o", ["av", "graph"], ["av", "blocklist"], "single", "not-stated", "addressed", false, "2012-02 to 2012-08"],
  ["IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att", ["behavioural", "manual"], ["manual", "blocklist", "av"], "multi-config", "multi", "addressed", true, "not stated"],
  ["NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers", ["signature"], ["own-rule", "manual"], "repeated", "multi", "none", true, "2013-03 to 2013-08"],
  ["NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system", ["static-ml"], ["av", "manual"], "single", "not-stated", "none", false, "not stated"],
  ["USENIX/2011/deseo-combating-search-result-poisoning", ["static-ml", "signature", "manual"], ["manual", "vendor"], "passive", "passive", "addressed", true, "2010-05 to 2011-02"],
  ["USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths", ["network", "graph", "av"], ["av", "manual"], "passive", "passive", "none", true, "not stated"],
  ["USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks", ["static-ml", "behavioural"], ["blocklist", "av", "manual"], "single", "not-stated", "none", true, "2021-10 to 2022-10"],
  ["WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages", ["static-ml"], ["honeyclient", "manual"], "single", "not-stated", "addressed", false, "not stated"],
  ["WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions", ["behavioural", "av"], ["av", "manual"], "single", "not-stated", "addressed", false, "2014-03 to 2014-05"],
  ["WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications", ["static-ml"], ["manual", "vendor"], "passive", "passive", "none", true, "2015-01 to 2015-08"],
  ["WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild", ["behavioural"], ["blocklist", "manual"], "single", "not-stated", "none", true, "2018-02 to 2018-10"],
  ["CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web", ["signature","static-ml"], ["blocklist","manual"], "repeated", "not-stated", "none", true, "2010-07 to 2011-04"],
  ["CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising", ["graph","static-ml","signature"], ["blocklist","av","vendor","manual"], "repeated", "multi", "measured", true, "2011-06 to 2011-10"],
  ["CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service", ["honeyclient","signature","graph","network"], ["vendor","blocklist","manual"], "passive", "passive", "addressed", true, "2012-03 to 2012-05"],
  ["CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti", ["static-ml","honeyclient"], ["honeyclient"], "not-stated", "not-stated", "none", false, "2012-07 to 2014-12"],
  ["IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i", ["signature","behavioural"], ["av","blocklist","vendor","manual"], "not-stated", "not-stated", "measured", true, "2012-04 to 2013-08"],
  ["IMC/2018/digging-into-browser-based-crypto-mining", ["signature","behavioural"], ["blocklist","manual","own-rule"], "single", "not-stated", "none", true, "2018-02 to 2018-07"],
  ["IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem", ["av"], ["av"], "multi-config", "multi", "measured", false, "not stated"],
  ["IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising", ["behavioural","graph","signature","manual"], ["blocklist","av","manual"], "multi-config", "not-stated", "addressed", true, "2019-09 to 2019-10"],
  ["USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware", ["honeyclient","manual"], ["honeyclient","manual"], "passive", "passive", "measured", false, "not stated"],
  ["USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks", ["network","graph","static-ml","manual"], ["manual","av"], "passive", "passive", "none", true, "not stated"],
  ["WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod", ["honeyclient"], ["honeyclient","manual"], "multi-config", "single", "addressed", true, "2008-01 to 2009-11"],
  ["WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics", ["graph","signature"], ["av","vendor"], "not-stated", "not-stated", "none", true, "2017-02 to 2017-09"],
  ["WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas", ["av","manual"], ["av","manual"], "single", "not-stated", "none", false, "2020-04 to 2020-09"],
  ["CCS/2011/surf-detecting-and-measuring-search-poisoning", ["static-ml","graph"], ["manual"], "repeated", "not-stated", "measured", true, "2010-09 to 2011-04"],
  ["CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns", ["static-ml"], ["honeyclient","manual"], "repeated", "not-stated", "none", false, "2013-01 to 2013-05"],
  ["CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages", ["graph","static-ml"], ["av","manual"], "passive", "passive", "addressed", true, "2012-02 to 2012-03"],
  ["CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma", ["static-ml","graph"], ["av","blocklist","manual"], "single", "not-stated", "measured", false, "2015-02"], // blcmp false (author 2026-10-08): coder C flagged "true" as a stretch; no missed-by-list figure
  ["CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea", ["behavioural"], ["manual"], "single", "not-stated", "measured", true, "not stated"], // window: coder C took 2018-04 from Table 2's report date; the crawl dates are not stated (author 2026-10-08)
  ["IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages", ["honeyclient","signature"], ["honeyclient","blocklist"], "not-stated", "not-stated", "measured", false, "2010-11 to 2011-11"],
  ["IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements", ["honeyclient","signature","av"], ["honeyclient","blocklist","av"], "repeated", "not-stated", "none", false, "not stated"],
  ["USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web", ["behavioural"], ["own-rule"], "single", "not-stated", "none", false, "2018-05"],
  ["USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking", ["behavioural","signature","network"], ["own-rule","manual"], "single", "single", "measured", false, "2017-09 to 2019-05"],
  ["USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress", ["signature"], ["manual","av"], "passive", "passive", "none", false, "2012-07 to 2020-07"],
  ["WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads", ["honeyclient","signature","graph"], ["honeyclient","vendor"], "not-stated", "not-stated", "none", false, "not stated"],
  ["WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems", ["static-ml","manual","av"], ["manual","av"], "multi-config", "multi", "measured", true, "2019-06 to 2019-08"],
];

// ---- The post-2023 question (added 2026-10-08). Two audits back the page's answer.
// (1) mwc_recent_probe.mjs: wider full-text vocabularies over every 2024–2026 paper outside the candidate
//     set. Every WEB-platform hit with >= 5 WIDE hits or any NEW-phenomenon string was read (title, extraction
//     summary, and full-text context where the title did not settle it); its verdict is here. The script
//     throws if such a paper has no entry.
export const RECENT_WIDE_RE = /malicious (scripts?|javascript|js|code|content|ads?|advert\w*|iframes?|redirect\w*|payloads?|web ?sites?|sites?|pages?|downloads?)\b|malware (distribution|download|delivery|hosting)|compromised (web ?sites?|sites?|pages?|cdns?|libraries|scripts?)|drive-?by|watering[- ]hole|exploit[- ]kits?|cryptojack\w*|skimm\w*|magecart|malvertis\w*|(script|javascript|web|front-?end|cdn) supply[- ]chain|polyfill\.io|injected (scripts?|javascript|code)/gi;
export const RECENT_NEW_RE = /click-?fix|fake (re)?captcha|fake (browser )?updates?|socgholish|clearfake|(wallet|crypto(currency)?|web3|asset) drainers?|drainer (kit|script|service|contract)s?|seo poisoning|search[- ]ads? (malware|abuse|impersonat\w*)|malicious (search )?ads? (impersonat\w*|for software)|polyfill\.io|fake (installers?|software downloads?)|tech(nical)? support scams?/gi;
export const RECENT_READ = {
  'achieving-interpretable-dl-based-web-attack-detection-through-malicious-payload-localization': 'OUT: attack payloads in HTTP requests to servers (WAF side)',
  'malla-demystifying-real-world-large-language-model-integrated-malicious-services': 'OUT: LLM-integrated malicious services sold underground',
  'peeking-through-the-window-fingerprinting-browser-extensions-through-page-visibl': 'OUT: extension fingerprinting',
  'in-security-of-file-uploads-in-node-js': 'CONTEXT web-vuln: file-upload vulnerabilities',
  'break-the-wall-from-bottom-automated-discovery-of-protocol-level-evasion-vulnera': 'OUT: WAF evasion',
  'scanned-and-scammed-insecurity-by-obsqrity-measuring-user-susceptibility-and-awa': 'OUT: QR-code user study',
  'cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange': 'CONTEXT attack-capability: HTTP/2 push and SXG attack, controlled tests',
  'characterizing-and-mitigating-phishing-attacks-at-cctld-scale': 'CONTEXT phishing (security:phishing)',
  'be-aware-of-what-you-let-pass-demystifying-url-based-authentication-bypass-vulne': 'CONTEXT web-vuln: authentication bypass',
  'passwords-and-fido2-are-meant-to-be-secret-a-practical-secure-authentication-cha': 'OUT: authentication channel design',
  'whats-in-phishers-a-longitudinal-study-of-security-configurations-in-phishing-we': 'CONTEXT phishing (security:phishing)',
  'unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie': 'OUT: tracking on piracy sites; malvertising and malware appear only in related work (read 2026-10-08)',
  'breaching-security-keys-without-root-fido2-deception-attacks-via-overlays-exploi': 'OUT: Android overlay attack',
  'the-big-brothers-new-playground-unmasking-the-illusion-of-privacy-in-web-metaver': 'OUT: metaverse privacy',
  'trust-me-if-you-can-how-usable-is-trusted-types-in-practice': 'CONTEXT third-party-risk: Trusted Types usability (security:headers)',
  'experimental-security-analysis-of-sensitive-data-access-by-browser-extensions': 'CONTEXT extension: extensions reading password fields',
  'make-agent-defeat-agent-automatic-detection-of-taint-style-vulnerabilities-in-ll': 'OUT: LLM-agent vulnerabilities',
  'scammagnifier-piercing-the-veil-of-fraudulent-shopping-website-campaigns': 'CONTEXT scams (security:online_scams)',
  'are-your-sites-truly-isolated-automatically-detecting-logic-bugs-in-site-isolation-implementations': 'OUT: browser site-isolation bugs',
  'ctrlaltdeceive-quantifying-user-exposure-to-online-scams': 'CONTEXT scams: users\' exposure to scam pages (security:online_scams)',
  'adflush-a-real-world-deployable-machine-learning-solution-for-effective-advertis': 'OUT: ML ad and tracker blocking (privacy:javascript, programming:filter_lists)',
  'the-poorest-man-in-babylon-a-longitudinal-study-of-cryptocurrency-investment-sca': 'CONTEXT scams',
  'loki-proactively-discovering-online-scams-by-mining-toxic-search-queries': 'CONTEXT scams',
  'fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by': 'CONTEXT phishing (SMS); names SocGholish once',
  'nokescam-understanding-and-rectifying-non-sense-keywords-spear-scam-in-search-en': 'CONTEXT scams via search',
  'more-and-scammier-ads-the-perils-of-youtubes-ad-privacy-settings': 'CONTEXT ads: predatory YouTube pre-roll ads (privacy:advertising)',
  'like-comment-get-scammed-characterizing-comment-scams-on-media-platforms': 'CONTEXT scams',
  'ctphishcapture-uncovering-credential-theft-based-phishing-scams-targeting-cryptocurrency-wallets': 'CONTEXT phishing (crypto wallets)',
  'exploration-of-the-dynamics-of-buy-and-sale-of-social-media-accounts': 'OUT: account markets',
  'give-and-take-an-end-to-end-investigation-of-giveaway-scam-conversion-rates': 'CONTEXT scams',
  'the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor': 'CONTEXT scams / impersonation',
  'c-frame-characterizing-and-measuring-in-the-wild-captcha-attacks': 'OUT: CAPTCHA farms',
};
// (2) mwc_screening_probe.mjs / report PASS J: INDEX-channel hits that never reached extraction. Each one read
//     from its title and abstract (no full text exists in the corpus). ON = would have been a candidate on
//     topic; the report prints them and throws if the set of non-extracted hits changes.
export const FUNNEL_NOTES = {
  'WWW/2010/alhambra-a-system-for-creating-enforcing-and-testing-browser-security-policies': 'off: browser policy system',
  'CCS/2012/you-are-what-you-include-large-scale-evaluation-of-remote-javascript-inclusions': 'ON: remote JavaScript inclusion on 3M pages (third-party-risk); selected, no PDF retrieved',
  'NDSS/2012/chrome-extensions-threat-analysis-and-countermeasures': 'off: extensions',
  'CCS/2014/poster-enhancing-security-and-privacy-with-google-glass': 'off',
  'NDSS/2014/breaking-and-fixing-origin-based-access-control-in-hybrid-web-mobile-application': 'off: hybrid-app access control',
  'CCS/2015/poster-page-table-manipulation-attack': 'off',
  'CCS/2018/ast-based-deep-learning-for-detecting-malicious-powershell': 'off: PowerShell',
  'CCS/2019/traceback-for-end-to-end-encrypted-messaging': 'off',
  'CCS/2019/poster-detecting-webassembly-based-cryptocurrency-mining': 'ON: Wasm cryptojacking detector (poster)',
  'USENIX/2019/robust-website-fingerprinting-through-the-cache-occupancy-channel': 'off',
  'WWW/2020/minethrottle-defending-against-wasm-in-browser-cryptojacking': 'ON: in-browser Wasm cryptojacking defence',
  'CCS/2021/secure-complaint-enabled-source-tracking-for-encrypted-messaging': 'off',
  'CCS/2022/poster-adversarial-perturbation-attacks-on-the-state-of-the-art-cryptojacking-de': 'off: IoT cryptojacking (out of scope by brief)',
  'CCS/2025/what-gets-measured-gets-managed-mitigating-supply-chain-attacks-with-a-link-inte': 'ON: LiMS link-integrity defence for third-party web resources, evaluated by simulated deployment on 450 domains (would be CONTEXT third-party-risk / defence-lab)',
  'CCS/2025/pixnapping-bringing-pixel-stealing-out-of-the-stone-age': 'off: Android pixel stealing',
  'CCS/2025/gasliteing-the-retrieval-exploring-vulnerabilities-in-dense-embedding-based-sear': 'off: retrieval poisoning',
  'WWW/2025/peripheral-instinct-how-external-devices-breach-browser-sandboxes': 'off',
  'WWW/2025/wasmguard-enhancing-web-security-through-robust-raw-binary-detection-of-webassem': 'ON: adversarially robust Wasm malware (incl. cryptojacker) detector on the WasmMal-15K dataset',
  'WWW/2025/beast-in-the-cage-a-fine-grained-and-object-oriented-permission-system-to-confin': 'ON-adjacent: permission system confining (possibly malicious) included scripts; defence',
  'IEEE-SP/2026/graphrag-under-fire': 'off',
  'USENIX/2026/confundo-learning-to-generate-robust-poison-for-practical-rag-systems': 'off',
  'USENIX/2026/shielding-qr-codes-unveiling-the-real-world-illicit-promotion-behind-adversarial': 'off: adversarial QR codes; selected, not extracted',
  'USENIX/2026/what-you-decode-depends-on-where-you-stand-distance-based-optical-qr-code': 'off',
};
</file>

===== Hand-coding files =====

The three coders' files, unedited: rows, a checked quote per field, a digest and FLAGS per paper.

<file markdown mwc_hand_A.md>
# MWC hand-coding, batch A

Rows: 14. Papers whose full text could not be read: none (all 14 paper.cols.txt files read; quotes checked against them).

Quote check: whitespace-collapsed, case-insensitive substring match. "verified verbatim" = one contiguous match. "PARTIAL" = the two-column layout splices the sentence (or a hyphenated line break), so only fragments match; every fragment shown was found.

```js
  ["CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections", ["honeyclient"], ["own-rule", "av"], "multi-config", "not-stated", "none", true, "not stated"],
  ["CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense", ["signature", "behavioural"], ["manual"], "single", "single", "none", true, "2018-03 to 2018-05"],
  ["IEEE-SP/2012/rozzle-de-cloaking-internet-malware", ["honeyclient", "static-ml"], ["honeyclient", "manual"], "multi-config", "not-stated", "measured", false, "not stated"],
  ["IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o", ["av", "graph"], ["av", "blocklist"], "single", "not-stated", "addressed", false, "2012-02 to 2012-08"],
  ["IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att", ["behavioural", "manual"], ["manual", "blocklist", "av"], "multi-config", "multi", "addressed", true, "not stated"],
  ["NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers", ["signature"], ["own-rule", "manual"], "repeated", "multi", "none", true, "2013-03 to 2013-08"],
  ["NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system", ["static-ml"], ["av", "manual"], "single", "not-stated", "none", false, "not stated"],
  ["USENIX/2011/deseo-combating-search-result-poisoning", ["static-ml", "signature", "manual"], ["manual", "vendor"], "passive", "passive", "addressed", true, "2010-05 to 2011-02"],
  ["USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths", ["network", "graph", "av"], ["av", "manual"], "passive", "passive", "none", true, "not stated"],
  ["USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks", ["static-ml", "behavioural"], ["blocklist", "av", "manual"], "single", "not-stated", "none", true, "2021-10 to 2022-10"],
  ["WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages", ["static-ml"], ["honeyclient", "manual"], "single", "not-stated", "addressed", false, "not stated"],
  ["WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions", ["behavioural", "av"], ["av", "manual"], "single", "not-stated", "addressed", false, "2014-03 to 2014-05"],
  ["WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications", ["static-ml"], ["manual", "vendor"], "passive", "passive", "none", true, "2015-01 to 2015-08"],
  ["WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild", ["behavioural"], ["blocklist", "manual"], "single", "not-stated", "none", true, "2018-02 to 2018-10"],
```

#### CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections

- detect = honeyclient. BLADE is run inside a VM and the testbed visits harvested malware URLs, logging drive-by installs. Quote: "Our testbed automatically harvests malware URLs from multiple whitehat mailing lists on a daily basis" (§4.1.A). [PARTIAL: column splice/hyphenation; words not matched as-is: automatically, mailing]
- gt = own-rule, av. outcomes from BLADE + own instrumentation (procmon/tcpdump); binaries then scanned at VirusTotal. Quote: "procmon [3] to monitor Windows system call events" (§4.1.A). [verified verbatim]
- gt (av) = av. VirusTotal scanning of pushed binaries. Quote: "The average detection rate of these binaries from virustotal.com was only 28.43%." (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- visits = multi-config. VM iterated over each URL for each software configuration. Quote: "against multiple software configurations covering different browser versions and common plug-ins" (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- vantage = not-stated. one VMware VM on a PC, no location/network named. Quote: "Our evaluation platform is a VMware virtual machine running on a lightly loaded PC" (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- cloak = none. IP tracking is named as one possible reason attacks fail but it is neither measured nor countered. Quote: "sites that employ IP tracking to blacklist repeated visitors" (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- blcmp = true. VirusTotal detection rate of the intercepted binaries is reported. Quote: "The average detection rate of these binaries from virustotal.com was only 28.43%." (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- window = not stated. only durations (3 / 6 months), no calendar dates. Quote: "The testbed has been operational for 3 months" (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- DIGEST: "BLADE was successful at blocking all 7,925 attempted drive-by malware installs while generating zero false alarms" (§4.1.A). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
  Blocklist/AV miss figure: "The average detection rate of these binaries from virustotal.com was only 28.43%." [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- FLAGS: Notes say abstract cites 1,934 active malicious URLs and body 3,992 visited; both appear, not reconciled. Notes' window 'not stated' confirmed. Cloak coded none (conservative): the paper says only about half of URLs still delivered attacks, partly because of IP tracking, but gives no measured split.

#### CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense

- detect = signature, behavioural. keyword matching for 13 mining services, Stratum in WebSocket traffic, CPU load. Quote: "We manually collected keywords for 13 well-known mining services" (§4.1.1). [verified verbatim]
- gt = manual. manual analysis of mining payloads / benign check of the 4 non-detected Wasm samples. Quote: "we also manually analysed part of the mining payloads of websites that we detected based on other signals" (§4.2.1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- visits = single. each page once, four seconds. Quote: "we only visit each webpage once" (§7). [verified verbatim]
- vantage = single. one unfiltered cluster network. Quote: "We deployed our web crawler in Docker containers running on Kubernetes in an unfiltered network" (§4.1.4). [verified verbatim]
- cloak = none. limitations (4 s dwell, ad-served payloads missed) are acknowledged as undercount but no countermeasure or measurement. Quote: "We only spend four seconds on each webpage" (§7). [verified verbatim]
- blcmp = true. Dr. Mine (CoinBlockerLists-based) found 272 of the 785 still-mining sites. Quote: "Dr. Mine could only find 272 websites, while MineSweeper found 785 websites" (§6). [verified verbatim]
- window = 2018-03 to 2018-05. main crawl 12-19 Mar 2018, second Wasm crawl early Apr 2018, blocklist comparison 9 May 2018. Quote: "Crawling period March 12, 2018 - March 19, 2018" (Table 1). [verified verbatim]
- DIGEST: "# of drive-by mining websites 1,735 (0.18%)" (Table 1 (denominator: # of crawled websites 991,513)). [verified verbatim]
  Blocklist/AV miss figure: "Dr. Mine could only find 272 websites, while MineSweeper found 785 websites that were still actively mining cryptocurrency." [verified verbatim]
- FLAGS: Window: I extended to 2018-05 because the 9 May blocklist re-check is part of the paper's own data; headline crawl alone is 2018-03. Notes' text/Table profit mismatch ($188,878.84 vs .85) not relevant to fields.

#### IEEE-SP/2012/rozzle-de-cloaking-internet-malware

- detect = honeyclient, static-ml. Nozzle runtime heap-spray detection in a high-interaction honeyclient plus Zozzle static classifier. Quote: "high-interaction client honeypot" (§V.A). [verified verbatim]
- gt = honeyclient, manual. labels are the detectors' verdicts, differences manually verified. Quote: "we manually verified a large fraction of the analysis results where we see a difference in the two runs" (§V.B). [verified verbatim]
- visits = multi-config. each URL analysed under base config and Rozzle config. Quote: "visited each file as a local URL using the high-interaction client honeypot twice" (§V.A). [verified verbatim]
- vantage = not-stated. no crawler location or network given for either experiment. Quote: (no quote) (absence). [no quote: value rests on absence of a statement in the text]
- cloak = measured. base vs Rozzle comparison quantifies hidden detections (595% more offline, 74 to 224 online). Quote: "Rozzle increases the detection rate for offline runtime detection by almost seven times" (Abstract). [verified verbatim]
- blcmp = false. blocklist/SafeBrowsing only a pre-filter for URL selection. Quote: "Each URL was checked against a list of hosts known to serve malicious content as well as using Google's SafeBrowsing API" (§V.B). [verified verbatim]
- window = not stated. no dates for own collection (only an external 2011 Sophos citation). Quote: (no quote) (absence). [no quote: value rests on absence of a statement in the text]
- DIGEST: "Rozzle increases the detection rate for offline runtime detection by almost seven times" (Abstract; denominator: 65,855 samples, Nozzle 1,662 base vs 11,559 Rozzle (§V.A)). [verified verbatim]
  Blocklist/AV miss figure: none reported.
- FLAGS: None substantive. The online run (57,132 blocklist/SafeBrowsing-prefiltered URLs) is the other headline; visits there are also base vs Rozzle.

#### IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o

- detect = av, graph. Forefront AV labels crawled content; graph/PageRank over hostname-IP clusters detects more. Quote: "we first use Microsoft Forefront, an Anti-Virus scanner, to scan the contents associated with individual URLs" (§II.C). [verified verbatim]
- gt = av, blocklist. AV labels; detections validated against Safebrowsing, content clustering, URL patterns. Quote: "including comparing against the Google Safebrowsing list" (§V.A). [verified verbatim]
- visits = single. 20 crawlers explore each doorway URL once; some TDSes seen again only incidentally. Quote: "to explore the URL redirection paths of these 5.5 million doorway URLs" (§II.B). [verified verbatim]
- vantage = not-stated. 20 VMs with distinct IPs, no locations or network types. Quote: "each hosted on a separate Linux virtual machine with a distinctive IP address" (§II.B). [verified verbatim]
- cloak = addressed. IE6 user agent and spoofed Referral field to avoid cloaking. Quote: "to avoid some malicious servers from cloaking to the requests with an empty Referral field" (§II.B). [verified verbatim]
- blcmp = false. SafeBrowsing used for validation/role hints; no miss rate. Quote: "We do not use Google Safebrowsing because a reported malicious URL may be hosted on a compromised site" (§II.C footnote 1). [verified verbatim]
- window = 2012-02 to 2012-08. Table I feed dates (3/2012-8/2012; Top sites 2/2012-8/2012). Quote: "during a 7-month period to collect data" (§II.A). [verified verbatim]
- DIGEST: "attached to 76.2% of the malicious paths across all the data sources" (§III.B (abstract: over 70% of ~4 million malicious paths)). [verified verbatim]
  Blocklist/AV miss figure: none reported.
- FLAGS: Notes quote a 'Table II' row garbled ('malicious paths? ...'); not used. Revisits: paper says 122 subsequent visits to TDSes seen again, incidental, so visits coded single.

#### IMC/2019/what-you-see-is-not-what-you-get-discovering-and-tracking-social-engineering-att

- detect = behavioural, manual. instrumented Chromium crawler clicking ads, landing-page screenshot clustering then manual cluster review. Quote: "(1) Visual inspection of one of the sample images in the cluster" (§4.3). [verified verbatim]
- gt = manual, blocklist, av. visual/source inspection plus GSB and VirusTotal. Quote: "Verification using external sources such as Google Safe Browsing and VirusTotal" (§4.3). [verified verbatim]
- visits = multi-config. crawl repeated with four user agents (milking each URL every 15 min is a second repeated component). Quote: "We repeated the crawling using four different user agents" (§3.2/§4.1). [verified verbatim]
- vantage = multi. institutional network plus residential laptops. Quote: "three separate machines (three common Linux-based laptops with Intel i5 processors) with residential Internet access" (§4.1). [verified verbatim]
- cloak = addressed. two ad networks differ by IP type; residential IPs and anti-anti-bot used, difference not quantified. Quote: "respond to ad requests from our institution's machines, Tor exit nodes, and Amazon AWS IP ranges differently" (§3.2). [PARTIAL: column splice/hyphenation; words not matched as-is: institution's, differently]
- blcmp = true. GSB detected 1.42% at milking time, 16.21% two months later. Quote: "Total 2042 1.42% 16.21%" (Table 4). [verified verbatim]
- window = not stated. only durations (14-day milking, 2 months). Quote: "a recent Chromium release (64.0.3282)" (§3.2 (browser version only; not used as window)). [verified verbatim]
- DIGEST: "Among the 70,541 publisher websites that we crawled, only 11,341 (16%) were observed to host SEACMA ads." (§5). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
  Blocklist/AV miss figure: "GSB detected only a small percentage (16.2% overall) of SE attack domains" [verified verbatim]
- FLAGS: Cloak: the paper observed different ad serving by IP space but gives no counts, so addressed rather than measured. Window not stated; Chromium 64 implies early 2018 but I did not infer. Notes' 'Table 4 GSB-init 1.42%' verified as the 'Total 2042 1.42% 16.21%' row.

#### NDSS/2014/cyberprobe-towards-internet-scale-active-detection-of-malicious-servers

- detect = signature. payload fingerprints (Snort/Suricata-style token sets) replayed against Internet hosts. Quote: "CyberProbe first performs a horizontal scan of the desired target ranges" (§IV.C (active scanning, not page visits)). [verified verbatim]
- gt = own-rule, manual. a server is malicious when it answers a fingerprint; false positives inspected by hand. Quote: "the bh2-adobe fingerprint" (§V.D (see FLAGS)). [verified verbatim]
- visits = repeated. scans over Mar-Aug 2013; later HTTP scans re-probe live hosts of scan 12. Quote: "scans 12-21 target the live hosts found by horizontal scan 12" (§V.C). [verified verbatim]
- vantage = multi. local scanner plus cloud VMs/VPS and dedicated hosts at institutions. Quote: "we also rent 4 large instances in a cloud hosting provider" (§V.B). [verified verbatim]
- cloak = none. limits are protocol/coverage, not cloaking. Quote: "One day after the Internet-wide scan only 19% of the 15,943 advertised supernodes were alive" (§V.E). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- blcmp = true. VirusTotal knows 50/194 found servers; URL Query 30/194. Quote: "The best coverage is achieved by VirusTotal, which knows 25.7% of the servers found by CyberProbe" (§V.D). [verified verbatim]
- window = 2013-03 to 2013-08. scan dates 2013-03-12 ... 2013-08-06 (Tables III/IV). Quote: "2013-08-05 80 2,459,631,240" (Table III). [verified verbatim]
- DIGEST: "The results show that the 22 scans identified 194 servers, of which 151 are unique." (§V.D (starting from 15 seeds)). [verified verbatim]
  Blocklist/AV miss figure: "The best coverage is achieved by VirusTotal, which knows 25.7% of the servers found by CyberProbe (50/194)" [verified verbatim]
- FLAGS: Active network probing, not web crawling; visits/vantage are scan-based, so 'repeated'/'multi' are the closest vocabulary values. gt coded own-rule+manual because no independent label exists beyond fingerprint response and manual FP check.

#### NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system

- detect = static-ml. CNN over grey-scale images of Wasm binaries. Quote: "Convolutional Neural Network (CNN)-based Wasm classifier" (§VI.C). [verified verbatim]
- gt = av, manual. VirusTotal Premium labels plus manual checks (decompiler view, workers). Quote: "the VirusTotal Premium API" (§VII.A). [verified verbatim]
- visits = single. Puppeteer visits each site once to collect Wasm. Quote: "Using the Puppeteer API, MINOS visited each website in the dataset" (§VII.C). [verified verbatim]
- vantage = not-stated. only the local machine spec is given. Quote: "a system running Ubuntu 18.04 with an Intel Core i7-9700K processor" (§VI). [verified verbatim]
- cloak = none. obfuscation test concerns classifier robustness, not site cloaking. Quote: "MINOS is able to detect the obfuscated binaries regardless of the level or degree of obfuscation" (§VII.E). [verified verbatim]
- blcmp = false. NoCoin is only compared qualitatively (all but two mining domains already listed); no miss count reported as such. Quote: "except for bimeq.com.vn and monero.cit.net, the remaining domains already reside in the NoCoin" (§VII.A). [verified verbatim]
- window = not stated. only the VirusShare package date (21 Apr 2020). Quote: "shared publicly on the 21st of April, 2020" (§VII.A (source date, not crawl date)). [verified verbatim]
- DIGEST: "detect and correctly classify 67 malicious webpages, and 608 benign webpages" (§VII.C (in-the-wild set: 682 websites, 613 benign, 69 malicious; accuracy 98.97%)). [verified verbatim]
  Blocklist/AV miss figure: none reported.
- FLAGS: blcmp borderline: the NoCoin remark implies only 2 domains missed by NoCoin but with no denominator; coded false (conservative).

#### USENIX/2011/deseo-combating-search-result-poisoning

- detect = static-ml, signature, manual. URL clustering and group analysis, then regex signatures; groups picked manually. Quote: "we manually go through these groups to pick out malicious ones" (§4.3). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- gt = manual, vendor. manual check of groups and matches; datasets are Bing crawls from Microsoft. Quote: "We manually verified all the matches and did not find false positives" (§6.3). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- visits = passive. URL sets sampled from Bing's own crawls, no per-site visits for the headline. Quote: "Each sampled set of URLs contains over a hundred billion URLs" (§5.1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- vantage = passive. observed from the search engine's data. Quote: "a sampled search query log from September 2010" (§5.1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- cloak = addressed. detection is URL-only, designed to work despite cloaking. Quote: "detects search-result poisoning attacks without crawling the contents of Web pages" (§1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- blcmp = true. none of the matching live URLs was blocked by Safe Browsing or IE. Quote: "none of them were blocked" (§6.3). [verified verbatim]
- window = 2010-05 to 2011-02. Bing sets Jun/Sep 2010 and Jan 2011, trend keywords 28 May 2010 - 3 Feb 2011, live search Feb 2011. Quote: "during the months of June 2010, September 2010, and January 2011" (§5.1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- DIGEST: "In total, we capture 957 unique compromised domains and 15,482 malicious URLs in our sampled datasets." (§5.2.3). [verified verbatim]
  Blocklist/AV miss figure: "We run all matching URLs through Firefox using the Google Safebrowsing API and Internet Explorer" [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- FLAGS: blcmp true on a zero count ('none of them were blocked'); the denominator is the matching live URLs, not stated in the sentence. Visits coded passive (Bing crawl data) though 100 pages per group were crawled for group analysis.

#### USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths

- detect = network, graph, av. passive HTTP traces, transaction-graph path tracing, malicious files labelled via VirusTotal AV rules. Quote: "we use deep packet inspection to perform on-the-fly TCP flow reconstruction" (§2.1). [verified verbatim]
- gt = av, manual. VirusTotal labelling rule; manual path analysis of 533 samples. Quote: "we performed extensive manual analysis of their download paths" (§2.3). [verified verbatim]
- visits = passive. no active visits. Quote: "purely passive way" (§2.3). [verified verbatim]
- vantage = passive. one large academic network. Quote: "a large academic network serving tens of thousands of users" (§2.1). [verified verbatim]
- cloak = none. sampling and Referer suppression are limitations of traceback, not cloaking of content. Quote: "the malicious downloads in our study represent only a sample" (§2.3). [verified verbatim]
- blcmp = true. less than 10% of domains ever on a public blacklist; GSB 4 of 34 drive-by downloads. Quote: "less than 10% of these domains ever appeared on a public blacklist" (§4.5). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- window = not stated. ten months, split 6+4, no calendar dates. Quote: "for a period of ten months" (§1). [verified verbatim]
- DIGEST: "we collected a total of 174,376 executable downloads" (§2.3 (5,536 labelled malicious; 1,064 malware downloads, 533 unique samples)). [verified verbatim]
  Blocklist/AV miss figure: "Overall, less than 10% of these domains ever appeared on a public blacklist" [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- FLAGS: Passive sensor sees only traffic not already blocked by blacklists, which the paper states; this biases miss rates upward.

#### USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks

- detect = static-ml, behavioural. random forest over action-history-graph features captured in an instrumented browser. Quote: "random forest" (§3). [verified verbatim]
- gt = blocklist, av, manual. screenshot clustering (manually reviewed) plus GSB and VirusTotal over redirect chains. Quote: "Categorical BlockList" (§4.2). [verified verbatim]
- visits = single. one crawl per site per data collection, no revisit design stated. Quote: "We deployed the crawlers in 20 docker containers" (§4.1). [verified verbatim]
- vantage = not-stated. docker containers, no locations/IP types given. Quote: "20 docker containers" (§4.1). [verified verbatim]
- cloak = none. cloaking by some low-tier networks is noted as a gap, not measured or countered. Quote: "due to cloaking" (§4.2). [verified verbatim]
- blcmp = true. Brave Shields (filter lists) missed 14.74% of the 1,479 SE navigations. Quote: "of which Brave Shields missed 14.74%" (§4.5.1). [verified verbatim]
- window = 2021-10 to 2022-10. training crawl Oct 2021-Jan 2022; test Mar 2022; robustness Oct 2022. Quote: "from October 2021 to January 2022" (§4.1). [verified verbatim]
- DIGEST: "we obtained 258,008 navigation events initiated by JS code" (§4.2 (1,479 resulting in SE attacks)). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
  Blocklist/AV miss figure: "we obtained 1,479 positive samples for the training dataset, of which Brave Shields missed 14.74%" [verified verbatim]
- FLAGS: detect is a judgement: the ground-truth set was found by clustering + GSB/VT labelling, the classifier is the paper's own detector. Cloak none (conservative) although cloaking is mentioned once.

#### WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages

- detect = static-ml. three classifiers over static HTML/JS/URL/host features, OR-combined. Quote: "Prophiler declares a page malicious when one or more of the individual classifiers declare a page as malicious" (§3.2). [PARTIAL: column splice/hyphenation; words not matched as-is: declares]
- gt = honeyclient, manual. Wepawet verdicts label the validation set; training positives manually confirmed. Quote: "We labeled each page with the result produced by Wepawet" (§5). [verified verbatim]
- visits = single. each crawled page analysed once. Quote: "analyze on average 320,000 pages/day" (§4). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- vantage = not-stated. one server, no location. Quote: "installed on a server running Ubuntu Linux" (§4). [verified verbatim]
- cloak = addressed. IE6 user agent and spoofed Referer to trigger fingerprinting malware. Quote: "we decided to set up our crawler's user-agent as MS Internet Explorer 6 on Windows XP" (§5 footnote 2). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- blcmp = false. AV miss figure is from earlier studies, not the paper's own set. Quote: "earlier studies report between 65% and 80% missed detections" (§2). [verified verbatim]
- window = not stated. 60-day and 15-day periods, no dates. Quote: "over a 60-day period" (§5). [verified verbatim]
- DIGEST: "running it over a 60-day period on a dataset containing 18,939,908 pages" (§5 (14.3% flagged; validation FP 10.4%, FN 0.54%)). [verified verbatim]
  Blocklist/AV miss figure: none reported.
- FLAGS: Notes quoted 'Table 5' for the comparison dataset; the paper's table numbering for FP/FN comparison could not be verified beyond the figures.

#### WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions

- detect = behavioural, av. Expector instruments extensions/pages and follows ad redirects; landing executables confirmed through VirusTotal. Quote: "VirusTotal" (§5.1). [verified verbatim]
- gt = av, manual. VirusTotal on downloaded executables; extensions manually inspected. Quote: "We manually installed each of these and inspected their source code" (§4.2). [verified verbatim]
- visits = single. extensions installed and Alexa top-1000 browsed once. Quote: "We ran our crawler during March 2014, and obtained 18,030 Chrome extensions." (§4.2 (passive HTTP/DNS in §6 is secondary)). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- vantage = not-stated. VMs on one server, no location. Quote: "across 60 Linux Debian 7 virtual machines" (§4.2). [verified verbatim]
- cloak = addressed. system clock rewound to trigger delayed ad injection. Quote: "setting the system clock before we install an extension" (§4.1). [verified verbatim]
- blcmp = false. only 'majority of landing pages' undetected, no number. Quote: "failed to detect the majority of ad landing pages" (§5.1). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- window = 2014-03 to 2014-05. extension crawl Mar 2014; HTTP and DNS traffic May 2014. Quote: "We ran our crawler during March 2014" (§4.2). [verified verbatim]
- DIGEST: "We ran our crawler during March 2014, and obtained 18,030 Chrome extensions." (§4.2 (292 ad-injecting; 56 in malvertising)). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
  Blocklist/AV miss figure: "failed to detect the majority of ad landing pages" [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- FLAGS: blcmp borderline: 'majority' is not a number, coded false. Window includes May 2014 passive traffic.

#### WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications

- detect = static-ml. k-means clustering of five feature groups per candidate script URL. Quote: "we manually inspected the content of each cluster" (§4.2). [verified verbatim]
- gt = manual, vendor. each case manually investigated; exposure measured with an AV vendor's telemetry. Quote: "Whenever one of the AV client visits a page that includes our web indicators of compromise" (§3.6). [verified verbatim]
- visits = passive. honeypot compromises and vendor telemetry; no crawling. Quote: "Over a period of four years, our honeypots collected over 133K unique URLs of remote components" (§4.1). [verified verbatim]
- vantage = passive. honeypot plus vendor client installations. Quote: "120 million client installations worldwide" (§3.6). [verified verbatim]
- cloak = none. inline-inclusion evasion is a limitation of the method only. Quote: "attackers could include their code inline rather than importing the indicator's URL" (§6). [PARTIAL: contiguous in no single run (two-column splice) but every fragment found]
- blcmp = true. only 5.3% of pages with an indicator detected by any AV engine; over 90% unknown to vendor. Quote: "only 5.3% of the webpages including an indicator were detected by at least for one antivirus products" (§4.4). [verified verbatim]
- window = 2015-01 to 2015-08. training Jan-Apr 2015, live test four months from mid-April; honeypots ran four years (undated). Quote: "data collected between January and April 2015" (§4.1). [verified verbatim]
- DIGEST: "we only found two false positive out of 303 analyzed URLs" (§4.3 (96 valid indicators, 22 invalid, 185 not-enough-data)). [verified verbatim]
  Blocklist/AV miss figure: "only 5.3% of the webpages including an indicator were detected by at least for one antivirus products" [verified verbatim]
- FLAGS: Window is conservative: the four-year honeypot span is undated so I coded only the dated training+test months.

#### WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild

- detect = behavioural. SVM over runtime features (workers, Wasm, WebSocket, event loads) from an instrumented Chromium. Quote: "instrumented Chromium browser" (§3.1). [verified verbatim]
- gt = blocklist, manual. training labels from CoinBlockerLists/NoCoin/minerBlock patterns; deployment results checked manually. Quote: "matching the blacklist patterns" (§3.1). [verified verbatim]
- visits = single. each site visited once in each scan (45 s); 9 lifetime crawls are a separate analysis. Quote: "the crawler stayed on the visited website for 45 seconds" (§3.3). [verified verbatim]
- vantage = not-stated. 40 VMs, location not given. Quote: "We deployed the Outguardcrawler on 40 virtual machines" (§3.3). [verified verbatim]
- cloak = none. no cloaking discussion for their count. Quote: "interacted with the page by programmatically scrolling to the bottom of the page" (§3.3 (user emulation only)). [verified verbatim]
- blcmp = true. Outguard found 40% more than MinerBlock and 41.5% more than AntiMiner; Table 4 overlap 3,776 and 3,684 of 6,302. Quote: "Outguardhad approximately 40% more coverage than MinerBlock and 41.5% more coverage than AntiMiner" (§4.2). [verified verbatim]
- window = 2018-02 to 2018-10. scans 12 Feb-15 Apr 2018 and 20-30 Oct 2018 (passive DNS 2016-2018 is a separate dataset). Quote: "the first scan took place from February 12 to April 15, 2018" (§4). [verified verbatim]
- DIGEST: "found 6,302 cryptojacking sites, of which 3,600 are new detections" (Abstract; Table 4: 5,128,117 URLs visited). [verified verbatim]
  Blocklist/AV miss figure: "Outguardhad approximately 40% more coverage than MinerBlock and 41.5% more coverage than AntiMiner" [verified verbatim]
- FLAGS: Cloak coded none though scrolling emulation is mentioned; it is user simulation, not a stated anti-cloaking measure. Quote 'blacklist patterns' used for gt: labels are from blocklist patterns not a feed.
</file>

<file markdown mwc_hand_B.md>
# Hand coding, batch B (malicious_web_content)

Rows: 13. All 13 papers were readable in full text (paper.cols.txt); the WWW 2021 WebAssembly paper has column-splice duplication, so its quotes were checked against paper.pdf via pypdf. Quotes were checked whitespace-collapsed and case-insensitive. Number spacing artifacts ("6, 468, 623") were normalised. Column-spliced quotes are marked (partial).

```js
["CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web", ["signature","static-ml"], ["blocklist","manual"], "repeated", "not-stated", "none", true, "2010-07 to 2011-04"],
["CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising", ["graph","static-ml","signature"], ["blocklist","av","vendor","manual"], "repeated", "multi", "measured", true, "2011-06 to 2011-10"],
["CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service", ["honeyclient","signature","graph","network"], ["vendor","blocklist","manual"], "passive", "passive", "addressed", true, "2012-03 to 2012-05"],
["CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti", ["static-ml","honeyclient"], ["honeyclient"], "not-stated", "not-stated", "none", false, "2012-07 to 2014-12"],
["IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i", ["signature","behavioural"], ["av","blocklist","vendor","manual"], "not-stated", "not-stated", "measured", true, "2012-04 to 2013-08"],
["IMC/2018/digging-into-browser-based-crypto-mining", ["signature","behavioural"], ["blocklist","manual","own-rule"], "single", "not-stated", "none", true, "2018-02 to 2018-07"],
["IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem", ["av"], ["av"], "multi-config", "multi", "measured", false, "not stated"],
["IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising", ["behavioural","graph","signature","manual"], ["blocklist","av","manual"], "multi-config", "not-stated", "addressed", true, "2019-09 to 2019-10"],
["USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware", ["honeyclient","manual"], ["honeyclient","manual"], "passive", "passive", "measured", false, "not stated"],
["USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks", ["network","graph","static-ml","manual"], ["manual","av"], "passive", "passive", "none", true, "not stated"],
["WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod", ["honeyclient"], ["honeyclient","manual"], "multi-config", "single", "addressed", true, "2008-01 to 2009-11"],
["WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics", ["graph","signature"], ["av","vendor"], "not-stated", "not-stated", "none", true, "2017-02 to 2017-09"],
["WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas", ["av","manual"], ["av","manual"], "single", "not-stated", "none", false, "2020-04 to 2020-09"],
```

#### CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web
- detect [signature, static-ml]: "We pass all search results to Google's Safe Browsing API, which indicates whether a URL is currently infected with malware by checking it against a blacklist." (§2.3). MFA sites by a Bayesian-network classifier (notes quote; "Bayesian Network" confirmed in text).
- gt [blocklist, manual]: Safe Browsing for malware; "we selected a statistically significant (95% confidence interval) random sample of 363 websites for manual inspection" (§2.3).
- visits repeated: "searching for the hot terms once every four hours" (§2.2). No page-visit crawler. Searches and tweets are collected repeatedly over 9 months, so I coded repeated, not single. Chosen over not-stated because the repetition is explicit.
- vantage not-stated: only search APIs are described.
- cloak none: the Safe Browsing top-level versus external-URL blind spot is an undercount, not cloaking. "our analysis provides an upper bound on malware success".
- blcmp true: "24% of the visits triggered from the results of trending terms are not blocked by the Safe Browsing API." (§4.1). Also the §3.1 false-negative rate "34% (7.6 results undetected" (partial).
- window: "between July 24, 2010 and April 24, 2011" (§2.2).

DIGEST: "MFA sites attract 39 million visits over nine months" (§4.1). Malware, with denominator: "trending terms expose around 49 000 victims per month to undetected malware" (§4.1). Population: "182 741 different domains appeared in the top 32" (§2.3). Blocklist miss: "24% of the visits triggered from the results of trending terms are not blocked by the Safe Browsing API" (§4.1, vs "over 99%" blocked for control terms).
FLAGS: Notes confirmed. The visit counts are modelled, not measured by a crawler. "Undetected malware" means URLs listed by Safe Browsing later than first seen. Visits=repeated is a judgement call.

#### CCS/2012/knowing-your-enemy-understanding-and-detecting-malicious-web-advertising
- detect [graph, static-ml, signature]: "We scan all the nodes on the identified ad paths using the Google Safe-Browsing API and Microsoft Forefront 2010" (§4.1). MadTracer: "generates a set of detection rules via building a full decision tree" (§5.1; the notes' "generate[s]" wording is paraphrased).
- gt [blocklist, av, vendor, manual]: "Over 95% of the detected malvertising cases have been confirmed so far" (Introduction, via Forefront collaboration or manual validation).
- visits repeated: "Our crawler visits each of the pages once every three days" (§3.1). The follow-up monitoring is multi-config (UA and cookie strategies, 3 locations), but the headline count comes from the main crawl.
- vantage multi: "12 Windows virtual machine (VM) instances on 12 different IP addresses from 3 subnets" (§3.1); monitoring "12 VMs at three different geo-locations" (§5.2).
- cloak measured: they compared configurations. §2.2 "did not send malicious contents to requests from certain IP ranges"; App. C "95 of them deliver attacks successfully to IE, and 57 do not display malicious contents when visited by Firefox" (partial; column splice).
- blcmp true: abstract "15 times as many as Google Safe Browsing and Microsoft Forefront did together"; §6.3 "Safe Browsing on average needs 10.5 more days".
- window: "from Jun 21st to Sep 30th, 2011" (§3.1); Testing-Oct is Oct 2011, so "2011-06 to 2011-10".

DIGEST: "By crawling just the top 90,000 Alexa home pages (among them 53,100 are publisher pages), we find that more than 1% of these well-maintained sites have been exploited" (§8). Also "MadTracer detects 617 infected publishers and 9,568 unique" (§6.1). Blocklist miss: "15 times as many as Google Safe Browsing and Microsoft Forefront did together" (abstract); "Forefront detects 89 infected publisher pages and Safe Browsing detects 199" of 286 identified (§4.1); "does miss 46 domain-paths" caught by those engines (§6.3).
FLAGS: The notes quote "Forefront detects 89 infected publisher pages ... " correctly. The notes' "generate[s]" quote is a bracketed paraphrase. "Over 95%" is in the Introduction.

#### CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service
- detect [honeyclient, signature, graph, network]: "Google uses a web browser to visit suspicious web sites" (§3.1); binaries run in the "GQ honeyfarm" (§3.2); crowd-sourced blacklist feed (abstract). Redirect-chain analysis gives the initial/intermediate/final URL graph. Passive DNS adds a network component.
- gt [vendor, blocklist, manual]: "manual analysis of cluster reports" (§3.4); VirusTotal reports used in classification (Acknowledgements).
- visits passive and vantage passive: the data are feeds plus passive DNS from "135 distinct network vantage points" (§4.4.1).
- cloak addressed: "Servers that use "cloaking" to prevent clients from receiving an exploit more than once" can inflate infection counts, so they report only domains, popularity and visits (§4.4.1). Not measured. Judgement call between addressed and none.
- blcmp true: "we note that only 22% of final domains appear in the list" (§4.4.5, partial); "A median malicious domain receives traffic for 17 hours before Google flags it" (§4.4.5, partial).
- window: Table 1 feeds "Google Driveby 4/2012 5/2012" and "BH/Phoenix Driveby 3/2012 5/2012"; DNS "from the course of March 1, 2012 until April 20, 2012". Coded "2012-03 to 2012-05".

DIGEST: "Blackhole accounting for 29% of all malicious URLs" (abstract); "we analyze 77,000 malicious URLs received from Google Safe Browsing" (abstract). Blocklist miss: only 22% of final domains appear in the Safe Browsing list (§4.4.5; the other 78% were found through initial and intermediate URLs).
FLAGS: "The use of crawlers to identify malicious URLs often suffers" is partial (column splice). Notes otherwise accurate.

#### CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti
- detect [static-ml, honeyclient]: classification "with SVM with the RBF-kernel"; labels "by high-interaction honeyclients" (§3).
- gt [honeyclient]: "the discrimination results of web pages identified by high-interaction honeyclients [1] as the labels of the content on web pages without manual inspections" (§3, quote spliced across columns; partial).
- visits not-stated, vantage not-stated: the only crawl statement is "redirections gathered by crawling web pages" (§3).
- cloak none. blcmp false: "not stated" in the paper. The comparison is against the Prophiler classifier, not a blocklist.
- window: Table 1 "Training data Jul. 2012 - Dec. 2012 ... Test data Jan. 2013 - Dec. 2014" (verified; layout broken across columns).

DIGEST: "the accuracy of our method was about 20% higher than that of the previous method" (abstract). Test denominator: "Malicious 1,033 Benign 2,578" (Table 1). No blocklist or AV miss rate.
FLAGS: Notes confirmed. "Accuracy 0.89 to 0.78" for Prophiler is verified (§4).

#### IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i
- detect [signature, behavioural]: JsRED diffs crawled JS-lib files against clean references, runs static and dynamic analysis in an instrumented browser, then clusters into signatures (§III, per notes). Not independently re-verified in this pass.
- gt [av, blocklist, vendor, manual]: "Microsoft Security Essentials [31], a leading malware detection service" (§II-B; "a leading malware detection service" verified); "confirmed through VirusTotal and manual analysis" (§IV-B); the Bad feed came from Microsoft.
- visits not-stated: the crawler "renders the web page the URL points to and executes all the dynamic content" over feeds, with no per-URL revisit statement. "this estimate is considered to be a lower bound because most hosts in question had not been visited by our crawler on a daily basis" (§V-B). Coded not-stated, conservatively.
- vantage not-stated: only "deployed it to 20 Virtual Machines (VMs)".
- cloak measured: "In total, 2,883 scripts (56.9%) have evasion techniques built in" (Table VI); "the network blacklisted our crawler and attempted to cloak" (§V-B, partial). The analyzer also uses "the useragent of the analyzer is set to IE-6" plus a Google referrer and cleared cookies (§III-C).
- blcmp true: "Microsoft Security Essentials only detected 207 JS files" against JsRED's 409 (§IV-B).
- window: Bad feed "between 2012/07/15 and 2012/08/30"; Unknown set "during 05/01/2013 and 08/30/2013"; P2P data "between April 1st, 2012 and February 28th, 2013". Overall "2012-04 to 2013-08".

DIGEST: "436,869 unique compromised files" in the Bad set (§II-B), from "1,558,690 doorway URLs". Detection coverage: "covering 68.07% of all the JS files within the Bad set" (§IV-B). Blocklist/AV miss: "JsRED outperformed Security Essentials by nearly 100%"; Security Essentials "only detected 207 JS files" versus 409 (§IV-B, Table III); on HTML Security Essentials found more files (1677 vs 264, per notes).
FLAGS: The notes' dates match. §III method wording is from the notes, not re-quoted.

#### IMC/2018/digging-into-browser-based-crypto-mining
- detect [signature, behavioural]: NoCoin list applied to landing-page HTML via zgrab (§3.1); Chrome monitoring of "Websocket interactions and WebAssembly (Wasm) code" (§3.2).
- gt [blocklist, manual, own-rule]: "Through manual miner code inspection" (§3.2); "verified through random inspections" (§3.2). The Wasm signatures are the paper's own rule set.
- visits single: "We visit every domain, prefixed with www., via TLS and download the first 256 kB of the domains' landing pages using zgrab" (§3.1). One visit per domain is implied, not stated.
- vantage not-stated (no "vantage" or "residential" wording in the text).
- cloak none: the Coinhive PoW-header alteration (§4.2) is anti-reuse, not evasion of detection.
- blcmp true: abstract "up to 82% of thereby identified mining websites are not detected by block lists" (the notes say "Conclusion"; the sentence is in the abstract). Table 2 "129 608 (82%)".
- window: "first two weeks of May 2018" (§3.2); short links "As of February 2018"; blockchain "three full months in 2018". Coded "2018-02 to 2018-07".

DIGEST: "the prevalence of browser mining is currently low at < 0.08% of the probed sites" (Introduction; denominator "137M .com/.net/.org and Alexa Top 1M domains"). Blocklist miss: "up to 82% of thereby identified mining websites are not detected by block lists" (abstract); Table 2 Alexa 608 of 737 Wasm hits (82%) missed by NoCoin.
FLAGS: The notes say the 82% sentence is in the Conclusion; it is in the abstract (and the 0.08% sentence is in the Introduction). "~116M" and "a lower bound on the blocks mined through Coinhive" are not found as literal strings (the actual wording is "confidently estimate a lower bound on the blocks mined through Coinhive", §4.2).

#### IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
- detect [av]: "we only report domains flagged as malicious by at least 4 of the 70" (§5.3; "at least 4 of the 70" verified).
- gt [av]: VirusTotal consensus is the label. No independent check.
- visits multi-config: §6.2 compares VPN vantage points. §5.3 is a single Spain crawl. "we only crawl the landing page of websites" (§3.1).
- vantage multi: "our physical vantage point located in Spain" plus commercial VPNs (§3, §6).
- cloak measured: "The number of third-party domains considered as malicious by VirusTotal varies per country: from 15 third-party domains when accessed from Russia to 19 when accessed from India." (§6.2).
- blcmp false: VirusTotal is the detector; no miss number.
- window not stated: no crawl dates in the text (only "throughout 2018" for Alexa, lists "on Jan. 29th, 2019", Alexa top-10K "10th of January 2019"). The notes also say the crawl date is not stated.

DIGEST: "There are 7 porn websites classified as a potentially malicious by VirusTotal." (§5.3); corpus "6,843 pornographic websites". Also "malicious and deceptive behaviors also extend to 16 third-party services embedded in 41 porn websites" (§5.3). No blocklist/AV miss figure.
FLAGS: Notes confirmed. The notes' §6.2 figures (15 to 19 domains; 13 always present) check out. The "29 to 42 websites" figure was not re-checked.

#### IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
- detect [behavioural, graph, signature, manual]: instrumented browser registers for and clicks WPNs; clustering plus a cluster-domain graph; "we leverage two well-known URL blacklisting services: Google Safe Browsing(GSB) [11] and Virus Total [12] (VT)" (§5.2); "we manually analyze all malicious and suspicious WPN clusters" (§5).
- gt [blocklist, av, manual]: same blacklists plus manual confirmation, "96.8%" of 1,388 URLs (§6.3.2).
- visits multi-config: desktop Docker/Chromium crawl and a real Nexus 5 ("Google Nexus 5"); "Every time we visit a URL, we wait 5 minutes" (§6.1.2).
- vantage not-stated: no location is stated.
- cloak addressed: "these malicious messages were much more likely to appear on real Android devices, rather than emulated environments (likely due to some form of emulator detection)" (§6.1.3, partial), so they moved to a real device. Not quantified as a difference; "3.5 times more" WPNs per Service Worker on mobile (§6.1.3) is a yield figure, not a cloaking measure.
- blcmp true: "On our initial scan, less than 1% of the URLs were detected as malicious by GSB or VT" (§6.3.2) and "1,388 (11.31%)" a month later.
- window: "September and October 2019" (§6.2).

DIGEST: "51% of all WPN ads we collected are malicious" (abstract) out of "5,143 WPN-based ads" (572 campaigns). From "21,541 push notification messages" (§6.2). Blocklist miss: "less than 1% of the URLs were detected as malicious by GSB or VT" initially; "1,388 (11.31%)" after one month (§6.3.2).
FLAGS: The notes quote "We were able to confirm ... 96.8%"; the string "96.8%" is present. I changed the cloak code from the notes' tone to addressed, because the mobile-versus-emulator observation is not a measurement.

#### USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
- detect [honeyclient, manual]: "We used the Wepawet honeyclient" as the Oracle (§4); evasions "manually analyzed" (§5.1).
- gt [honeyclient, manual]: "we manually analyzed all groups categorized as" evasions; "only five were not intended evasion attempts" (§5.1).
- visits passive, vantage passive: "we continuously submitted to Revolver all web pages that Wepawet examined" (§5.1); "the web pages processed by the Wepawet tool" (§4). No active crawl.
- cloak measured: evasion is the subject; 155 evasion groups and 4,147 evasive scripts (Table 2). The paper also states that IP cloaking is a limitation: "Revolver is not effective when server-side evasion" is used (§2).
- blcmp false: no blocklist or AV miss figure.
- window not stated: "Since September 2012" with no end date. The vocabulary has no open-ended form, so I coded not stated.

DIGEST: "Since September 2012, we collected 6,468,623 web pages out of which 265,692 were malicious" (§5.1; PDF spacing "6, 468, 623" normalised, whole sentence not literally matched). Also "4,147 evasive scripts" (Table 2) and "155 evasions" groups.
FLAGS: Notes confirmed. Window: start 2012-09 is stated; the end is not.

#### USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks
- detect [network, graph, static-ml, manual]: "we monitor all web traffic at the edge of a large network" with a trace-back of download paths (§4.1), manual cluster labelling (§4.4) and a Random Forest classifier (§6).
- gt [manual, av]: "10% of the download events" per cluster reviewed; "AV labels are mainly used for confirmation purposes" (§4.4).
- visits passive, vantage passive: "a large academic network serving tens of thousands users for a period of two months" (§4.1); "single academic network" (§7).
- cloak none: "ads help hide" the campaigns from researchers (§3.1) and the HTTPS blind spot are limitations, not measured evasion.
- blcmp true: "only 70% − 75% of all malicious executables were labeled by the AVs, even after "aging" and rescanning" (§5/6, partial; column splice). The notes say "detected"; the paper says "labeled".
- window not stated: only "two months" and a later "three months" for D2, no dates.

DIGEST: "a total of 35,638 executable downloads" reduced to "2,004" SE download attacks (§4); classifier "91% true positives and only 0.5% false positives" (Introduction). Blocklist/AV miss: "only 70% − 75% of all malicious executables were labeled by the AVs, even after "aging" and rescanning".
FLAGS: Notes say "detected by the AVs"; paper text reads "labeled by the AVs". Section for the 70-75% figure not pinned down.

#### WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod
- detect [honeyclient]: JSAND/Wepawet, anomaly-based emulation with HtmlUnit (§3.3).
- gt [honeyclient, manual]: "Capture-HPC, a high-interaction honeyclient" plus "We manually verified that these pages actually launched drive-by downloads" (§5.1).
- visits multi-config: "We visit each resource twice, each time configuring our browser with a different personality" (§3.1).
- vantage single: "The visits are originated from the same IP address." (§3.1).
- cloak addressed: two personalities, and "run from distinct subnets to avoid spurious results due to IP cloaking" (§5.1). "In four cases, JSAND was redirected to a benign page" is anecdotal.
- blcmp true: "ClamAV missed most of the attacks (80.6%)" (§5.1, Table 2) on 823 known-bad samples; "409 domains that at the moment of the analysis were not flagged as malicious by Google Safe Browsing" (§5.2).
- window: spam trap "From January to August 2008"; Wepawet-uncat "between October and November 2009". Coded "2008-01 to 2009-11".

DIGEST: "JSAND had two false negatives on the known-bad datasets" (§5.1, 0.2% of 823); operations: "37,547 samples" submitted in October 2009, of which "11,679 (31%) were flagged" (§5.2). Blocklist/AV miss: "ClamAV missed most of the attacks (80.6%)"; "409 domains ... not flagged as malicious by Google Safe Browsing" (§5.2).
FLAGS: Notes confirmed.

#### WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
- detect [graph, signature]: analytics-ID extraction by headless Chrome, then lookup via "PublicWWW and SpyOnWeb" (§3.1, §4.1) and campaign clustering.
- gt [av, vendor]: VirusTotal verdicts; Palo Alto Networks data for APKs.
- visits not-stated: "crawl 145K malicious URLs provided by VirusTotal on a daily basis for a period of two weeks" (daily sets of different URLs; no per-URL repeat statement).
- vantage not-stated.
- cloak none.
- blcmp true: "only 18.9% of the newly discovered websites are marked as malicious" (§4.1; the notes' phrasing; the text reads "we find that the vast majority of new websites have successfully avoided detection, i.e., only 18.9% of the newly discovered websites are marked as malicious", spliced across columns, partial).
- window: "collected from February till September 2017" (§3.2, APKs); VT crawl August to September 2017. Coded "2017-02 to 2017-09". Miramirkhani data from 2015 to 2016 is borrowed, so excluded.

DIGEST: "we were able to extract 9,395 analytics IDs associated with malicious content" (§4.1, two-week crawl of 145K daily URLs). Also "14,267 live websites" with "76.5% of which were new". Blocklist/AV miss: "only 18.9% of the newly discovered websites are marked as malicious" (§4.1).
FLAGS: The "Three daily sets ... August 2017" sentence is column-spliced; the key fragments were found. The notes' "10 million domains per day" is a capacity claim, not a measurement.

#### WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas
- detect [av, manual]: "VirusTotal reports four files to contain malicious content" of 352 web binaries (§4.5.1), then manual triage and revisits (§4.5.2).
- gt [av, manual]: the same VirusTotal reports and manual review; "tested positive by only one scanner" for the fourth.
- visits single: manual revisit of the four binaries' source sites; "visiting the corresponding website increases CPU load to 70%" (§4.5.2). No repeated or multi-config visits.
- vantage not-stated.
- cloak none: three of four miners "appeared to be inactive when visiting the website" (§4.5.2) is not evasion.
- blcmp false: VirusTotal is the detector; no miss number.
- window: "between April and September 2020" (§3, verified in pdf).

DIGEST: "Among the 352 analyzed binaries, VirusTotal reports four files to contain malicious content." (§4.5.1); "comprising only 1% of all binaries" (abstract). No blocklist/AV miss figure.
FLAGS: "up to 70 independent third-party antivirus scanners" and "While our analysis may miss cryptomining binaries" only found in garbled/partial form (pdf text mangles the column); marked partial. Notes otherwise confirmed.
</file>

<file markdown mwc_hand_C.md>
Rows: 13. Papers not readable in full text: none (all 13 paper.cols.txt files were read/searched). Quote status is machine-checked against the whitespace-collapsed, case-insensitive text; 'partial' marks quotes interrupted by two-column splicing.

```js
  ["CCS/2011/surf-detecting-and-measuring-search-poisoning", ["static-ml","graph"], ["manual"], "repeated", "not-stated", "measured", true, "2010-09 to 2011-04"],
  ["CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns", ["static-ml"], ["honeyclient","manual"], "repeated", "not-stated", "none", false, "2013-01 to 2013-05"],
  ["CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages", ["graph","static-ml"], ["av","manual"], "passive", "passive", "addressed", true, "2012-02 to 2012-03"],
  ["CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma", ["static-ml","graph"], ["av","blocklist","manual"], "single", "not-stated", "measured", true, "2015-02"],
  ["CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea", ["behavioural"], ["manual"], "single", "not-stated", "measured", true, "2018-04"],
  ["IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages", ["honeyclient","signature"], ["honeyclient","blocklist"], "not-stated", "not-stated", "measured", false, "2010-11 to 2011-11"],
  ["IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements", ["honeyclient","signature","av"], ["honeyclient","blocklist","av"], "repeated", "not-stated", "none", false, "not stated"],
  ["NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration", ["manual"], ["own-rule"], "not-stated", "not-stated", "none", false, "not stated"],
  ["USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web", ["behavioural"], ["own-rule"], "single", "not-stated", "none", false, "2018-05"],
  ["USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking", ["behavioural","signature","network"], ["own-rule","manual"], "single", "single", "measured", false, "2017-09 to 2019-05"],
  ["USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress", ["signature"], ["manual","av"], "passive", "passive", "none", false, "2012-07 to 2020-07"],
  ["WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads", ["honeyclient","signature","graph"], ["honeyclient","vendor"], "not-stated", "not-stated", "none", false, "not stated"],
  ["WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems", ["static-ml","manual","av"], ["manual","av"], "multi-config", "multi", "measured", true, "2019-06 to 2019-08"],
```

#### CCS/2011/surf-detecting-and-measuring-search-poisoning
- detect: static-ml, graph — (Abstract) "SURF runs as a browser component to extract a number of robust"
- detect: static-ml, graph — (§3.4) "Weka's J48 decision tree classifier"
- gt: manual — (§3.4) "we chose to semi-manually label part of our dataset"
- visits: repeated — (§2.2) "on a daily basis automatically query"
- vantage: not-stated — (§3.3) "We deployed our browser on 20 virtual machines"
- cloak: measured — (§2.2) "Cloaking techniques [12] are commonly used in search poisoning (by 97% landing pages in Sstudy)"
- blcmp: true — (§5.1) "have failed to detect 78.9% of malicious terminal pages"
- window: 2010-09 to 2011-04 — (Intro) "over a period of seven months (from September 2010 to April 2011)"
DIGEST: (§5.1) "have failed to detect 78.9% of malicious terminal pages involved in the search poisoning cases detected by SURF" ; (§2.2) "1,084 highly likely search poisoning cases"
FLAGS: Detection partly rests on the paper's own J48 classifier; the 'honeyclient' BLADE is only protection/exploit logging so not coded. 78.9% scanner miss is URLVoid ([3]). Notes fine.

#### CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns
- detect: static-ml — (Abstract) "uses a machine-learning algorithm to derive a model of web site changes"
- gt: honeyclient, manual — (§2.1.2) "relies on an external detection system"
- gt: honeyclient, manual — (§5.3.1) "Once we verified that the cluster was indeed malicious"
- visits: repeated — (§5) "recrawl delay of at least 15 minutes" [partial: column splice interrupts the sentence; all words found in order within the local span]
- vantage: not-stated — (§5) "a 10-node cluster of custom crawlers"
- cloak: none — (§6.3) "we could be fingerprinted"
- blcmp: false — (§5.3) "we identified a total of 67,038 different clusters" [partial: column splice interrupts the sentence; all words found in order within the local span]
- window: 2013-01 to 2013-05 — (§5) "We obtained our dataset by crawling the web from January 2013 to May 2013" [partial: column splice interrupts the sentence; all words found in order within the local span]
DIGEST: (§5) "our dataset spans a size of 700GiB and 26,459,103 distinct web site pairs from 12,464,920 unique URLs" [partial]
FLAGS: Cloaking is acknowledged only as a limitation for the (external) dynamic detector, not addressed or measured -> none. External detector identity (Wepawet) per notes; verify in §2.1.2 if it matters.

#### CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
- detect: graph, static-ml — (§3.3) "We developed a set of 28 features that describe the characteristics of a redirection graph"
- detect: graph, static-ml — (§3.3) "Support Vector Machines"
- gt: av, manual — (§4) "a verdict made by the AV tool running on the client" [partial: column splice interrupts the sentence, every 3-word fragment found]
- gt: av, manual — (§4.1) "we manually assessed the mali- ... ciousness of the URL"
- visits: passive — (§3.1) "This dataset contains redirection chain infor- ... mation from a large number of their global users"
- vantage: passive — (§4) "users that generated the dataset were located in 145 coun- ... tries"
- cloak: addressed — (Intro) "the effect of cloaking is mitigated, because of the diverse population of web surfers involved in the data collection"
- blcmp: true — (§4.4) "SpiderWeb detected 778 URLs as malicious that went undetected by the AV vendor"
- window: 2012-02 to 2012-03 — (§4) "from February ... 1, 2012 to March 31, 2012"
DIGEST: (§4.4) "Of the 3,549 redirection graphs built from S (using the four groupings), 562 graphs were flagged as malicious" ; (§4.4) "SpiderWeb detected 778 URLs as malicious that went undetected by the AV vendor"
FLAGS: Cloak coded 'addressed' (crowd diversity as design countermeasure, not measured). blcmp true: 778 of 3,368 flagged URLs missed by the AV vendor.

#### CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
- detect: static-ml, graph — (§3.2) "we utilized a Support Vector Machine (SVM) as the classifier"
- detect: static-ml, graph — (§3.1) "bucket usage similarity"
- gt: av, blocklist, manual — (§3.3) "a methodology that combines anti-virus (AV) scanning, blacklist checking, and manual analysis"
- visits: single — (§3.1) "we visited each website using a crawler (as a Firefox add-on) to record the HTTP traffic"
- vantage: not-stated — (§3.2) "In total, 20 such crawlers were deployed"
- cloak: measured — (§4.3) "Redirect cloaking 10 1220 10-15 days"
- blcmp: true — (§3.3) "the AV scanning and blacklist verification confirmed that 502 buckets were indeed bad"
- window: 2015-02 — (§3.1) "collected in February 2015"
DIGEST: (Abstract) "BarFinder identified 694 malicious or compromised repositories" ; (§3.3) "BarFinder reported a total of 730 Bars, about 10.6% of the 6,885 buckets"
FLAGS: Borderline calls: cloak 'measured' rests on Table 6 (life span of Bars by evasion technique, 10 Bars each) - quantifies evasion on own data but not its effect on counts; use 'none' if stricter. blcmp true is a stretch: 502 of the 730 reported Bars were confirmed by AV+blacklist, 192 more only by manual analysis, i.e. AV/blacklist caught ~502/694; no explicit 'missed' figure. Window is only the Common Crawl seed month; lifetime/PUP monitoring dates are not calendar-stated (Groupon compromises 2010-2015 are historic). visits 'single' for the 1M-site headline; lifetime tracking re-crawled every 5 days.

#### CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
- detect: behavioural — (§3.3) "if a webpage uses more than 10% of its execution time on hashing, our profiler reports it as a cryptocurrency miner"
- gt: manual — (§3.5) "showed that none of the identified webpages are false"
- visits: single — (§3.1) "we collected a total of 853,936 webpages as our dataset"
- vantage: not-stated — (§3.1) "we first crawl Alexa top 100K websites"
- cloak: measured — (§6.2) "26 of the 100 analyzed samples obfuscate their code" [partial: column splice interrupts the sentence; all words found in order within the local span]
- blcmp: true — (Abstract) "53.9% of these identified samples would have not been identified with current widely used detectors based on blacklists"
- window: 2018-04 — (Table 2) "CMTracker 868 Apr. 2018"
DIGEST: (Abstract) "2,770 unique cryptojacking samples from 853,936 popular web pages" [partial] ; (Abstract) "53.9% of these identified samples would have not been identified with current widely used detectors based on blacklists"
FLAGS: Window: the paper never states the crawl dates; 2018-04 is only the 'Report Date' of CMTracker in Table 2 (coded because it is the paper's own report date; 'not stated' is the stricter alternative). Notes' 'collected as of May 9th, 2018' (Table 5, revenue stats) could not be found in the text (searched 'May 9') -> unverified, and it is third-party analytics anyway. Notes' quote 'less than 51% malicious attacks are detected' not found verbatim; Table 8 NoCoin/MinerBlock overall hit rows are present. Cloak 'measured': AV drop 44%->28% with evasion (§6.2) and 70% throttle.

#### IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
- detect: honeyclient, signature — (§II-B) "the oracle consists of three components: Google's Safe Browsing blacklist [16], Wepawet [6], and a custom-built tool"
- gt: honeyclient, blocklist — (§IV-A) "The oracles that we use for evaluation are Wepawet, Google Safe Browsing, and a custom fake AV detector"
- visits: not-stated — (§III-C) "we visit a URL three times, providing different values for the User-Agent and Referer HTTP headers"
- vantage: not-stated — (§V) "Cybercriminals could still track our system's IPs: using a large, dynamic pool of IPs mitigates this problem"
- cloak: measured — (§IV-B) "Overall, 26.2% of the URLs tested were in fact cloaked" [partial: column splice interrupts the sentence, every 3-word fragment found]
- cloak: measured — (§IV-B) "248 were detected to be cloaking"
- blcmp: false — (§IV-A) "EVILSEED submitted 226,140 URLs to the oracles, of which 3,036 were found to be malicious"
- window: 2010-11 to 2011-11 — (§IV-E) "Starting from the 13th of November 2010, we collected a year's worth of domain registrations" [partial: column splice interrupts the sentence; all words found in order within the local span]
DIGEST: (§IV-A) "EVILSEED submitted 226,140 URLs to the oracles, of which 3,036 were found to be malicious" ; (§IV-B) "Out of the 110,894 URLs that we collected, 248 were detected to be cloaking" [partial]
FLAGS: Notes' 26.2% is confirmed (§IV-B: 'Overall, 26.2% of the URLs tested were in fact cloaked', SEO gadget; the 13.8% I first saw is another table row). The 25-day main run is undated; window is the span of dated sub-collections (domain regs from 2010-11-13; SEO Jan-Nov 2011 per notes). Safe Browsing is part of the oracle; the only mention of GSB coverage is 'about half have been blacklisted' for one SEO example, not a miss rate -> blcmp false. Visits: cloaking gadget is multi-config for its own subset, oracle visits unstated -> not-stated.

#### IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements
- detect: honeyclient, signature, av — (§3.2) "The lifeblood of our oracle constitutes by three main components: Wepawet [4], malware and phishing blacklists, and VirusTotal"
- gt: honeyclient, blocklist, av — (§3.2.2) "a collection of 49 antivirus, spam and phishing blacklists"
- visits: repeated — (§3.1) "our crawler visited each website once per day, and refreshed a web page five times"
- vantage: not-stated — (§3.1) "Mozilla Firefox"
- cloak: none — (§4.1) "which suggest the utilization of cloaking techniques"
- blcmp: false — (§4.1) "we identified 6,601 incidents in which the advertisements triggered our detection framework"
- window: not stated — (§3.1) "After a period of three months, we have created a corpus of 673,596 unique advertisements"
DIGEST: (§4.1) "we identified 6,601 incidents in which the advertisements triggered our detection framework" ; (§3.1) "673,596 unique advertisements"
FLAGS: Window: crawl 'three months' with no calendar dates anywhere (only the Yahoo incident, Dec 2013-Jan 2014, is cited from others) -> not stated. Cloak 'none': cloaking indicators are only listed as a report heuristic, not a countermeasure or measurement. Table 1 'Blacklists 4,794' is a count of incidents by oracle, not a miss rate.

#### NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
- detect: manual — (§V-A) "three static code analysis tools"
- gt: own-rule — (§V-B) "then the vulnerability is confirmed"
- visits: not-stated — (§VII) "laboratory setting"
- vantage: not-stated — (§VII) "laboratory setting"
- cloak: none — (§IV-A) "Cloaking Setup. Upon exploit attempt failure, exploit kits silently redirect the victim"
- blcmp: false — (Abstract) "found over 180 vulnerabilities among 16 exploit kits"
- window: not stated — (§IV) "over a two year period"
DIGEST: (Abstract) "found over 180 vulnerabilities among 16 exploit kits of those surveyed"
FLAGS: Does NOT belong in a population of papers that 'collect malicious content served to visitors in the wild and measure, detect, cluster or label it': it analyses leaked exploit-kit server source code (30 kits from whitehat mailing lists) with static analysers and attacks the kits in a lab; no victim-facing collection. 'manual' is the closest vocabulary value for detect (static analysis of obtained code, not learned/signature/honeyclient); 'own-rule' for gt (solver-confirmed exploits). The 'two year period' is a duration, not calendar dates -> window not stated.

#### USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
- detect: behavioural — (§3) "browser-based analysis framework"
- gt: own-rule — (§4.3.3) "learned from our training phase"
- visits: single — (§5.1) "We crawled data from the main pages of Alexa top 250K ... websites in May 2018"
- vantage: not-stated — (§4.1) "we run our analysis framework on a 64 core CPU Linux server"
- cloak: none — (§5.2.4) "we do not have enough data to learn the timeouts they use"
- blcmp: false — (§5.4.1) "only 40,278 ... (1.95%) out of the 2,065,977 third-party navigation URLs are ... identified as advertising URLs"
- window: 2018-05 — (§5.1) "in May 2018"
DIGEST: (Abstract) "detected 437 third-party scripts that intercepted user clicks on 613 websites" [partial] ; (§5.1) "valid data of 228,614 (91.45%) websites"
FLAGS: Notes' 'forged'/'manual spot check' elements are minor; gt is the paper's own heuristics (75% size, 25% overlap, 0.1 opacity thresholds). Ghostery used only to label ad URLs, not the malicious set.

#### USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
- detect: behavioural, signature, network — (§5.2) "a mining code signature is found, together with a siteKey, more than two WebWorkers and a WebSocket connection"
- detect: behavioural, signature, network — (§5.1) "NetFlow"
- gt: own-rule, manual — (§6) "We have manually analyzed the used siteKeys"
- visits: single — (§5.3) "1,769,183 websites have been successfully visited in this initial crawl"
- vantage: single — (§5.3) "in Docker containers on 60 servers within the university network"
- cloak: measured — (§6) "Hiding techniques"
- blcmp: false — (§7.2) "a simple solution like the NoCoin block list is unable to detect all miners" [partial: column splice interrupts the sentence; all words found in order within the local span]
- window: 2017-09 to 2019-05 — (§5.1) "from September 2017 until December 2018"
- window: 2017-09 to 2019-05 — (§6.3) "until May 5, 2019"
DIGEST: (§6) "We have identified 21,022 websites with traces of cryptomining activities of which 10,100 websites are actively mining" ; (§7.1) "0.011%"
FLAGS: Window spans NetFlow (2017-09..2018-12), campaign crawl (2018-12-24..2019-01-09), TLD crawl (2019-01-11..2019-04-03), follow-up (to 2019-05-05); headline crawl alone is 2018-12 to 2019-04. Cloak 'measured' is borderline: an 8-level hiding taxonomy and throttle values are counted on own data, but no detection-rate difference measured ('addressed'/'none' are stricter). Blocklist statement is a market-share contrast to prior work, not a miss number -> blcmp false. gt is the paper's own signature+behaviour rule, plus manual siteKey/campaign analysis; there is no external label.

#### USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
- detect: signature — (§3.2) "targeted inter-procedural backward slicing on the AST from each sink to the predefined sources" [partial: column splice interrupts the sentence; all words found in order within the local span]
- gt: manual, av — (§4.2) "our team manually verified the server-side code files in all 3,132 plugins" [partial: column splice interrupts the sentence; all words found in order within the local span]
- visits: passive — (§2) "nightly backups of over 400K unique WordPress websites"
- vantage: passive — (§2) "our collaboration with CodeGuard"
- cloak: none — (§8) "it cannot detect malicious behaviors within the obfuscated code"
- blcmp: false — (§4.2) "2 plugins were falsely labeled as downloaders"
- window: 2012-07 to 2020-07 — (§2) "collected from July 2012 to July 2020"
DIGEST: (Abstract) "YODA uncovered 47,337 malicious plugins on 24,931 unique websites"
FLAGS: 'signature' is the nearest value for YODA (predefined source-to-sink semantic models/rules + VT/URLHaus URL checks); it is not a learned classifier. gt 'av': plugin-detection set was half websites flagged by pattern-based AV (§4); malicious-behaviour labels are manual. 'none' for cloak: obfuscation/input-gating counts exist (§5.1) but concern attacker behaviour, not evasion of this study's detector; borderline. window: paper's 2012-07..2020-07 backup span (validation set Apr 2018-Feb 2021 extends beyond).

#### WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
- detect: honeyclient, signature, graph — (Abstract) "a set of regular expression-based signatures are then generated based on the URLs of each central server"
- gt: honeyclient, vendor — (§3.1) "isDriveBySucc"
- visits: not-stated — (§3.1) "a cluster of high-interaction client honeypots"
- vantage: not-stated — (§4.1) "large-scale production search engine"
- cloak: none — (§5) "attackers can generate a different binary for each time of an attack"
- blcmp: false — (§4.2) "the detection coverage has been boosted by 96%"
- window: not stated — (Fig. 7) "60 Days"
DIGEST: (§4.1) "We randomly selected a set of 3.5 billion HTTPTraces" ; (§4.1) "1,345,890 HTTPTraces"
FLAGS: Window not stated (only '60 Days' comparison length). Vantage/visits are a vendor's production honeyclient fleet, details unstated. Fast-flux handled by Hostname-IP Clusters is a design feature, not a cloaking countermeasure -> none. Comparison is against the vendor's own honeyclient detections (96% more), not a blocklist/AV miss rate.

#### WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
- detect: static-ml, manual, av — (§4.3) "a RF (Random Forest) classifier"
- detect: static-ml, manual, av — (§5) "tagged malicious by at least one VirusTotal vendor"
- gt: manual, av — (§4.2) "manually labeled by at least two researchers"
- gt: manual, av — (§5) "tagged malicious by at least one VirusTotal vendor"
- visits: multi-config — (§3.4) "we visited every URL six times from six dif- ... ferent IP addresses"
- vantage: multi — (§3.3) "university IP addresses"
- cloak: measured — (§6.1) "using multiple IP addresses leads us to find more than twice as many malicious pages"
- blcmp: true — (§6.3) "only labels 92 out of the 3,746 malicious pages on the same day we de- ... tect them. Even after 60 days, GSB finds 32% less malicious pages than"
- window: 2019-06 to 2019-08 — (Abstract) "June 19, 2019 - August 24, 2019"
DIGEST: (Abstract) "874,494 scrapes over two months" ; (§6.3) "only labels 92 out of the 3,746 malicious pages on the same day we de- ... tect them. Even after 60 days, GSB finds 32% less malicious pages than"
FLAGS: Notes' 'We observed 81% more malicious pages compared to using only the best performing crawl profile' is the multi-config headline. Notes quote 'novel cloaking techniques could decrease by half the number of malicious pages observed' is from the Abstract.
</file>

===== Reading-note quote check, unedited =====

<file text mwc_notes_quotecheck-output.txt>
notes/mwc_papers_A.md: 443 of 469 quotes located
notes/mwc_papers_B.md: 408 of 432 quotes located
notes/mwc_papers_C.md: 133 of 210 quotes located

ALL: 984 of 1111 quotes located (88.6%), 101 of them only as partial (>= 60% of five-word windows; column splices)

NOT LOCATED (127):
  CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections
    "please see www.blade-defender.org/eval-lab for updated statistics and results."
  CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
    "we also manually analysed part of the mining payloads of websites that we detected based on other signals."
  IEEE-SP/2012/rozzle-de-cloaking-internet-malware
    "the second run using Rozzle flagged 11,559 URLs (595% more detections)"
  NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
    "Accuracy 0.9897 Sensitivity 0.971 Specificity 0.9918 Precision 0.9307 F1 Score 0.9504."
  NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
    "we cannot compare M INOS against prior studies due to reproducibility issues... only three studies in the literature openly share their source code (CMTracker, OUTGUARD and MineSweeper), it is not pos"
  NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
    "CPU Usage (%) 52...Time (s) 24.8"
  NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system
    "RAM Usage (%) 6.5...CPU Usage (%) 4...Detection time (s) 0.0259"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    "During these 6 months, we collected a total of 174,376 executable downloads from domains that were not on our whitelist... we labeled 5,536 downloads as malicious... This resulted in 1,064 malware dow"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    ">40 antivirus (AV) engines, using virustotal.com,"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    "Exploit 99.19% correctly labeled, 0% incorrectly; Landing 96.58% correctly, 0.17% incorrectly; Injection 94.87% correctly, 0.07% incorrectly...we obtained a minimum of 94.87% detection rate at 0.07% f"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    "174,376 executable downloads"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    "phenomenon is declining/shifting"
  USENIX/2015/webwitness-investigating-categorizing-and-mitigating-malware-download-paths
    "currently the most common infection vector"
  USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks
    "A D G RAPH for Generic Ads 83.25% accuracy... A D G RAPH for SE-ads 81.51%... T RIDENT 95.07%"
  USENIX/2023/trident-towards-detecting-and-mitigating-web-based-social-engineering-attacks
    "First batch: FNR by Brave Shields 15.14% vs. T RIDENT 2.13%; Second batch: 12% vs. 1.49%."
  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
    "[27]: FP 13.70%, FN 14.69%"
  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
    "[17]: FP 14.83%, FN 8.79%"
  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
    "Union of [5,16,17,27]: FP 17.09%, FN 2.84%"
  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
    "Prophiler: FP 9.88%, FN 0.77%."
  WWW/2011/prophiler-a-fast-filter-for-the-large-scale-detection-of-malicious-web-pages
    "3.06 s/page + 0.237 s/page"
  WWW/2015/understanding-malvertising-through-ad-injecting-browser-extensions
    "Expector then browses a set of pages and activates a 'click' event on all ads"
  WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications
    "22 Invalid + 96 Valid + 185 Not-enough-data = 303"
  WWW/2016/automatic-extraction-of-indicators-of-compromise-for-web-applications
    "Invalid Indicator 22, Valid Indicator of Compromise 96, Not-enough-data 185"
  WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
    "SVM... TPR 96.2% (BD) / 97.9% (ID); FPR 0.2% (BD) / 1.1% (ID); AUC 97.8%/98.4%."
  WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
    "adnxs.com (33%), spotxchange.com (23.1%), and stickyads.com (14.5%)"
  WWW/2019/outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild
    "Outguard, an open-source cryptojacking detection system... Both code and data are available at https://github.com/teamnsrg/outguard"
  CCS/2012/manufacturing-compromise-the-emergence-of-exploit-as-a-service
    "a virtualized environment provided by the GQ honeyfarm [20]... using Windows XP Service Pack 3"
  CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti
    "Training data Jul. 2012 - Dec. 2012 ... Test data Jan. 2013 - Dec. 2014"
  CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti
    "Training data Jul. 2012 - Dec. 2012 Malicious 693 Benign 1,540; Test data Jan. 2013 - Dec. 2014 Malicious 1,033 Benign 2,578"
  CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti
    "Malicious 693, Benign 1,540"
  CCS/2015/poster-detecting-malicious-web-pages-based-on-structural-similarity-of-redirecti
    "Malicious 1,033, Benign 2,578"
  IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i
    "a Firefox extension... deployed to 20 Virtual Machines (VMs)"
  IMC/2018/digging-into-browser-based-crypto-mining
    "the Symantec RuleSpace engine"
  IMC/2018/digging-into-browser-based-crypto-mining
    "Alexa 993 [NoCoin hits], 129 [having Wasm miner]... 737 [Wasm hits]... 129 608 (82%) [missed by NoCoin]"
  IMC/2018/digging-into-browser-based-crypto-mining
    ".org 978, 450, 1372, 450 922 (67%)"
  IMC/2019/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
    "downloaded on Jan. 29th, 2019"
  IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
    "The data collection process..."
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "Since September 2012, we collected 6,468,623 web pages out of which 265,692 were malicious."
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "6,468,623 web pages out of which 265,692 were malicious. We analyzed 20,732,766 total benign scripts and 186,032 total malicious scripts. Out of these scripts, we obtained 705,472 unique benign ASTs a"
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "we identified 6,996 scripts where malicious JavaScript was injected, 101,039 scripts with data-dependencies, 4,147 evasive scripts, and 2,490 scripts as general evolutions... we group the pairs by the"
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "we collected 6,468,623 web pages out of which 265,692 were malicious"
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "we obtained 705,472 unique benign ASTs and 5,701 unique malicious ASTs"
  USENIX/2013/revolver-an-automated-approach-to-the-detection-of-evasive-web-based-malware
    "Revolver identified 6,996 scripts where malicious JavaScript was injected, 101,039 scripts with data-dependencies, 4,147 evasive scripts, and 2,490 scripts as general evolutions"
  USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks
    "136 clusters as social engineering... a total of of 2,004 SE download attacks"
  USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks
    "only 70%-75% of all malicious executables were detected by the AVs, even after 'aging' and rescanning the samples"
  USENIX/2016/towards-measuring-and-mitigating-social-engineering-software-download-attacks
    "2,004 SE download attacks"
  WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod
    "10,598 unique visitors... submitted 37,547 samples... 11,679 (31%) were flagged as malicious... attributed 4,951 samples to one of eleven well-known drive-by campaigns"
  WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
    "796,304 Android APKs... 477,829 of them have received a 'strong' malware verdict"
  WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
    "intercepting JavaScript alerts, simulate clicks, and extract analytics identifiers from both network traffic, as well as the page's HTML code and browser DOM"
  WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics
    "we can associate two different extension developers"
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 2.2), yielding "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 2.2); long-term study "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Abstract); features grouped as "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Table 1); classifier is "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 3.4). Also used "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 3.4). Sstudy was "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 2.2), yielding "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 2.2). Terminal-page survey: "
  CCS/2011/surf-detecting-and-measuring-search-poisoning
    " (Section 3.3); browser = "
  CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns
    " (Section 5, Dataset). Case study campaign "
  CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns
    " (Section 5, Dataset); seed included "
  CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns
    " (Section 2.1.2). Manual case-study confirmation: "
  CCS/2013/delta-automatic-identification-of-unknown-web-based-infection-campaigns
    " (Section 5.3.1). Also cites the "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " (Section 4). Labeled training data "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " using Weka (Section 3.3). Compared against re-implemented "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " (Section 4). Manual review: "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " for the ground-truth set Tr (Section 4.1). Later manual review: "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " without graph-specific features; "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " without client-specific features; "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " and of the 556 URLs the AV vendor flagged that SpiderWeb missed, "
  CCS/2013/shady-paths-leveraging-surfing-crowds-to-detect-malicious-web-pages
    " (Introduction). Stated limitations: "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    "2015/08/06, 2014/12/18, 2014/06/25, 2014/01/27, 2014/02/26, 2013/06/23, 2011/11/08, 2010/09/28"
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Abstract); unknown set "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Section 3.1); classifier "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Section 3.2). Validation used "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Section 3.3). Table 4 (five-fold CV, classifier comparison): "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Table 4). On Unknown set: "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Section 3.2); experiments run "
  CCS/2016/lurking-malice-in-the-cloud-understanding-and-detecting-cloud-repository-as-a-ma
    " (Section 3.3); lifetime tracking "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " for stack sampling (Sections 3.3). Followed by a keyword-based benign-miner filter ("
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " on the 200-page sample; described as "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " (Abstract). Blacklist test: "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " (Table 8, Section 6.1). AV comparison: "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " (Section 6.2, Table 10). Also compares to public reports: "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " (Section 6.2); payload hiding via injecting into "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    " such as jQuery.js (Section 6.2). Domain churn undercounts blacklists: "
  CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
    ", Section 8) and cites a prior report that Piratebay "
  IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
    "a total of 16,663,616 domains"
  IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
    " and flagging cloaking when "
  IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
    " versus crawler+prefilter "
  IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
    "the Domain Registrations Gadget identified malicious URLs on 10,435 domains using 1,002 domains as seeds"
  IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements
    " using Selenium/Firefox (Section 3.1). Final corpus: "
  IMC/2014/the-dark-alleys-of-madison-avenue-understanding-malicious-advertisements
    " (Section 3.2.2). VirusTotal: "
  NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
    "a survey of a wide range of 30 real-world exploit kits"
  NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
    " built on the symbolic-execution tool TAPS, and an open-source "
  NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
    " based on RIPS (Section V-A); exploit synthesis uses "
  NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
    " (Section V-B). EkHunter itself performs "
  NDSS/2015/ekhunter-a-counter-offensive-toolkit-for-exploit-kit-infiltration
    " (via structural URL/resource signatures and a honeyclient, WebWinnow), and "
  USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
    " to drive the custom Chromium build, waiting "
  USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
    " while navigation is suppressed to log without truly visiting (Section 4.1). Later, "
  USENIX/2019/all-your-clicks-belong-to-me-investigating-click-interception-on-the-web
    " (subdomain/SOA-email edge cases, Section 6); "
  USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
    " (Section 5.2). Active-mining rule: "
  USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
    " (Section 5.3); each website visited via "
  USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
    " (Section 6); notes throttling as evasion — "
  USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
    " in NetFlow terms (Section 6, "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 4); malicious activity "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " — server-side files only, "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 2). Deployed on "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Table 5, Section 5). Detected "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 4.1). Malicious-behavior detection — "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 5.1); nulled plugins instead use "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " and attackers could evade by "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    "website owners from our dataset alone spent a total of $7.3M"
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 5.1); documents behaviors emerging at different times — "
  USENIX/2022/mistrust-plugins-you-must-a-large-scale-study-of-malicious-plugins-in-wordpress
    " (Section 7, Case Study 1); and a "
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    " (Section 4.1, Table 3). Benign comparison set: "
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    " (10,811,805 traces, pruning) and "
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    "Hostname-IP Clusters (HIC)"
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    " (Section 4.1). Case-study verification of the "
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    " out of 10,733,282 (Section 4.2). Case-study "
  WWW/2011/arrow-generating-signatures-to-detect-drive-by-downloads
    "ARROW generated 2,592 regular expression signatures. After pruning ... ARROW produced 2,588 signatures"
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " to a wide range of malicious/illicit "
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " 300 targets/experiment), "
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " (Nexus 6P Android) (Section 3, Table 1); vantage IPs from "
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " (Section 6.1). Headline evasion figure: "
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " (Introduction); repository at "
  WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems
    " (Section 6.2) — and observes that mobile users "
</file>

===== Bibliography =====

The 22 entries this run appended to [[literature:bibliography]] (20, then 2 after the generic review), generated by ''bibgen.mjs'' from the venue index (USENIX author lists fetched from the landing pages by ''fetch_authors.py''):

<file bibtex bib_additions_malicious_web_content.bib>
@inproceedings{nelms2015_webwitness,
  author        = {Nelms, Terry and Perdisci, Roberto and Antonakakis, Manos and Ahamad, Mustaque},
  title         = {WebWitness: Investigating, Categorizing, and Mitigating Malware Download Paths},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2015},
  series        = {USENIX Security 2015},
  url           = {https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms},
}

@inproceedings{nelms2016_mitigating,
  author        = {Nelms, Terry and Perdisci, Roberto and Antonakakis, Manos and Ahamad, Mustaque},
  title         = {Towards Measuring and Mitigating Social Engineering Software Download Attacks},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2016},
  series        = {USENIX Security 2016},
  url           = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/nelms},
}

@inproceedings{lu2010_blade,
  author        = {Lu, Long and Yegneswaran, Vinod and Porras, Phillip A. and Lee, Wenke},
  title         = {BLADE: an attack-agnostic approach for preventing drive-by malware infections},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2010},
  series        = {CCS 2010},
  doi           = {10.1145/1866307.1866356},
}

@inproceedings{grier2012_manufacturing,
  author        = {Grier, Chris and Ballard, Lucas and Caballero, Juan and Chachra, Neha and Dietrich, Christian J. and Levchenko, Kirill and Mavrommatis, Panayiotis and McCoy, Damon and Nappa, Antonio and Pitsillidis, Andreas and Provos, Niels and Rafique, M. Zubair and Rajab, Moheeb Abu and Rossow, Christian and Thomas, Kurt and Paxson, Vern and Savage, Stefan and Voelker, Geoffrey M.},
  title         = {Manufacturing compromise: the emergence of exploit-as-a-service},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2012},
  series        = {CCS 2012},
  doi           = {10.1145/2382196.2382283},
}

@inproceedings{invernizzi2012_evilseed,
  author        = {Invernizzi, Luca and Comparetti, Paolo Milani and Benvenuti, Stefano and Kruegel, Christopher and Cova, Marco and Vigna, Giovanni},
  title         = {EvilSeed: A Guided Approach to Finding Malicious Web Pages},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2012},
  series        = {IEEE S&P 2012},
  doi           = {10.1109/sp.2012.33},
}

@inproceedings{kolbitsch2012_rozzle,
  author        = {Kolbitsch, Clemens and Livshits, Benjamin and Zorn, Benjamin G. and Seifert, Christian},
  title         = {Rozzle: De-cloaking Internet Malware},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2012},
  series        = {IEEE S&P 2012},
  doi           = {10.1109/sp.2012.48},
}

@inproceedings{li2013_finding,
  author        = {Li, Zhou and Alrwais, Sumayah A. and Xie, Yinglian and Yu, Fang and Wang, XiaoFeng},
  title         = {Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2013},
  series        = {IEEE S&P 2013},
  doi           = {10.1109/sp.2013.18},
}

@inproceedings{nappa2014_cyberprobe,
  author        = {Nappa, Antonio and Xu, Zhaoyan and Rafique, M. Zubair and Caballero, Juan and Gu, Guofei},
  title         = {CyberProbe: Towards Internet-Scale Active Detection of Malicious Servers},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2014},
  series        = {NDSS 2014},
  url           = {https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/cyberprobe-towards-internet-scale-active-detection-malicious-servers/},
}

@inproceedings{cova2010_detection,
  author        = {Cova, Marco and Krügel, Christopher and Vigna, Giovanni},
  title         = {Detection and analysis of drive-by-download attacks and malicious JavaScript code},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2010},
  series        = {TheWebConf 2010},
  doi           = {10.1145/1772690.1772720},
}

@inproceedings{liao2016_lurking,
  author        = {Liao, Xiaojing and Alrwais, Sumayah A. and Yuan, Kan and Xing, Luyi and Wang, XiaoFeng and Hao, Shuang and Beyah, Raheem A.},
  title         = {Lurking Malice in the Cloud: Understanding and Detecting Cloud Repository as a Malicious Service},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2016},
  series        = {CCS 2016},
  doi           = {10.1145/2976749.2978349},
}

@inproceedings{li2014_hunting,
  author        = {Li, Zhou and Alrwais, Sumayah A. and Wang, XiaoFeng and Alowaisheq, Eihal},
  title         = {Hunting the Red Fox Online: Understanding and Detection of Mass Redirect-Script Injections},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2014},
  series        = {IEEE S&P 2014},
  doi           = {10.1109/sp.2014.8},
}

@inproceedings{zhang2019_your,
  author        = {Zhang, Mingxue and Meng, Wei and Lee, Sangho and Lee, Byoungyoung and Xing, Xinyu},
  title         = {All Your Clicks Belong to Me: Investigating Click Interception on the Web},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2019},
  series        = {USENIX Security 2019},
  url           = {https://www.usenix.org/conference/usenixsecurity19/presentation/zhang},
}

@inproceedings{kasturi2022_mistrust,
  author        = {Kasturi, Ranjita Pai and Fuller, Jonathan and Sun, Yiting and Chabklo, Omar and Rodriguez, Andres and Park, Jeman and Saltaformaggio, Brendan},
  title         = {Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2022},
  series        = {USENIX Security 2022},
  url           = {https://www.usenix.org/conference/usenixsecurity22/presentation/kasturi},
}

@inproceedings{li2012_knowing,
  author        = {Li, Zhou and Zhang, Kehuan and Xie, Yinglian and Yu, Fang and Wang, XiaoFeng},
  title         = {Knowing your enemy: understanding and detecting malicious web advertising},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2012},
  series        = {CCS 2012},
  doi           = {10.1145/2382196.2382267},
}

@inproceedings{hong2018_shot,
  author        = {Hong, Geng and Yang, Zhemin and Yang, Sen and Zhang, Lei and Nan, Yuhong and Zhang, Zhibo and Yang, Min and Zhang, Yuan and Qian, Zhiyun and Duan, Hai-Xin},
  title         = {How You Get Shot in the Back: A Systematical Study about Cryptojacking in the Real World},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2018},
  series        = {CCS 2018},
  doi           = {10.1145/3243734.3243840},
}

@inproceedings{naseem2021_minos,
  author        = {Naseem, Faraz and Aris, Ahmet and Babun, Leonardo and Tekiner, Ege and Uluagac, A. Selcuk},
  title         = {MINOS: A Lightweight Real-Time Cryptojacking Detection System},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2021},
  series        = {NDSS 2021},
  url           = {https://www.ndss-symposium.org/ndss-paper/minos-a-lightweight-real-time-cryptojacking-detection-system/},
}

@inproceedings{kharraz2019_outguard,
  author        = {Kharraz, Amin and Ma, Zane and Murley, Paul and Lever, Charles and Mason, Joshua and Miller, Andrew and Borisov, Nikita and Antonakakis, Manos and Bailey, Michael D.},
  title         = {Outguard: Detecting In-Browser Covert Cryptocurrency Mining in the Wild},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2019},
  series        = {TheWebConf 2019},
  doi           = {10.1145/3308558.3313665},
}

@inproceedings{hilbig2021_real,
  author        = {Hilbig, Aaron and Lehmann, Daniel and Pradel, Michael},
  title         = {An Empirical Study of Real-World WebAssembly Binaries: Security, Languages, Use Cases},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2021},
  series        = {TheWebConf 2021},
  doi           = {10.1145/3442381.3450138},
}

@inproceedings{lu2011_surf,
  author        = {Lu, Long and Perdisci, Roberto and Lee, Wenke},
  title         = {SURF: detecting and measuring search poisoning},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2011},
  series        = {CCS 2011},
  doi           = {10.1145/2046707.2046762},
}

@inproceedings{lim2023_longitudinal,
  author        = {Lim, Kyungchan and Kwon, Yonghwi and Kim, Doowon},
  title         = {A Longitudinal Study of Vulnerable Client-side Resources and Web Developers' Updating Behaviors},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2023},
  series        = {IMC 2023},
  doi           = {10.1145/3618257.3624804},
}

@inproceedings{stringhini2013_shady,
  author        = {Stringhini, Gianluca and Kruegel, Christopher and Vigna, Giovanni},
  title         = {Shady paths: leveraging surfing crowds to detect malicious web pages},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2013},
  series        = {CCS 2013},
  doi           = {10.1145/2508859.2516682},
}

@inproceedings{borgolte2013_delta,
  author        = {Borgolte, Kevin and Kruegel, Christopher and Vigna, Giovanni},
  title         = {Delta: automatic identification of unknown web-based infection campaigns},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2013},
  series        = {CCS 2013},
  doi           = {10.1145/2508859.2516725},
}
</file>