Working log behind How many sites. Every query with its denominator, the report script and its unedited output, the two full-text probes and the bugs found in them, the hand classification of every probe hit, the quotes checked, the external sources verified and rejected, and what could not be established.

Corpus-level caveats — the venue scope, the selection funnel, the provisional 2025–2026 years — are on Corpus and are not restated here. Citation keys are shared with the content page and the single Bibliography; this page adds no bibliography entries of its own and carries no discussion block, following the convention set by hypothesis_testing that comments belong on the content page.

Voice here is a working log, not prose. It is for someone checking a number.

Two neighbours could have absorbed this material and both were read in full before the decision.

• Sampling (52 KB) already has a section titled How Big, and Why That Number and a Sample sizes are round numbers subsection. Broadening it was the serious alternative and was rejected on three grounds: (1) its subject is the draw — frame, method, unit, versioning — and n is orthogonal to all four, so the section sits there as a guest; (2) it is already one of the longest pages on the wiki and the material below adds roughly 45 KB; (3) the rank-tail, design-effect and rare-event arguments are statistical rather than design arguments and belong in the statistics: namespace next to Hypothesis testing, whose central error — non-independence — has a direct sizing consequence that neither page previously stated.
• Hypothesis testing owns non-independence and its effect on a p-value. It does not own, and should not own, the question of what n to pick before any test exists. Section C of the new page is explicitly the sizing corollary of that page's simulation and links to it rather than restating it.

Consequence, and the drift risk it creates. design:sampling's How Big section stays where it is; it was not carved out. That is deliberate — removing it would leave literal numbers stranded in the parts of that page that were not moved — but it means two pages now carry size figures. They are numerically different on purpose and each says so:

Both were re-derived on 2026-09-02 against the current run1, and design:sampling's published figures were confirmed unchanged, so the divergence is definitional and not drift. A tip box on the new page states this so a reader who meets both does not conclude one is stale.

Every figure on the content page traces to one of these. Nothing on the page uses “of 5,859 papers”.

The web-unit definition is copied from scripts/report_sampling.mjs on purpose, so the two pages' populations nest rather than cross. The narrowing from 1,153 to 1,121 discards 32 papers (2.8%) that name a web population and never give its size; they are this page's population residue and are counted in section 11 of the report output.

Paper-level, largest population. A paper that draws a 1,000,000-site crawl and a 300-site hand-check contributes 1,000,000. That is the number that reaches the abstract, and it is the number this page is about. The tuple-level view is Sampling's.

Two figures on the page come from outside this report script and are flagged where they appear. Both come from scripts/report_sampling.mjs, re-run on 2026-09-02.

• The 2,379 / 6,755 / 43.5% comparison row above. Re-run and compared against the published design:sampling figures: identical.
• The rank-stratified sampling shares in the currency table. Re-run: 1.0% (2010–2013), 4.8% (2014–2017), 5.0% (2018–2021), 8.9% (2022–2024), 6.3% (2025–2026, provisional), and 6.0% over the whole 1,153-paper web-sampling population (69 papers). That population is report_sampling.mjs's, which is web-unit papers without the stated-size requirement, so it is 1,153 rather than this page's 1,121 — the currency table now says so in a footnote rather than leaving “the whole population” ambiguous between the two. A first draft of the currency table wrote this as “6–9% since 2018”, which is wrong at the low end — 2018–2021 is 5.0%, not 6%. It was caught by the figures reviewer re-running the script rather than trusting the prose, and it is recorded here because the same draft also claimed the figure had been “diffed with no change”, which was itself untrue. The lesson is the general one: a figure copied from a neighbouring page into a summary range is not a figure this page's script can check, and every such figure needs its own re-run.

Both probes read data/fulltext/<year>/<venue>/<slug>/paper.cols.txt — the repaired column reading order — never paper.norm.txt. Both collapse whitespace before matching, because a PDF line break inside a phrase silently loses the match.

This is the part worth reading, because both bugs made a published count too low and both survived inspection.

1. The sentence splitter cut at decimal points. The splitter treats the full stop in 0.4% as a sentence end. Murley et al.'s “We find them in use on only 0.4% of the top thousand and 0.05% of websites in the top million” — a textbook per-band result — was split into fragments none of which contained both bands. Fixed by masking digit-dot-digit, plus a short abbreviation list, with a placeholder byte before splitting and restoring it before printing. Effect: the sizing probe went from 24 hits to 26, and the rank-band probe from 15 to 20.
2. The rank-band pattern required a digit after “top”. It matched top 1K but not top thousand, top million or larger Top Alexa lists. Widened to include spelled-out magnitudes. Effect: the rank-band probe went from 20 hits to 28, and the per-band count from 10 to 19.

The published counts are therefore floors. A third under-count is known and not fixed: a sentence spliced across two columns can lose the join, which is how the sizing probe misses Liao et al.'s Chernoff calculation entirely — that paper was found through the structured statistics.kind = power-analysis field instead. The page reports 6 derived sizes from the probe and names Liao as a seventh found by another route.

One sentence containing all three of: sizing language, a web unit, and a number.

sizing language: sample size(s|d) | statistical power | power analysis/analyses |
                 powered to detect | margin of error | chernoff | hoeffding |
                 confidence interval | diminishing returns | law of large numbers
web unit:        web site(s) | site(s) | domain(s) | web page(s) | page(s) | url(s) | host(s)
number:          three or more digits with optional commas, or a decimal
                 followed by k / K / thousand / million / m / M

26 papers matched. All 26 matching sentences were read one by one and given one of four verdicts. The verdict is on the sentence the probe matched, not on the paper: a paper filed not-sizing may have sized its population carefully somewhere the probe cannot see. The verdicts are which live in a literal table inside the script so the script prints the judgement rather than hiding it. The script fails loudly with !! unread if a hit has no verdict, which is how the three new hits after the decimal-point fix were caught.

Every hit, its verdict and its full sentence are in the –sizing output reproduced below.

One sentence containing a rank band, a phrase comparing across rank, and a percentage. 28 papers matched; all 28 were read and classified per-band (19) or not-rank (9). The nine rejected are: a long tail of vulnerable applications, of WHOIS service names, of FQDNs, of third-party domains to fix, and of URL popularity; popularity bands of browser extensions rather than websites; a figure legend whose comparison is not in the sentence; a figure fragment about the top-100 most informative features; and Ruth et al.'s measurement of list accuracy by rank bucket, which is a result about the list rather than a phenomenon measured per band.

The content page tables 12 of the 19, in 13 rows (Al Roomi and Li appear twice, in both directions), plus one paper the probe misses: [1Korczyński, Maciej; Król, Michal; van Eeten, Michel (2016): "Zone Poisoning: The How and Where of Non-Secure DNS Dynamic Updates", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], whose comparison is between a ranking and a random sample of the whole zone rather than between two depths of one ranking. It is included because a genuinely flat result is the hardest of the three families to find, and it was surfaced by the rare-event query in section 10 instead.

The seven per-band papers not tabled, all in section 9 of the report output with their sentences:

The page's rare-event table is a selection, not an aggregate, and the selection rule is written down here. From section 10 of the report output — prevalence strings naming a web unit, containing a percentage below 0.5%, in papers with n at or above 200,000 — keep rows where (a) the phenomenon is a property of a site or domain rather than of a classifier, (b) the paper's own n is stated, and © the source sentence checks out verbatim. Twenty-one tuples across 21 papers matched the mechanical filter; five were kept.

Rejected from the same 21 for failing (a): HPKP validity, CAA tag misconfiguration, DKIM l= tags, QUIC ECN validation, and several false-positive-rate rows. All 21 are printed by the report script under –rare.

The analysed-n column is a correction, and the largest single defect this run produced. The first draft of the table used population[].n from the structured extraction as “the n the paper needed”, which is the drawn n. The citations reviewer read the papers and found three wrong:

None of these changes a rate or an expected-hit count, because the rates are the papers' own. All three change what n the reader is told the rate rests on, on a page whose central instruction is to report the analysed n and not the drawn one. population[].n is the drawn size and cannot be assumed to be the analysed size; the six new quote-check entries added afterwards pin each analysed figure to a sentence.

scripts/hms_quotecheck.py checks every quotation the content page prints against the corpus text the extractor read. Exact match after whitespace collapse and quote/dash normalisation; on failure the phrase is re-tried as overlapping five-word windows and the share found is printed, so a two-column splice shows as PARTIAL rather than as an absence.

42 entries, 41 distinct, 0 not located at all, 2 PARTIAL, and 0 page quotations uncovered by the audit. Both partials are two-column splices and are handled on the page rather than hidden:

Two coverage gaps in this script were found by the citations reviewer and are fixed. First, the two footnoted quotes from [6Moore, Tyler; Leontiadis, Nektarios; Christin, Nicolas (2011): "Fashion Crimes: Trending-Term Exploitation on the Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] and [7Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)] were not in the check list at all, so “every quotation the page prints” was not true when it was first written; both are now in it. Second, the normaliser collapsed whitespace but did not rejoin a word broken across a line by a hyphen. A de-hyphenating second pass was added, reported separately as EXACT-DH so it can never silently paper over a real absence.

Two honest qualifications on that second fix, both raised by the figures reviewer on a re-check. Chang et al.'s “ran-domized sample” was the example that motivated it, and the de-hyphenation pass does not rescue that quote: the real damage there is a two-column splice with an unrelated clause sitting between ran- and domized, which no adjacent-word rejoin can bridge. The page quotes the intact run starting after the hyphen instead. And no quote in the current list exercises the pass at all — the output contains zero EXACT-DH lines. It is a defence against a failure mode that has not yet occurred here, kept because it is cheap and because the failure mode is real in this corpus; it is not evidence that anything was fixed.

Third, and structurally the important one: curating the list by hand failed three times in a row, so it is no longer curated on trust. The script now audits itself against the content page: it extracts every //"..."// span from pages/statistics_how_many_sites.txt, requires each to be covered by a QUOTES entry, prints any that are not, and exits non-zero. That guard caught two further quotes while this page was being written — the McDonald “500 random combinations” quote the citations reviewer found, and a PhishFarm quote added minutes earlier. The provenance page's own page-quote spans are not audited, because most of them quote this page's superseded drafts rather than any paper.

A fourth splice, Chang et al.'s “domized sample of 2,000 websites (margin of error = 2.”, is quoted with its damage visible rather than repaired: the leading ran and the trailing digits are in the other column, and inventing them would have been a fabrication.

A third splice, Singanamalla et al.'s HTTPS long-tail sentence, was caught before it was quoted: the naive reconstruction reads “valid https use ment index scores”, which is nonsense. The page quotes the two intact fragments and paraphrases the join, and the check file records both fragments separately with a comment explaining why.

Four quotes were additionally chased by hand during drafting, because the extraction record and the page disagreed about what the number meant:

• [3Bijmans, Hugo L.J.; Booij, Tim M.; Doerr, Christian (2019): "Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale", in: Proceedings of the USENIX Security Symposium. (Link)] — the extraction gave “0.011% of all domains, or one in 9,090 websites”. The corpus text says “meaning that one in every 9,090 websites is cryptojacking”, and the page uses the source wording. Reading the surrounding paragraph also produced the head/tail comparison used in the page's rank-tail discussion — 0.065% in the Alexa top 1M against 0.011% in a random 49M-domain sample, “almost 6 times lower” — which no probe had surfaced.
• [4Sy, Erik; Burkert, Christian; Federrath, Hannes; Fischer, Mathias (2019): "A QUIC Look at Web Tracking", Proceedings on Privacy Enhancing Technologies 2019(3):255-266. (DOI)] — the extraction gave “186 websites … 0.02% in the Top 1M”. Reading the source found the full six-row table the content page now leads with, and a second figure (0.0186%) the paper gives to three decimals elsewhere. Both are quoted.
• [1Korczyński, Maciej; Król, Michal; van Eeten, Michel (2016): "Zone Poisoning: The How and Where of Non-Secure DNS Dynamic Updates", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — checked because a “flat across rank” result is the one this page most wants to be true. It is in the abstract, verbatim.
• [8Liao, Xiaojing; Liu, Chang; McCoy, Damon; Shi, Elaine; Hao, Shuang; Beyah, Raheem A. (2016): "Characterizing Long-tail SEO Spam on Cloud Web Hosting Services", in: Proceedings of the ACM Web Conference. (DOI)] — checked because the sizing probe had missed it. Present, spliced.

Three references on the content page are outside the seven-venue corpus. Two are the external methodological citations below, both fetched on 2026-09-02 rather than recalled. The third is [9Tang, Jenny; Bauer, Lujo; Christin, Nicolas (2025): "Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers", in: Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS), pp. 475-493. USENIX Association. (Link)], which is SOUPS 2025 — a venue this corpus does not cover, and the one venue whose absence matters most for a page about statistical practice; it is cited from Hypothesis testing, which introduced the key.

Rejected. No industry or vendor source was used and none was sought. Sample-size choice is a methodological question with no vendor stake, and the one category of external material that would have been tempting — “how many sites should I crawl” blog posts and SEO tooling pages — is exactly the listicle failure mode the site's conventions warn about. No general statistics textbook is cited either, under the no-textbook rule: the three formulas the page uses are written out in the report script where they can be checked, and the two external citations above are each the primary source for one specific named rule rather than background reading.

Not established, and therefore not written: which software this field uses for a power calculation. Six papers is too few to say, and none of them names a tool.

Ten, appended before the closing </bibtex> tag of Bibliography after a key and DOI and URL collision scan against a fresh export of the live page, not against a local copy. The scan caught seven would-be duplicates that a key-string check alone would have missed or mis-keyed:

Added: sy2019_quic, korczynski2016_zone, ashiq2023_report, liao2016_characterizing, bhuiyan2025_digital, ikram2019_chain, singanamalla2020_accept, moore2011_fashion, hanley1983_nothing, killip2004_intracluster. PoPETs and USENIX index records carry no authors, so sy2019_quic and ashiq2023_report had their author lists fetched from the PoPETs and USENIX landing pages with curl and a browser User-Agent; bibgen.mjs derived the rest from OpenAlex DOIs. No entry contains a literal ASCII at-sign in a field, which silently drops an entry from bibtex4dw. One pre-existing duplicate was noticed and left alone: lerner2016internet and lerner2016_internet are the same paper under two keys. The page cites the underscored form, which matches the file's dominant style.

Both were introduced while fixing something else, and neither would have been visible on the rendered page until it was too late.

1. A literal closing <file> tag inside a published <file> block. hms_quotecheck.py strips DokuWiki code blocks out of the page text before auditing it, so its source contained the literal string for a closing tag — and this page publishes that source inside such a block. DokuWiki would have ended the block at that line and rendered the remaining ~1,000 lines of the file as page markup. Caught by counting opening against closing tags after every generator run rather than by reading. The script now assembles the tag name from two fragments, with a comment saying why.
2. The report script's power-analysis section printed only the six papers that also crawled, while the page states a negative about all nine in the population. A negative claim whose audit trail shows a subset is not audited. It now prints all nine.

Worth recording because it is the failure mode the site's conventions warn about most, and because no automated check would have caught it. An early draft described two of the subsample-sizing papers in a footnote rather than citing them, and named them from the slug and from memory: “Liao et al., Fashion Crimes … CCS 2011” and “Chen et al., Security Implications of Redirection Trail … TheWebConf 2017”. Both author attributions were wrong. The bibliographic index gives:

“Liao” had leaked across from [8Liao, Xiaojing; Liu, Chang; McCoy, Damon; Shi, Elaine; Hao, Shuang; Beyah, Raheem A. (2016): "Characterizing Long-tail SEO Spam on Cloud Web Hosting Services", in: Proceedings of the ACM Web Conference. (DOI)], a different paper by a different group in the same section. It was found by looking both slugs up in data/corpus2/.meta/ rather than by any check — and no check would have found it. The quote check did not evaluate these two quotes at all (they were not in its list until afterwards), and even if it had, it would have passed them: the quotes were correct and only the names were invented, and no quote check reads a name. Both papers are now cited properly — chang2017_security was already in the bibliography, moore2011_fashion was added — and their quotes are in the check file.

The lesson for the next run: a name written in prose rather than resolved through bibgen.mjs or .meta/ has no verification path at all. Do not describe a paper in a footnote to avoid adding a bibliography entry.

• Whether the plateau in n is a plateau in ambition or in cost. Median n stopped growing around 2018 while storage and automation got cheaper. The corpus records no cost, so the page states the plateau and does not explain it.
• The intra-class correlation of any web-measurement outcome. No paper reports one, which is why section C of the page is arithmetic on assumed ρ. This is the same gap Hypothesis testing records; one small study would close both.
• Whether reviewers penalise a small n. The page states this as an impression, explicitly labelled as one, in its Open Questions box. It is not measurable from published papers, and it was tempting to assert.
• Whether the 2025–2026 LLM row is a real constraint or a small-sample artefact. 29 papers, 22 of them in provisional venue-years. Flagged in the page text as needing re-derivation.
• The recall of both probes. Two bugs were found by looking; a third source of loss — column splices — is known and unfixed. There is no estimate of how many further per-band or sizing papers exist, so the page says “floor” wherever a probe-derived count appears.

1. Create rather than broaden design:sampling. Argued above. A reasonable person could have added 15 KB to that page instead and avoided two pages carrying size figures.
2. Leave design:sampling's How Big section in place. Carving it out would have been cleaner but would have left literal numbers stranded in the parts of that page that were not moved. A cross-link and an explicit reconciliation table were chosen instead.
3. Publish the design-effect table with assumed ρ. The alternative was to omit section C for want of a measured ICC. It is kept because the shape of the deflation is the point and is not controversial, and because the assumption is stated three times — in the section, in the methodology bullet and in the open question. The ρ values match the sweep already published on Hypothesis testing, so the two pages cannot be read as disagreeing.
4. Drop the prevalence-versus-n cross-tabulation. It was the most quotable finding this run produced, and it did not survive reading its own inputs. Recorded above so the next run does not rediscover and publish it.
5. Call power analysis for site counts “never established” rather than “superseded”. 87 of 1,762 inferential papers report one and 74 are user studies; there is no earlier period in which crawl papers did this and then stopped. The distinction matters because “superseded” would imply something replaced it, and nothing did.
6. Report the sizing verdicts as four categories rather than as “justified” against “not justified”. The states-only and design-reason rows exist because collapsing them would have made the headline figure look better and the classification less checkable.
7. Do not present the rank-tail direction as a rule. The nineteen papers split three ways and one paper contains two directions. The page gives a mechanism test instead of a heuristic.
8. Quote the arithmetic tables from the report script rather than embedding a runnable file on the page. Sibling pages embed Python with a <file> block. Here the formulas are three lines each and a published script would have been mostly print statements, so the tables are printed by the report script instead and the page says where they come from.

node scripts/report_how_many_sites.mjs prints every figure on the content page with its denominator, plus the three arithmetic tables and the residues. –sizing, –ranktail and –rare add the full text of every probe hit. Runtime is about 20 seconds, dominated by reading 1,121 full texts twice.

report_how_many_sites.mjs

#!/usr/bin/env node
// Every figure on statistics:how_many_sites, with its denominator.
//
//   node scripts/report_how_many_sites.mjs           # the full report
//   node scripts/report_how_many_sites.mjs --wiki    # the same tables as DokuWiki markup
//   node scripts/report_how_many_sites.mjs --sizing  # all 24 sizing-sentence hits, in full
//   node scripts/report_how_many_sites.mjs --ranktail # all rank-band hits, in full
//   node scripts/report_how_many_sites.mjs --rare    # rare site-level phenomena with their n
//
// Rules enforced here rather than remembered (data/extract/README.md):
//   * every figure names its own population; "of 5,859 papers" is never one
//   * sentinels are silence, never an answer
//   * papers are counted, never tuples, EXCEPT the size distribution, which is
//     tuple-level because one paper may draw several populations — it says so
//   * full-text probes print their hits so a count is never the claim; the
//     hand classification of the sizing hits is a literal table below, so the
//     script prints the judgement rather than hiding it
//
// Population: this page is about the SIZE of a web population, so a paper is in
// scope if it drew at least one population whose unit is a web unit
// (websites / domains / web-pages) AND stated a size for one of them. That is
// the same web-unit definition scripts/report_sampling.mjs uses, narrowed to
// papers with a stated n, because a page about the number cannot use a paper
// that gives none.
//
// The arithmetic sections (§6, §7, §8) are NOT measurements of the corpus.
// They are closed-form binomial and design-effect calculations printed here so
// the page's tables are reproducible. They are labelled as such on the page.
 
import fs from 'node:fs';
import path from 'node:path';
import { loadExtractions, dataRoot, pct, table, wikiTable } from './lib.mjs';
 
const WIKI = process.argv.includes('--wiki');
const SHOW_SIZING = process.argv.includes('--sizing');
const SHOW_RANKTAIL = process.argv.includes('--ranktail');
const SHOW_RARE = process.argv.includes('--rare');
 
const ROOT = dataRoot();
const rows = loadExtractions();
const WEB_UNITS = new Set(['websites', 'domains', 'web-pages']);
const key = (p) => `${p.venue}/${p.year}/${p.slug}`;
const crawled = (p) => p.crawlConfig !== null || p.studyTypes.includes('automated-web-crawl');
const webTuples = (p) => p.population.filter((t) => WEB_UNITS.has(t.unit));
const statedSizes = (p) =>
  webTuples(p)
    .map((t) => t.n)
    .filter((n) => typeof n === 'number' && n > 0);
const maxN = (p) => Math.max(...statedSizes(p));
 
const WEB_POP = rows.filter((p) => webTuples(p).length > 0);
const POP = WEB_POP.filter((p) => statedSizes(p).length > 0);
const N = POP.length;
 
const out = [];
const say = (s = '') => out.push(s);
const h = (s) => {
  say('');
  say('='.repeat(74));
  say(s);
  say('='.repeat(74));
};
const t = (headers, body) => say(WIKI ? wikiTable(headers, body) : table(headers, body));
const med = (a) => {
  const s = [...a].sort((x, y) => x - y);
  if (!s.length) return null;
  return s.length % 2 ? s[(s.length - 1) / 2] : (s[s.length / 2 - 1] + s[s.length / 2]) / 2;
};
const quant = (a, q) => {
  const s = [...a].sort((x, y) => x - y);
  return s[Math.min(s.length - 1, Math.floor(q * (s.length - 1)))];
};
const fmt = (n) => Number(n).toLocaleString('en-US');
 
const BUCKETS = [
  ['2010–2013', 2010, 2013],
  ['2014–2017', 2014, 2017],
  ['2018–2021', 2018, 2021],
  ['2022–2024', 2022, 2024],
  ['2025–2026*', 2025, 2026],
];
 
// ------------------------------------------------------------------ §1 scope
h('1. POPULATION — which papers this page is about');
say(`corpus                                            ${fmt(rows.length)}`);
say(`drew >=1 web-unit population                      ${fmt(WEB_POP.length)}  ${pct(WEB_POP.length, rows.length)} of corpus`);
say(`PAGE POPULATION: ... and stated a size for one    ${fmt(N)}  ${pct(N, WEB_POP.length)} of those`);
say(`  ... of which also ran a crawl                   ${fmt(POP.filter(crawled).length)}  ${pct(POP.filter(crawled).length, N)}`);
say(`  ... sampled the web without crawling            ${fmt(POP.filter((p) => !crawled(p)).length)}  ${pct(POP.filter((p) => !crawled(p)).length, N)}`);
say(`web-unit population tuples in scope               ${fmt(POP.reduce((a, p) => a + webTuples(p).length, 0))}`);
say(`  ... of those, with a stated size                ${fmt(POP.reduce((a, p) => a + statedSizes(p).length, 0))}`);
 
// ------------------------------------------------------- §2 the number itself
h('2. THE NUMBER — what sizes the field actually picks (paper-level, max stated web n)');
const allN = POP.map(maxN);
say(`min ${fmt(Math.min(...allN))}  p25 ${fmt(quant(allN, 0.25))}  median ${fmt(med(allN))}  p75 ${fmt(quant(allN, 0.75))}  p90 ${fmt(quant(allN, 0.9))}  max ${fmt(Math.max(...allN))}`);
say('');
const freq = new Map();
for (const n of allN) freq.set(n, (freq.get(n) || 0) + 1);
say('-- the 12 most common values, papers of ' + N + ' --');
t(
  ['Largest stated web population', 'Papers', 'Share of ' + N],
  [...freq.entries()]
    .sort((a, b) => b[1] - a[1] || a[0] - b[0])
    .slice(0, 12)
    .map(([n, c]) => [fmt(n), c, pct(c, N)])
);
const isRound = (n) => {
  for (let e = 0; e <= 12; e++) for (const m of [1, 2, 5]) if (n === m * 10 ** e) return true;
  return false;
};
const round = allN.filter(isRound).length;
const exact1M = allN.filter((n) => n === 1e6).length;
say('');
say(`sizes that are 1, 2 or 5 times a power of ten:  ${round}  ${pct(round, N)}`);
say(`exactly 1,000,000:                              ${exact1M}  ${pct(exact1M, N)}`);
say(`at or above 1,000,000:                          ${allN.filter((n) => n >= 1e6).length}  ${pct(allN.filter((n) => n >= 1e6).length, N)}`);
say(`at or below 1,000:                              ${allN.filter((n) => n <= 1000).length}  ${pct(allN.filter((n) => n <= 1000).length, N)}`);
 
say('');
say('-- has the number grown? median largest stated web n, by four-year bucket --');
t(
  ['Years', 'Papers', 'Median n', 'p75', 'n >= 1M', 'n <= 1,000'],
  BUCKETS.map(([lab, a, b]) => {
    const ps = POP.filter((p) => p.year >= a && p.year <= b).map(maxN);
    return [lab, ps.length, fmt(med(ps)), fmt(quant(ps, 0.75)), pct(ps.filter((n) => n >= 1e6).length, ps.length), pct(ps.filter((n) => n <= 1000).length, ps.length)];
  })
);
say('* 2025-2026 is provisional: CCS/IMC 2026 have not been held and IEEE S&P/WWW 2026 are');
say('  incompletely selected. See literature:corpus.');
 
say('');
say('-- the same, crawling papers only --');
t(
  ['Years', 'Crawling papers', 'Median n', 'n >= 1M'],
  BUCKETS.map(([lab, a, b]) => {
    const ps = POP.filter(crawled).filter((p) => p.year >= a && p.year <= b).map(maxN);
    return [lab, ps.length, fmt(med(ps)), pct(ps.filter((n) => n >= 1e6).length, ps.length)];
  })
);
 
// -------------------------------------------------- §3 what sets the number
h('3. WHAT SETS THE NUMBER — n by what the paper does to each site');
say('classification.method is a mid-band field (58% run-to-run agreement) and is');
say('multi-valued, so a paper appears in every row whose method it uses. Read the');
say('medians as a ranking, not as precise figures.');
say('');
const METHODS = ['heuristic-rules', 'regex-or-signature', 'blocklist', 'curated-database', 'third-party-service', 'supervised-ml', 'static-analysis', 'dynamic-analysis', 'manual-labelling', 'llm'];
t(
  ['Per-site analysis method', 'Papers in scope', 'Median n', 'p25', 'p75'],
  METHODS.map((m) => {
    const ps = POP.filter((p) => p.classification.some((c) => c.method === m));
    const ns = ps.map(maxN);
    return [m, ps.length, ns.length ? fmt(med(ns)) : '—', ns.length ? fmt(quant(ns, 0.25)) : '—', ns.length ? fmt(quant(ns, 0.75)) : '—'];
  })
);
const noCls = POP.filter((p) => p.classification.length === 0);
say('');
say(`papers in scope with no classification tuple at all: ${noCls.length}, median n ${fmt(med(noCls.map(maxN)))}`);
say('');
say('-- LLM classification by bucket, because the population is small and new --');
t(
  ['Years', 'LLM papers in scope', 'Median n', 'Non-LLM papers', 'Median n'],
  BUCKETS.map(([lab, a, b]) => {
    const inb = POP.filter((p) => p.year >= a && p.year <= b);
    const l = inb.filter((p) => p.classification.some((c) => c.method === 'llm'));
    const nl = inb.filter((p) => !p.classification.some((c) => c.method === 'llm'));
    return [lab, l.length, l.length ? fmt(med(l.map(maxN))) : '—', nl.length, fmt(med(nl.map(maxN)))];
  })
);
 
// ------------------------------------------- §4 does anyone justify the number
h('4. DOES ANYONE JUSTIFY THE NUMBER? — structured field');
const inferential = rows.filter((p) => p.statistics.some((s) => s.kind && s.kind !== 'descriptive-only'));
const powerPapers = rows.filter((p) => p.statistics.some((s) => s.kind === 'power-analysis'));
say(`papers running inference ('inferential')                     ${fmt(inferential.length)}`);
say(`  ... with a statistics tuple of kind power-analysis         ${fmt(powerPapers.length)}  ${pct(powerPapers.length, inferential.length)}`);
say(`      of those, recruited human participants                ${powerPapers.filter((p) => p.participants.length > 0).length}  ${pct(powerPapers.filter((p) => p.participants.length > 0).length, powerPapers.length)}`);
say(`      of those, ran a crawl                                 ${powerPapers.filter(crawled).length}`);
say(`      of those, drew a web-unit population                  ${powerPapers.filter((p) => webTuples(p).length > 0).length}`);
say(`power-analysis papers inside this page's ${N}-paper population  ${powerPapers.filter((p) => POP.includes(p)).length}`);
say('');
say('-- every power-analysis tuple in a paper INSIDE THIS PAGE\'S POPULATION --');
say('   (was: only the ones that also crawled. The page states a negative — no');
say('    observational crawl sized from power — so the audit trail has to show');
say('    every in-population paper the structured field returns, not a subset.)');
for (const p of powerPapers.filter((p) => POP.includes(p))) {
  say(`  ${key(p)}   participants=${p.participants.length}  max web n=${statedSizes(p).length ? fmt(maxN(p)) : 'n/a'}`);
  for (const s of p.statistics.filter((s) => s.kind === 'power-analysis')) {
    say(`     method: ${s.method}`);
    say(`     detail: ${s.detail}`);
    say(`     quote : ${s.evidence.quote}`);
  }
}
 
// -------------------------------------------------------- §5 full-text probe
h('5. DOES ANYONE JUSTIFY THE NUMBER? — full-text probe over the ' + N + ' papers');
say('A sizing sentence is one sentence (<=400 chars, no terminal punctuation inside)');
say('that contains ALL THREE of: sample-size / precision language, a web unit, and a');
say('number. Text is whitespace-collapsed first, because a PDF line break inside a');
say('phrase silently loses the match. paper.cols.txt is read, not paper.norm.txt.');
say('');
const SIZE_RE = /\b(?:sample size[sd]?|statistical power|power analys[ei]s|powered to detect|margin of error|chernoff|hoeffding|confidence interval|diminishing returns|law of large numbers)\b/i;
const UNIT_RE = /\b(?:web ?sites?|sites?|domains?|web ?pages?|pages?|urls?|hosts?)\b/i;
const NUM_RE = /\b(?:\d[\d,]{2,}|\d+(?:\.\d+)?\s?(?:k|K|thousand|million|m|M))\b/;
const SENT_RE = /[^.!?]{0,400}[.!?]/g;
// Sentence splitting on [.!?] cuts "0.4% of the top thousand" in half at the
// decimal point, which silently dropped murley2021_websocket from the rank-band
// probe below. Decimal points, and periods inside common abbreviations, are
// masked with \u0001 before splitting and restored before printing. Found
// 2026-09-02 by checking a paper the probe should have matched and did not.
const DOT = '\u0001';
const maskDots = (s) =>
  s
    .replace(/(\d)\.(\d)/g, `$1${DOT}$2`)
    .replace(/\b(?:e\.g|i\.e|et al|cf|vs|Fig|Sec|approx|no)\./gi, (m) => m.slice(0, -1) + DOT);
const unmaskDots = (s) => s.split(DOT).join('.');
const norm = (s) => maskDots(s.replace(/\s+/g, ' '));
 
// Hand classification of every hit, read one by one on 2026-09-02. The verdict
// is a judgement and is printed so a reader can disagree with it.
//   derives-n      the size of a web population is derived from a stated
//                  precision, power or confidence requirement
//   design-reason  the size is argued for, but from a design or cost argument
//                  rather than a calculation
//   states-only    the sentence names the size of a web population and gives no
//                  argument for it at all
//   not-sizing     the sentence is about the statistics of the analysis, or a
//                  scale boast, or a caveat about a group being too small
const VERDICT = {
  'CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web': ['derives-n', 'sized a 363-site manual-inspection subsample from a 95% confidence requirement'],
  'IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i': ['not-sizing', 'dropped groups with <10 URLs; a filtering threshold, not a sample size'],
  'IMC/2014/censorship-in-the-wild-analyzing-internet-filtering-in-syria': ['not-sizing', 'CI width on a proportion in an already-collected 32M-request dataset'],
  'WWW/2016/remedying-web-hijacking-notification-effectiveness-and-webmaster-comprehension': ['not-sizing', '"largest studied to date" — a scale boast'],
  'IMC/2017/email-typosquatting': ['not-sizing', 'CI on an extrapolated email volume, not on a sample size'],
  'WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide': ['derives-n', 'sized a 2,000-site subsample from a stated margin of error'],
  'IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking': ['design-reason', 'empirical saturation: resampled 500 combinations at varying sizes to see when a block page stops appearing'],
  'IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni': ['derives-n', '384 phishing sites per arm from an ANOVA power calculation'],
  'IMC/2019/a-longitudinal-analysis-of-the-ads-txt-standard': ['not-sizing', 'the population grew because the standard was adopted; no calculation'],
  'WWW/2019/auditing-the-partisanship-of-google-search-snippets': ['not-sizing', 'a >100 threshold for including a website in a per-site test'],
  'USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish': ['derives-n', 'deployment size from a power calculation; also reports the achieved effect size'],
  'WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web': ['design-reason', '4,000 sites as 1,000 from each rank magnitude band — a stratification argument'],
  'IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web': ['design-reason', 'calls n=10,000 "conservative"; asserted, not derived'],
  'USENIX/2022/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement': ['design-reason', 'reduced the domain set citing diminishing returns and minimising risk'],
  'WWW/2022/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps': ['not-sizing', 'a 100-site verification subsample described as limited; no calculation'],
  'WWW/2022/leveraging-googles-publisher-specific-ids-to-detect-website-administration': ['not-sizing', 'a figure caption fragment about snapshot variance'],
  'CCS/2023/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio': ['not-sizing', 'explains a recall difference by a smaller training set'],
  'PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation': ['derives-n', '383 sites hand-inspected, sized for 100K at +-5% margin of error'],
  'USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking': ['derives-n', '272 of 933 sites hand-inspected, sized for 95%/+-5%'],
  'WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework': ['not-sizing', 'a caveat that one rank band had too few domains'],
  'WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari': ['design-reason', 'a fixed 10,000-per-country target, met by descending the ranking'],
  'USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time': ['not-sizing', 'CI on an estimate derived from an already-fixed population'],
  'PETS/2025/understanding-regional-filter-lists-efficacy-and-impact': ['not-sizing', 'diminishing returns of larger filter-rule sets, not of more sites'],
  'PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc': ['not-sizing', 'a robustness remark about variation in sample size'],
  // added 2026-09-02 after masking decimal points in the sentence splitter
  'PETS/2020/enhanced-performance-and-privacy-for-tls-over-tcp-fast-open': ['states-only', 'names a 30,000-hostname subsample of the Alexa top million with no derivation'],
  'IMC/2021/web-censorship-measurements-of-http-3-over-quic': ['not-sizing', 'a table fragment: per-country replication counts after validation filtering'],
  'WWW/2021/its-not-just-the-site-its-the-contents-intra-domain-fingerprinting-social-media': ['not-sizing', 'a figure caption about confidence intervals on burst sizes'],
};
 
const sizingHits = [];
for (const p of POP) {
  const f = path.join(ROOT, `fulltext/${p.year}/${p.venue}/${p.slug}/paper.cols.txt`);
  if (!fs.existsSync(f)) continue;
  const txt = norm(fs.readFileSync(f, 'utf8'));
  const keep = (txt.match(SENT_RE) || []).filter((s) => SIZE_RE.test(s) && UNIT_RE.test(s) && NUM_RE.test(s));
  if (keep.length) sizingHits.push({ p, sents: keep });
}
say(`papers with >=1 sizing sentence: ${sizingHits.length}  ${pct(sizingHits.length, N)} of ${N}`);
const unclassified = sizingHits.filter((x) => !VERDICT[key(x.p)]);
say(`hand-read: ${sizingHits.length - unclassified.length} of ${sizingHits.length}` + (unclassified.length ? '  !! UNREAD HITS BELOW — the verdict table is stale' : ''));
for (const x of unclassified) say(`   !! unread: ${key(x.p)}`);
const byVerdict = (v) => sizingHits.filter((x) => VERDICT[key(x.p)]?.[0] === v);
say('');
t(
  ['Verdict after reading the sentence', 'Papers', 'Share of ' + N],
  [
    ['derives n from a precision or power requirement', byVerdict('derives-n').length, pct(byVerdict('derives-n').length, N)],
    ['argues the size from design or cost, without a calculation', byVerdict('design-reason').length, pct(byVerdict('design-reason').length, N)],
    ['names a size and gives no argument for it', byVerdict('states-only').length, pct(byVerdict('states-only').length, N)],
    ['not about sizing a web population', byVerdict('not-sizing').length, pct(byVerdict('not-sizing').length, N)],
  ]
);
say('');
say('-- the derives-n papers, and what the calculation sized --');
for (const x of byVerdict('derives-n')) {
  say(`  ${key(x.p)}`);
  say(`     n stated for the web population: ${fmt(maxN(x.p))}`);
  say(`     ${VERDICT[key(x.p)][1]}`);
}
const subsample = byVerdict('derives-n').filter((x) => /subsample|hand-inspected|manual-inspection|hand/i.test(VERDICT[key(x.p)][1]));
say('');
say(`of the ${byVerdict('derives-n').length} derives-n papers, ${subsample.length} size a HAND-CHECKED SUBSAMPLE`);
say(`rather than the crawl itself; ${byVerdict('derives-n').length - subsample.length} size the measured population.`);
 
if (SHOW_SIZING) {
  h('5b. EVERY SIZING-SENTENCE HIT, IN FULL');
  for (const x of sizingHits) {
    const v = VERDICT[key(x.p)] ?? ['UNREAD', ''];
    say('');
    say(`### ${key(x.p)}   n=${fmt(maxN(x.p))}   [${v[0]}] ${v[1]}`);
    for (const s of x.sents) say('    ' + unmaskDots(s).trim());
  }
}
 
// ------------------------------------------------------- §6 precision, exact
h('6. ARITHMETIC (not a corpus measurement) — precision on a prevalence');
say('Wald half-width of a 95% interval on a proportion: 1.96*sqrt(p(1-p)/n).');
say('Nothing about the web is in this table; it is here so the page can be checked.');
say('');
const Z = 1.96;
const hw = (p, n) => Z * Math.sqrt((p * (1 - p)) / n);
const NS = [100, 1000, 10000, 100000, 1000000];
t(
  ['n', 'p = 0.5', 'p = 0.2', 'p = 0.05', 'p = 0.01', 'p = 0.001'],
  NS.map((n) => [fmt(n), ...[0.5, 0.2, 0.05, 0.01, 0.001].map((p) => '+-' + (100 * hw(p, n)).toFixed(p <= 0.01 ? 3 : 2) + ' pp')])
);
say('');
say('-- n needed for a given half-width at p = 0.5, the worst case --');
t(
  ['Target half-width', 'n needed'],
  [0.05, 0.03, 0.01, 0.003, 0.001].map((w) => [`+-${(100 * w).toFixed(1)} pp`, fmt(Math.ceil((Z ** 2 * 0.25) / w ** 2))])
);
 
// ---------------------------------------------------- §7 rare-event capture
h('7. ARITHMETIC (not a corpus measurement) — capturing a rare thing');
say('Expected count is n*p. P(at least one) = 1-(1-p)^n. The n for a 95% chance of');
say('seeing at least one is ceil(ln(0.05)/ln(1-p)), which is about 3/p. If you see');
say('zero in n trials, the 95% upper bound on p is about 3/n (the rule of three).');
say('');
const PS = [0.1, 0.01, 0.001, 0.0001, 0.00001];
t(
  ['Prevalence p', 'Expected hits at n=10,000', 'at n=100,000', 'at n=1,000,000', 'n for P(>=1 hit) >= 95%', 'n for a +-20% relative CI'],
  PS.map((p) => [
    (100 * p).toFixed(3).replace(/0+$/, '').replace(/\.$/, '') + '%',
    (1e4 * p).toFixed(2),
    (1e5 * p).toFixed(1),
    (1e6 * p).toFixed(0),
    fmt(Math.ceil(Math.log(0.05) / Math.log(1 - p))),
    fmt(Math.ceil((Z ** 2 * (1 - p)) / (0.2 ** 2 * p))),
  ])
);
say('');
say('-- what a zero buys you: 95% upper bound on p after seeing no hits in n --');
t(
  ['n with zero hits', '95% upper bound on p', 'i.e. at most ... sites in a million'],
  NS.map((n) => [fmt(n), (100 * (3 / n)).toFixed(4) + '%', fmt(Math.round((3 / n) * 1e6))])
);
 
// ------------------------------------------------------- §8 the design effect
h('8. ARITHMETIC (not a corpus measurement) — sites are not independent draws');
say('Design effect for equal clusters of size m with intra-class correlation rho:');
say('deff = 1 + (m-1)*rho, and the effective sample size is n/deff. The ICC of any');
say('real web-measurement outcome has never been measured (see the open question on');
say('statistics:hypothesis_testing), so these rho values are illustrative, chosen to');
say('match the sweep published on that page.');
say('');
const deff = (m, rho) => 1 + (m - 1) * rho;
t(
  ['Cluster size m', 'rho = 0.02', 'rho = 0.05', 'rho = 0.20'],
  [10, 100, 1000].map((m) => [fmt(m), ...[0.02, 0.05, 0.2].map((r) => deff(m, r).toFixed(1) + 'x')])
);
say('');
say('-- effective n for a 1,000,000-site crawl --');
t(
  ['Cluster size m', 'rho = 0.02', 'rho = 0.05', 'rho = 0.20'],
  [10, 100, 1000].map((m) => [fmt(m), ...[0.02, 0.05, 0.2].map((r) => fmt(Math.round(1e6 / deff(m, r))))])
);
say('');
say('-- half-width on p=0.05 at n=1,000,000 once deflated --');
t(
  ['Cluster size m', 'rho = 0.02', 'rho = 0.05', 'rho = 0.20'],
  [10, 100, 1000].map((m) => [fmt(m), ...[0.02, 0.05, 0.2].map((r) => '+-' + (100 * hw(0.05, 1e6 / deff(m, r))).toFixed(3) + ' pp')])
);
 
// -------------------------------------------------------------- §9 rank tail
h('9. THE RANK TAIL — papers reporting the same measurement per rank band');
say('Probe: one sentence containing a rank band, a phrase comparing across rank, and');
say('a percentage. Whitespace-collapsed. Every hit is printed with --ranktail; the');
say('count is not the claim.');
say('');
// Widened on 2026-09-02: the first version required a DIGIT after "top", so it
// missed "0.4% of the top thousand and 0.05% of websites in the top million"
// (murley2021_websocket) — a per-band result stated in words. Spelled-out
// magnitudes and "Top Alexa lists" are now included. The narrow version found
// 10 papers; the wide one is what the page reports.
const BAND_RE = /\b(?:top[- ]?(?:\d[\d,]*\s?(?:k|K|m|M|thousand|million)?|ten|hundred|thousand|million)|larger top[- ]?\w+ lists?|rank(?:ed|ing|s)? (?:between|from) [\d,]+|\d[\d,]*\s?(?:k|K)\s?[–-]\s?\d[\d,]*\s?(?:k|K|m|M))\b/i;
const DIR_RE = /\b(?:less popular|lower[- ]ranked|higher[- ]ranked|more popular|as (?:the )?rank(?:ing)? (?:increases|decreases|grows)|down the (?:list|ranking|tail)|long tail|popularity (?:decreases|declines|drops)|rank(?:ing)? bucket|rank(?:ing)? (?:band|strat|tier)|per[- ]rank|by rank|(?:share|rate|prevalence|adoption)[^.]{0,40}(?:decreases|increases|drops|rises)[^.]{0,30}(?:larger|lower|higher|less|more)|top thousand and[^.]{0,40}top million)\b/i;
const PCT_RE = /\d+(?:\.\d+)?\s?%/;
const rankHits = [];
for (const p of POP) {
  const f = path.join(ROOT, `fulltext/${p.year}/${p.venue}/${p.slug}/paper.cols.txt`);
  if (!fs.existsSync(f)) continue;
  const txt = norm(fs.readFileSync(f, 'utf8'));
  const keep = (txt.match(SENT_RE) || []).filter((s) => BAND_RE.test(s) && DIR_RE.test(s) && PCT_RE.test(s));
  if (keep.length) rankHits.push({ p, sents: keep });
}
// Hand classification, read one by one on 2026-09-02.
const RANK_VERDICT = {
  'CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web': ['per-band', 'CA market share RISES down the ranking: 5% of top 1K, 20% of top 100K, 35% of top 1M'],
  'IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment': ['per-band', 'security.txt adoption FALLS down the ranking: 3-4% of top 10K, ~1% of top 100K'],
  'IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne': ['per-band', 'third-party CA use 71% in top-100 against 77% in top-100K'],
  'USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting': ['per-band', 'DMARC misconfiguration ~10% in the most popular 10K against ~20% in the least popular 10K'],
  'CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security': ['per-band', 'archive hit rate plotted across Tranco rank buckets — the tail is less archived'],
  'WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading': ['per-band', 'dependency chains marginally more common in more popular sites (55% in the top 10K)'],
  'WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web': ['per-band', 'Server-Sent Events on 0.4% of the top thousand against 0.05% of the top million — an 8x head/tail gap'],
  'USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web': ['per-band', 'lower-ranked and unranked sites less susceptible than the Tranco top 1K'],
  'CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka': ['per-band', 'PII leakage share quoted separately for the 500K-1M band'],
  'WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod': ['not-rank', 'long tail of vulnerable applications, not of site rank'],
  'IMC/2015/who-is-com-learning-to-parse-whois-records': ['not-rank', 'long tail of WHOIS service names'],
  'IMC/2016/characterizing-website-behaviors-across-logged-in-and-not-logged-in-users': ['not-rank', 'long tail of FQDNs within the data, not a rank band'],
  'USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w': ['per-band', 'Wayback coverage better for more popular trackers: 75% of the top 100 against 53% of all'],
  'PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion': ['not-rank', 'a figure-legend fragment; the comparison is not in the sentence'],
  'WWW/2019/unnecessarily-identifiable-quantifying-the-fingerprintability-of-browser-extensi': ['not-rank', 'popularity bands of browser EXTENSIONS, not of websites'],
  'IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web': ['per-band', 'category mix shifts across the ranking: News & Media above 15% of top-50 sites and dropping'],
  // added 2026-09-02 after masking decimal points in the sentence splitter widened
  // this probe from 15 hits to 28
  'PETS/2019/a-quic-look-at-web-tracking': ['per-band', 'QUIC support at six nested depths: 21.00% (top 100) down to 0.02% (top 1M)'],
  'USENIX/2023/a-large-scale-measurement-of-website-login-policies': ['per-band', 'BOTH directions in one paper: cleartext password submission 0.44%/0.50%/0.62% rising across top 10K/100K/1M, rate limiting 33.6%/26.7%/24.1% falling'],
  'IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio': ['per-band', 'valid HTTPS on government sites ~30% in the top million and in the long tail alike — FLAT'],
  'IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking': ['per-band', 'Luminati-protected domains 0.05% of the wide sample against 0.2% of the Alexa top 10K'],
  'USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account': ['per-band', 'SSO support higher in more popular sites, 10.8% coverage in the top 100K'],
  'IMC/2015/neither-snow-nor-rain-nor-mitm-an-empirical-analysis-of-email-delivery-security': ['per-band', 'TLS support lags in the long tail of 700,000 SMTP servers behind the Alexa top million'],
  'PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law': ['per-band', 'policy-generator use and disclosure rates tabulated by rank group; generators used by less popular sites'],
  'WWW/2025/harmful-terms-and-where-to-find-them-measuring-and-modeling-unfavorable-financia': ['per-band', 'unfavorable financial terms more prevalent on less popular sites within the Tranco top 100K'],
  'IMC/2022/toppling-top-lists-evaluating-the-accuracy-of-popular-website-lists': ['not-rank', 'measures the ACCURACY OF THE LIST by rank bucket, not a web phenomenon per band'],
  'IMC/2011/towards-understanding-modern-web-traffic': ['not-rank', 'a figure fragment about URL popularity distributions'],
  'CCS/2018/measuring-information-leakage-in-website-fingerprinting-attacks-and-defenses': ['not-rank', 'a figure fragment: top-100 most informative FEATURES by rank'],
  'IMC/2025/towards-a-non-binary-view-of-ipv6-adoption': ['not-rank', 'long tail of third-party DOMAINS to fix, not a rank band of sites'],
};
const rankUnread = rankHits.filter((x) => !RANK_VERDICT[key(x.p)]);
say(`papers with >=1 rank-band sentence: ${rankHits.length}  ${pct(rankHits.length, N)} of ${N}`);
for (const x of rankUnread) say(`   !! unread: ${key(x.p)}`);
const perBand = rankHits.filter((x) => RANK_VERDICT[key(x.p)]?.[0] === 'per-band');
say(`after reading: ${perBand.length} report a measurement per rank band; ${rankHits.length - perBand.length - rankUnread.length} are a long tail of something else`);
say('');
for (const x of perBand) say(`  ${key(x.p)}\n     ${RANK_VERDICT[key(x.p)][1]}`);
if (SHOW_RANKTAIL) {
  h('9b. EVERY RANK-BAND HIT, IN FULL');
  for (const x of rankHits) {
    const v = RANK_VERDICT[key(x.p)] ?? ['UNREAD', ''];
    say('');
    say(`### ${key(x.p)}  n=${fmt(maxN(x.p))}  [${v[0]}] ${v[1]}`);
    for (const s of x.sents.slice(0, 2)) say('    ' + unmaskDots(s).trim());
  }
}
 
// ------------------------------------------------------ §10 rare in practice
h('10. RARE IN PRACTICE — site-level phenomena under 0.5%, in papers with n >= 200,000');
say('detection[].prevalence is free text. This is a PROBE, not an aggregate: it keeps');
say('tuples whose prevalence string names a web unit and contains a percentage below');
say('0.5, and prints them so each can be read. It is not a rate of anything.');
say('');
const UNIT_ONLY = /\b(sites?|websites?|domains?|pages?)\b/i;
const PCT_G = /(\d+(?:\.\d+)?)\s*%/g;
let rareTuples = 0;
const rare = [];
for (const p of POP.filter((p) => maxN(p) >= 200000)) {
  for (const d of p.detection) {
    if (!d.prevalence) continue;
    const s = String(d.prevalence);
    if (!UNIT_ONLY.test(s)) continue;
    PCT_G.lastIndex = 0;
    const vs = [];
    let m;
    while ((m = PCT_G.exec(s)) !== null) vs.push(parseFloat(m[1]));
    if (vs.length && Math.min(...vs) < 0.5) {
      rareTuples++;
      rare.push({ p, d, s, min: Math.min(...vs) });
    }
  }
}
say(`papers in scope with n >= 200,000: ${POP.filter((p) => maxN(p) >= 200000).length}`);
say(`tuples kept: ${rareTuples}, across ${new Set(rare.map((r) => key(r.p))).size} papers`);
if (SHOW_RARE) for (const r of rare) say(`  ${r.p.year} ${key(r.p)}  n=${fmt(maxN(r.p))}\n     ${r.d.phenomenon} :: ${r.s}`);
else say('(run with --rare to print all of them)');
 
// -------------------------------------------------------------- §11 residues
h('11. RESIDUES AND WHAT IS NOT COUNTED');
say(`web-unit papers with NO stated size, excluded from this page: ${WEB_POP.length - N}  ${pct(WEB_POP.length - N, WEB_POP.length)} of ${WEB_POP.length}`);
const anyPrev = POP.filter((p) => p.detection.some((d) => d.prevalence));
say(`papers in scope with >=1 detection prevalence string: ${anyPrev.length}  ${pct(anyPrev.length, N)}`);
let prevT = 0,
  prevUnit = 0,
  prevPctInUnit = 0;
for (const p of POP)
  for (const d of p.detection) {
    if (!d.prevalence) continue;
    prevT++;
    const s = String(d.prevalence);
    if (!UNIT_ONLY.test(s)) continue;
    prevUnit++;
    if (/\d+(?:\.\d+)?\s*%/.test(s)) prevPctInUnit++;
  }
say(`prevalence strings in scope: ${prevT}; naming a web unit: ${prevUnit} (${pct(prevUnit, prevT)}); of those with a %: ${prevPctInUnit} (${pct(prevPctInUnit, prevUnit)})`);
say(`The ${pct(prevUnit - prevPctInUnit, prevUnit)} of unit-naming prevalence strings that carry no`);
say('parseable percentage, and the percentages that turn out to be false-positive');
say('rates or classifier metrics rather than site shares,');
say('are why no aggregate of prevalence-versus-n is published. An earlier draft');
say('cross-tabulated them; it was dropped. See the provenance page.');
 
console.log(out.join('\n'));

Unedited output of node scripts/report_how_many_sites.mjs:

report_how_many_sites-output.txt

==========================================================================
1. POPULATION — which papers this page is about
==========================================================================
corpus                                            5,859
drew >=1 web-unit population                      1,153  19.7% of corpus
PAGE POPULATION: ... and stated a size for one    1,121  97.2% of those
  ... of which also ran a crawl                   674  60.1%
  ... sampled the web without crawling            447  39.9%
web-unit population tuples in scope               2,484
  ... of those, with a stated size                2,379
 
==========================================================================
2. THE NUMBER — what sizes the field actually picks (paper-level, max stated web n)
==========================================================================
min 1  p25 1,000  median 20,000  p75 1,000,000  p90 7,341,165  max 250,000,000,000
 
-- the 12 most common values, papers of 1121 --
Largest stated web population  Papers  Share of 1121
-----------------------------  ------  -------------
1,000,000                      140     12.5%
10,000                         80      7.1%
100,000                        65      5.8%
100                            48      4.3%
1,000                          37      3.3%
500                            20      1.8%
20,000                         20      1.8%
5,000                          18      1.6%
50                             16      1.4%
20                             14      1.2%
200                            14      1.2%
10                             12      1.1%
 
sizes that are 1, 2 or 5 times a power of ten:  523  46.7%
exactly 1,000,000:                              140  12.5%
at or above 1,000,000:                          311  27.7%
at or below 1,000:                              302  26.9%
 
-- has the number grown? median largest stated web n, by four-year bucket --
Years       Papers  Median n  p75        n >= 1M  n <= 1,000
----------  ------  --------  ---------  -------  ----------
2010–2013   98      5,183     100,000    19.4%    37.8%
2014–2017   182     26,589.5  1,000,000  34.6%    29.7%
2018–2021   312     42,541.5  1,000,000  27.2%    21.8%
2022–2024   341     20,000    1,000,000  26.1%    25.8%
2025–2026*  188     20,000    1,000,000  29.3%    29.3%
* 2025-2026 is provisional: CCS/IMC 2026 have not been held and IEEE S&P/WWW 2026 are
  incompletely selected. See literature:corpus.
 
-- the same, crawling papers only --
Years       Crawling papers  Median n  n >= 1M
----------  ---------------  --------  -------
2010–2013   49               10,000    16.3%
2014–2017   115              18,000    25.2%
2018–2021   191              35,102    21.5%
2022–2024   208              13,795.5  19.2%
2025–2026*  111              20,000    24.3%
 
==========================================================================
3. WHAT SETS THE NUMBER — n by what the paper does to each site
==========================================================================
classification.method is a mid-band field (58% run-to-run agreement) and is
multi-valued, so a paper appears in every row whose method it uses. Read the
medians as a ranking, not as precise figures.
 
Per-site analysis method  Papers in scope  Median n  p25     p75
------------------------  ---------------  --------  ------  ---------
heuristic-rules           605              93,427    2,846   1,000,000
regex-or-signature        111              132,798   4,000   1,000,000
blocklist                 145              20,000    10,000  387,000
curated-database          228              93,283.5  3,806   1,000,000
third-party-service       271              100,000   7,337   1,000,000
supervised-ml             266              20,000    1,000   442,190
static-analysis           50               15,000    1,899   1,000,000
dynamic-analysis          66               74,215.5  5,000   1,000,000
manual-labelling          307              10,000    361     906,731
llm                       29               10,000    2,892   90,000
 
papers in scope with no classification tuple at all: 101, median n 3,000
 
-- LLM classification by bucket, because the population is small and new --
Years       LLM papers in scope  Median n  Non-LLM papers  Median n
----------  -------------------  --------  --------------  --------
2010–2013   0                    —         98              5,183
2014–2017   0                    —         182             26,589.5
2018–2021   0                    —         312             42,541.5
2022–2024   7                    10,000    334             20,000
2025–2026*  22                   10,500    166             20,000
 
==========================================================================
4. DOES ANYONE JUSTIFY THE NUMBER? — structured field
==========================================================================
papers running inference ('inferential')                     1,762
  ... with a statistics tuple of kind power-analysis         87  4.9%
      of those, recruited human participants                74  85.1%
      of those, ran a crawl                                 6
      of those, drew a web-unit population                  9
power-analysis papers inside this page's 1121-paper population  9
 
-- every power-analysis tuple in a paper INSIDE THIS PAGE'S POPULATION --
   (was: only the ones that also crawled. The page states a negative — no
    observational crawl sized from power — so the audit trail has to show
    every in-population paper the structured field returns, not a subset.)
  WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services   participants=0  max web n=1,073,642
     method: Chernoff Bounds
     detail: trust interval δ = 0.01; error probability λ = 0.01; sample n = 500
     quote : We set the trust interval δ = 0.01 and the error probability λ = 0.01 to obtain the number of sampled cloud directories n = 500.
  IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni   participants=0  max web n=1,980
     method: one-way independent ANOVA
     detail: power = 0.95; significance level = 0.05; assumed medium effect size f = 0.25
     quote : Our goal was to obtain a power of 0.95 at the significance level of 0.05 in a one-way independent ANOVA test
  USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish   participants=0  max web n=4,393
     method: Statistical power analysis
     detail: power 0.95; p-value 0.05; assumed medium effect size 0.25; later estimated effect size 0.36
     quote : To obtain a power of 0.95 at a p-value of 0.05, we initially assumed a medium effect size of 0.25.
  PETS/2021/managing-potentially-intrusive-practices-in-the-browser-a-user-centered-perspect   participants=2  max web n=16
     method: G*Power
     detail: At least 997 participants required for α = 0.05 and medium effect size 0.4.
     quote : We required at least 997 participants to achieve significance at α = 0.05 with a medium effect size (0.4).
  IMC/2022/what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement   participants=2  max web n=10
     method: G*Power sample-size calculation
     detail: At least 126 participants for medium effects with 10 predictors
     quote : we calculated that we needed a sample size of at least 126 participants to detect medium effect sizes using a linear regression with 10 predictors
  PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing   participants=2  max web n=118,000
     method: point biserial model power analysis
     detail: All comparisons had >=80% power
     quote : A power analysis, using the point biserial model, strengthens this hypothesis, as all comparisons between conditions had ≥80% power.
  IEEE-SP/2016/sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-with-public   participants=0  max web n=8
     method: statistical power
     detail: all tests had statistical power of 0.98 or higher
     quote : Finally, we confirmed that all tests performed had a statistical power of 0.98 or higher
  NDSS/2025/the-kids-are-all-right-investigating-the-susceptibility-of-teens-and-adults-to-youtube-giveaway-scams   participants=2  max web n=451
     method: repeated measures ANOVA power analysis
     detail: effect size = 0.25, power = 0.95, α = 0.05, 2 measures, 12 groups, correlation = 0.5
     quote : This calculation used a repeated measures ANOVA model, assuming an effect size of 0.25, power = 0.95, α = 0.05, 2 measures, 12 groups ...
  IEEE-SP/2025/lets-get-visual-testing-visual-analogies-and-metaphors-for-conveying-privacy-pol   participants=4  max web n=10
     method: a priori power analysis; post-hoc power analyses
     detail: minimum N=357; initial N=428; lowest post-hoc power .72
     quote : An initial power analysis with the tool G*Power [78] suggested a minimum required sample size of N=357 participants
 
==========================================================================
5. DOES ANYONE JUSTIFY THE NUMBER? — full-text probe over the 1121 papers
==========================================================================
A sizing sentence is one sentence (<=400 chars, no terminal punctuation inside)
that contains ALL THREE of: sample-size / precision language, a web unit, and a
number. Text is whitespace-collapsed first, because a PDF line break inside a
phrase silently loses the match. paper.cols.txt is read, not paper.norm.txt.
 
papers with >=1 sizing sentence: 26  2.3% of 1121
hand-read: 26 of 26
 
Verdict after reading the sentence                          Papers  Share of 1121
----------------------------------------------------------  ------  -------------
derives n from a precision or power requirement             6       0.5%
argues the size from design or cost, without a calculation  5       0.4%
names a size and gives no argument for it                   1       0.1%
not about sizing a web population                           14      1.2%
 
-- the derives-n papers, and what the calculation sized --
  CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web
     n stated for the web population: 6,558
     sized a 363-site manual-inspection subsample from a 95% confidence requirement
  WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide
     n stated for the web population: 1,000,000
     sized a 2,000-site subsample from a stated margin of error
  IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
     n stated for the web population: 1,980
     384 phishing sites per arm from an ANOVA power calculation
  USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish
     n stated for the web population: 4,393
     deployment size from a power calculation; also reports the achieved effect size
  PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation
     n stated for the web population: 100,000
     383 sites hand-inspected, sized for 100K at +-5% margin of error
  USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking
     n stated for the web population: 5,000
     272 of 933 sites hand-inspected, sized for 95%/+-5%
 
of the 6 derives-n papers, 4 size a HAND-CHECKED SUBSAMPLE
rather than the crawl itself; 2 size the measured population.
 
==========================================================================
6. ARITHMETIC (not a corpus measurement) — precision on a prevalence
==========================================================================
Wald half-width of a 95% interval on a proportion: 1.96*sqrt(p(1-p)/n).
Nothing about the web is in this table; it is here so the page can be checked.
 
n          p = 0.5    p = 0.2    p = 0.05   p = 0.01    p = 0.001
---------  ---------  ---------  ---------  ----------  ----------
100        +-9.80 pp  +-7.84 pp  +-4.27 pp  +-1.950 pp  +-0.619 pp
1,000      +-3.10 pp  +-2.48 pp  +-1.35 pp  +-0.617 pp  +-0.196 pp
10,000     +-0.98 pp  +-0.78 pp  +-0.43 pp  +-0.195 pp  +-0.062 pp
100,000    +-0.31 pp  +-0.25 pp  +-0.14 pp  +-0.062 pp  +-0.020 pp
1,000,000  +-0.10 pp  +-0.08 pp  +-0.04 pp  +-0.020 pp  +-0.006 pp
 
-- n needed for a given half-width at p = 0.5, the worst case --
Target half-width  n needed
-----------------  --------
+-5.0 pp           385
+-3.0 pp           1,068
+-1.0 pp           9,604
+-0.3 pp           106,712
+-0.1 pp           960,400
 
==========================================================================
7. ARITHMETIC (not a corpus measurement) — capturing a rare thing
==========================================================================
Expected count is n*p. P(at least one) = 1-(1-p)^n. The n for a 95% chance of
seeing at least one is ceil(ln(0.05)/ln(1-p)), which is about 3/p. If you see
zero in n trials, the 95% upper bound on p is about 3/n (the rule of three).
 
Prevalence p  Expected hits at n=10,000  at n=100,000  at n=1,000,000  n for P(>=1 hit) >= 95%  n for a +-20% relative CI
------------  -------------------------  ------------  --------------  -----------------------  -------------------------
10%           1000.00                    10000.0       100000          29                       865
1%            100.00                     1000.0        10000           299                      9,508
0.1%          10.00                      100.0         1000            2,995                    95,944
0.01%         1.00                       10.0          100             29,956                   960,304
0.001%        0.10                       1.0           10              299,572                  9,603,904
 
-- what a zero buys you: 95% upper bound on p after seeing no hits in n --
n with zero hits  95% upper bound on p  i.e. at most ... sites in a million
----------------  --------------------  -----------------------------------
100               3.0000%               30,000
1,000             0.3000%               3,000
10,000            0.0300%               300
100,000           0.0030%               30
1,000,000         0.0003%               3
 
==========================================================================
8. ARITHMETIC (not a corpus measurement) — sites are not independent draws
==========================================================================
Design effect for equal clusters of size m with intra-class correlation rho:
deff = 1 + (m-1)*rho, and the effective sample size is n/deff. The ICC of any
real web-measurement outcome has never been measured (see the open question on
statistics:hypothesis_testing), so these rho values are illustrative, chosen to
match the sweep published on that page.
 
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              1.2x        1.4x        2.8x
100             3.0x        6.0x        20.8x
1,000           21.0x       51.0x       200.8x
 
-- effective n for a 1,000,000-site crawl --
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              847,458     689,655     357,143
100             335,570     168,067     48,077
1,000           47,664      19,627      4,980
 
-- half-width on p=0.05 at n=1,000,000 once deflated --
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              +-0.046 pp  +-0.051 pp  +-0.071 pp
100             +-0.074 pp  +-0.104 pp  +-0.195 pp
1,000           +-0.196 pp  +-0.305 pp  +-0.605 pp
 
==========================================================================
9. THE RANK TAIL — papers reporting the same measurement per rank band
==========================================================================
Probe: one sentence containing a rank band, a phrase comparing across rank, and
a percentage. Whitespace-collapsed. Every hit is printed with --ranktail; the
count is not the claim.
 
papers with >=1 rank-band sentence: 28  2.5% of 1121
after reading: 19 report a measurement per rank band; 9 are a long tail of something else
 
  IMC/2015/neither-snow-nor-rain-nor-mitm-an-empirical-analysis-of-email-delivery-security
     TLS support lags in the long tail of 700,000 SMTP servers behind the Alexa top million
  USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
     Wayback coverage better for more popular trackers: 75% of the top 100 against 53% of all
  IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking
     Luminati-protected domains 0.05% of the wide sample against 0.2% of the Alexa top 10K
  USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account
     SSO support higher in more popular sites, 10.8% coverage in the top 100K
  CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web
     CA market share RISES down the ranking: 5% of top 1K, 20% of top 100K, 35% of top 1M
  PETS/2019/a-quic-look-at-web-tracking
     QUIC support at six nested depths: 21.00% (top 100) down to 0.02% (top 1M)
  WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading
     dependency chains marginally more common in more popular sites (55% in the top 10K)
  IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne
     third-party CA use 71% in top-100 against 77% in top-100K
  IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio
     valid HTTPS on government sites ~30% in the top million and in the long tail alike — FLAT
  IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment
     security.txt adoption FALLS down the ranking: 3-4% of top 10K, ~1% of top 100K
  WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web
     Server-Sent Events on 0.4% of the top thousand against 0.05% of the top million — an 8x head/tail gap
  IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web
     category mix shifts across the ranking: News & Media above 15% of top-50 sites and dropping
  CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security
     archive hit rate plotted across Tranco rank buckets — the tail is less archived
  USENIX/2023/a-large-scale-measurement-of-website-login-policies
     BOTH directions in one paper: cleartext password submission 0.44%/0.50%/0.62% rising across top 10K/100K/1M, rate limiting 33.6%/26.7%/24.1% falling
  USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting
     DMARC misconfiguration ~10% in the most popular 10K against ~20% in the least popular 10K
  CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka
     PII leakage share quoted separately for the 500K-1M band
  PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law
     policy-generator use and disclosure rates tabulated by rank group; generators used by less popular sites
  WWW/2025/harmful-terms-and-where-to-find-them-measuring-and-modeling-unfavorable-financia
     unfavorable financial terms more prevalent on less popular sites within the Tranco top 100K
  USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
     lower-ranked and unranked sites less susceptible than the Tranco top 1K
 
==========================================================================
10. RARE IN PRACTICE — site-level phenomena under 0.5%, in papers with n >= 200,000
==========================================================================
detection[].prevalence is free text. This is a PROBE, not an aggregate: it keeps
tuples whose prevalence string names a web unit and contains a percentage below
0.5, and prints them so each can be read. It is not a rate of anything.
 
papers in scope with n >= 200,000: 368
tuples kept: 21, across 21 papers
(run with --rare to print all of them)
 
==========================================================================
11. RESIDUES AND WHAT IS NOT COUNTED
==========================================================================
web-unit papers with NO stated size, excluded from this page: 32  2.8% of 1153
papers in scope with >=1 detection prevalence string: 1114  99.4%
prevalence strings in scope: 6203; naming a web unit: 1626 (26.2%); of those with a %: 837 (51.5%)
The 48.5% of unit-naming prevalence strings that carry no
parseable percentage, and the percentages that turn out to be false-positive
rates or classifier metrics rather than site shares,
are why no aggregate of prevalence-versus-n is published. An earlier draft
cross-tabulated them; it was dropped. See the provenance page.

Unedited output of node scripts/report_how_many_sites.mjs –sizing –ranktail –rare — every probe hit, in full, with its hand verdict:

report_how_many_sites-full-output.txt

==========================================================================
1. POPULATION — which papers this page is about
==========================================================================
corpus                                            5,859
drew >=1 web-unit population                      1,153  19.7% of corpus
PAGE POPULATION: ... and stated a size for one    1,121  97.2% of those
  ... of which also ran a crawl                   674  60.1%
  ... sampled the web without crawling            447  39.9%
web-unit population tuples in scope               2,484
  ... of those, with a stated size                2,379
 
==========================================================================
2. THE NUMBER — what sizes the field actually picks (paper-level, max stated web n)
==========================================================================
min 1  p25 1,000  median 20,000  p75 1,000,000  p90 7,341,165  max 250,000,000,000
 
-- the 12 most common values, papers of 1121 --
Largest stated web population  Papers  Share of 1121
-----------------------------  ------  -------------
1,000,000                      140     12.5%
10,000                         80      7.1%
100,000                        65      5.8%
100                            48      4.3%
1,000                          37      3.3%
500                            20      1.8%
20,000                         20      1.8%
5,000                          18      1.6%
50                             16      1.4%
20                             14      1.2%
200                            14      1.2%
10                             12      1.1%
 
sizes that are 1, 2 or 5 times a power of ten:  523  46.7%
exactly 1,000,000:                              140  12.5%
at or above 1,000,000:                          311  27.7%
at or below 1,000:                              302  26.9%
 
-- has the number grown? median largest stated web n, by four-year bucket --
Years       Papers  Median n  p75        n >= 1M  n <= 1,000
----------  ------  --------  ---------  -------  ----------
2010–2013   98      5,183     100,000    19.4%    37.8%
2014–2017   182     26,589.5  1,000,000  34.6%    29.7%
2018–2021   312     42,541.5  1,000,000  27.2%    21.8%
2022–2024   341     20,000    1,000,000  26.1%    25.8%
2025–2026*  188     20,000    1,000,000  29.3%    29.3%
* 2025-2026 is provisional: CCS/IMC 2026 have not been held and IEEE S&P/WWW 2026 are
  incompletely selected. See literature:corpus.
 
-- the same, crawling papers only --
Years       Crawling papers  Median n  n >= 1M
----------  ---------------  --------  -------
2010–2013   49               10,000    16.3%
2014–2017   115              18,000    25.2%
2018–2021   191              35,102    21.5%
2022–2024   208              13,795.5  19.2%
2025–2026*  111              20,000    24.3%
 
==========================================================================
3. WHAT SETS THE NUMBER — n by what the paper does to each site
==========================================================================
classification.method is a mid-band field (58% run-to-run agreement) and is
multi-valued, so a paper appears in every row whose method it uses. Read the
medians as a ranking, not as precise figures.
 
Per-site analysis method  Papers in scope  Median n  p25     p75
------------------------  ---------------  --------  ------  ---------
heuristic-rules           605              93,427    2,846   1,000,000
regex-or-signature        111              132,798   4,000   1,000,000
blocklist                 145              20,000    10,000  387,000
curated-database          228              93,283.5  3,806   1,000,000
third-party-service       271              100,000   7,337   1,000,000
supervised-ml             266              20,000    1,000   442,190
static-analysis           50               15,000    1,899   1,000,000
dynamic-analysis          66               74,215.5  5,000   1,000,000
manual-labelling          307              10,000    361     906,731
llm                       29               10,000    2,892   90,000
 
papers in scope with no classification tuple at all: 101, median n 3,000
 
-- LLM classification by bucket, because the population is small and new --
Years       LLM papers in scope  Median n  Non-LLM papers  Median n
----------  -------------------  --------  --------------  --------
2010–2013   0                    —         98              5,183
2014–2017   0                    —         182             26,589.5
2018–2021   0                    —         312             42,541.5
2022–2024   7                    10,000    334             20,000
2025–2026*  22                   10,500    166             20,000
 
==========================================================================
4. DOES ANYONE JUSTIFY THE NUMBER? — structured field
==========================================================================
papers running inference ('inferential')                     1,762
  ... with a statistics tuple of kind power-analysis         87  4.9%
      of those, recruited human participants                74  85.1%
      of those, ran a crawl                                 6
      of those, drew a web-unit population                  9
power-analysis papers inside this page's 1121-paper population  9
 
-- every power-analysis tuple in a paper INSIDE THIS PAGE'S POPULATION --
   (was: only the ones that also crawled. The page states a negative — no
    observational crawl sized from power — so the audit trail has to show
    every in-population paper the structured field returns, not a subset.)
  WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services   participants=0  max web n=1,073,642
     method: Chernoff Bounds
     detail: trust interval δ = 0.01; error probability λ = 0.01; sample n = 500
     quote : We set the trust interval δ = 0.01 and the error probability λ = 0.01 to obtain the number of sampled cloud directories n = 500.
  IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni   participants=0  max web n=1,980
     method: one-way independent ANOVA
     detail: power = 0.95; significance level = 0.05; assumed medium effect size f = 0.25
     quote : Our goal was to obtain a power of 0.95 at the significance level of 0.05 in a one-way independent ANOVA test
  USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish   participants=0  max web n=4,393
     method: Statistical power analysis
     detail: power 0.95; p-value 0.05; assumed medium effect size 0.25; later estimated effect size 0.36
     quote : To obtain a power of 0.95 at a p-value of 0.05, we initially assumed a medium effect size of 0.25.
  PETS/2021/managing-potentially-intrusive-practices-in-the-browser-a-user-centered-perspect   participants=2  max web n=16
     method: G*Power
     detail: At least 997 participants required for α = 0.05 and medium effect size 0.4.
     quote : We required at least 997 participants to achieve significance at α = 0.05 with a medium effect size (0.4).
  IMC/2022/what-factors-affect-targeting-and-bids-in-online-advertising-a-field-measurement   participants=2  max web n=10
     method: G*Power sample-size calculation
     detail: At least 126 participants for medium effects with 10 predictors
     quote : we calculated that we needed a sample size of at least 126 participants to detect medium effect sizes using a linear regression with 10 predictors
  PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing   participants=2  max web n=118,000
     method: point biserial model power analysis
     detail: All comparisons had >=80% power
     quote : A power analysis, using the point biserial model, strengthens this hypothesis, as all comparisons between conditions had ≥80% power.
  IEEE-SP/2016/sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-with-public   participants=0  max web n=8
     method: statistical power
     detail: all tests had statistical power of 0.98 or higher
     quote : Finally, we confirmed that all tests performed had a statistical power of 0.98 or higher
  NDSS/2025/the-kids-are-all-right-investigating-the-susceptibility-of-teens-and-adults-to-youtube-giveaway-scams   participants=2  max web n=451
     method: repeated measures ANOVA power analysis
     detail: effect size = 0.25, power = 0.95, α = 0.05, 2 measures, 12 groups, correlation = 0.5
     quote : This calculation used a repeated measures ANOVA model, assuming an effect size of 0.25, power = 0.95, α = 0.05, 2 measures, 12 groups ...
  IEEE-SP/2025/lets-get-visual-testing-visual-analogies-and-metaphors-for-conveying-privacy-pol   participants=4  max web n=10
     method: a priori power analysis; post-hoc power analyses
     detail: minimum N=357; initial N=428; lowest post-hoc power .72
     quote : An initial power analysis with the tool G*Power [78] suggested a minimum required sample size of N=357 participants
 
==========================================================================
5. DOES ANYONE JUSTIFY THE NUMBER? — full-text probe over the 1121 papers
==========================================================================
A sizing sentence is one sentence (<=400 chars, no terminal punctuation inside)
that contains ALL THREE of: sample-size / precision language, a web unit, and a
number. Text is whitespace-collapsed first, because a PDF line break inside a
phrase silently loses the match. paper.cols.txt is read, not paper.norm.txt.
 
papers with >=1 sizing sentence: 26  2.3% of 1121
hand-read: 26 of 26
 
Verdict after reading the sentence                          Papers  Share of 1121
----------------------------------------------------------  ------  -------------
derives n from a precision or power requirement             6       0.5%
argues the size from design or cost, without a calculation  5       0.4%
names a size and gives no argument for it                   1       0.1%
not about sizing a web population                           14      1.2%
 
-- the derives-n papers, and what the calculation sized --
  CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web
     n stated for the web population: 6,558
     sized a 363-site manual-inspection subsample from a 95% confidence requirement
  WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide
     n stated for the web population: 1,000,000
     sized a 2,000-site subsample from a stated margin of error
  IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
     n stated for the web population: 1,980
     384 phishing sites per arm from an ANOVA power calculation
  USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish
     n stated for the web population: 4,393
     deployment size from a power calculation; also reports the achieved effect size
  PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation
     n stated for the web population: 100,000
     383 sites hand-inspected, sized for 100K at +-5% margin of error
  USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking
     n stated for the web population: 5,000
     272 of 933 sites hand-inspected, sized for 95%/+-5%
 
of the 6 derives-n papers, 4 size a HAND-CHECKED SUBSAMPLE
rather than the crawl itself; 2 size the measured population.
 
==========================================================================
5b. EVERY SIZING-SENTENCE HIT, IN FULL
==========================================================================
 
### CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web   n=6,558   [derives-n] sized a 363-site manual-inspection subsample from a 95% confidence requirement
    To that ef- fect we selected a statistically significant (95% confidence interval) random sample of 363 websites for manual inspection.
 
### IEEE-SP/2014/hunting-the-red-fox-online-understanding-and-detection-of-mass-redirect-script-i   n=1,558,690   [not-sizing] dropped groups with <10 URLs; a filtering threshold, not a sample size
    To avoid drawing any conclusion based upon such a small sample size, we ignored those with less than 10 unique URLs, which left us 213 types.
 
### IMC/2014/censorship-in-the-wild-analyzing-internet-filtering-in-syria   n=28   [not-sizing] CI width on a proportion in an already-collected 32M-request dataset
    2), requests from the same user accessing the same URL), some are for a sample size of n = 32M, the actual proportion in the full consistently denied, while others are sometimes or always allowed.
 
### WWW/2016/remedying-web-hijacking-notification-effectiveness-and-webmaster-comprehension   n=313,190   [not-sizing] "largest studied to date" — a scale boast
    Second, our coverage of hijacked websites is biased towards threats caught by Google's pipelines, though we still capture a sample size of 760,935 incidents, the largest studied to date.
 
### IMC/2017/email-typosquatting   n=1,000,000   [not-sizing] CI on an extrapolated email volume, not on a sample size
    Our model finds that the 1,211 typosquatting domains registered by others should receive approximately 260,514 emails per year, with a 95% confidence interval ranging between 22,577 and 905,174 emails per year.
 
### WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide   n=1,000,000   [derives-n] sized a 2,000-site subsample from a stated margin of error
    We then selected a ran- (48.0%) of the reachable home pages (N = 9, 159) do not domized sample of 2,000 websites (margin of error = 2.19%) support HTTPS at all even though this analysis is based to represent the 1M sample, and we used the represented on the top 10K popular websites; only 24.7% provide secure sample to compare with the 10K websites.
 
### IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking   n=87,000,000   [design-reason] empirical saturation: resampled 500 combinations at varying sizes to see when a block page stops appearing
    From each set of samples, we then selected 500 random combinations of different sample sizes to detect how many combinations would not yield a block page.
 
### IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni   n=1,980   [derives-n] 384 phishing sites per arm from an ANOVA power calculation
    Sample Size Selection For our full tests, we chose a sample size of 384 phishing sites for each entity.
    All sites ultimately delivered 100% uptime during deployment, thus we ended up with an effective sample size of 396 per experiment.
 
### IMC/2019/a-longitudinal-analysis-of-the-ads-txt-standard   n=240,000   [not-sizing] the population grew because the standard was adopted; no calculation
    Subsequently, our sample size grew from 100K websites on January 15, 2018 to 240K on April 1, 2019.
 
### WWW/2019/auditing-the-partisanship-of-google-search-snippets   n=541,437   [not-sizing] a >100 threshold for including a website in a per-site test
    For each website that had a sample size >100, we use the Wilcoxon V signed-rank test to compare the snippets' Γ scores and webpages' Γ scores, and further applied a Boneferroni correction for multiple hypothesis testings.
 
### PETS/2020/enhanced-performance-and-privacy-for-tls-over-tcp-fast-open   n=1,000,000   [states-only] names a 30,000-hostname subsample of the Alexa top million with no derivation
    Based upon a sample size of approx. 30 000 hostnames within the Alexa Top Million Sites, we then investigate to which extent changing server IP addresses affects the performance gains achievable by TFO.
 
### USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish   n=4,393   [derives-n] deployment size from a power calculation; also reports the achieved effect size
    Despite our relatively large sample size for each deployment, we do not believe that the volume of URLs we reported hampered the anti-phishing ecosystem's 392 29th USENIX Security Symposium ability to mitigate real threats.
 
### IMC/2021/web-censorship-measurements-of-http-3-over-quic   n=4,000   [not-sizing] a table fragment: per-country replication counts after validation filtering
    ations, TLS-hs-to overall Hosts Sample Size* China VPS, 69, 37.3% 25.9% 2.7% - (45090) 102 6706 Iran VPS, 36, 34.4% - 33.4% - - (62442) 120 3887 India PD, 2, 15.0% 7.5% - 4.5% (55836) 133 266 India VPS, 60, 16.3% - - - (14061) 133 7531 India PD, 1, 12.8% - - - (38266) 133 133 Kazakhstan VPN, 22, 3.2% - 3.2% - (9198) 82 1764 * final sample size of all replications after validation step filtering (c.
 
### WWW/2021/its-not-just-the-site-its-the-contents-intra-domain-fingerprinting-social-media   n=120,000   [not-sizing] a figure caption about confidence intervals on burst sizes
    5 244 22 Burst 4 242 Burst 4 20 240 0.4 238 1 2 Burst 3 Burst Index Burst Index 0.3 44 Amount of Transmitted Data Per Burst (MB) Amount of Transmitted Data Per Burst (MB) Burst 3 300 Burst 2 42 297.5 0.2 40 295 292.5 38 Burst 1 290 0.1 36 287.5 285 34 282.5 3 4 0.0 0.0 0.5 1.0 1.5 2.0 Burst Index Burst Index Web Page Loading Time (seconds) (d) Visualized the CDN bursts with 95% confidence interval.
 
### WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web   n=1,000,000   [design-reason] 4,000 sites as 1,000 from each rank magnitude band — a stratification argument
    Our subset of sites for this crawl consisted of the top 1000 sites, along with a random sample of 1000 sites from each of the top 10K, top 100K, and top 1M, for a total sample size of 4000 websites.
 
### IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web   n=1,000,000   [design-reason] calls n=10,000 "conservative"; asserted, not derived
    We note that di�erent per-platform usage rates dataset of ranked lists does not provide raw tra�c volume to each site, we instead set of incognito mode (which is not captured in Chrome telemetry) a conservative sample size of # = 10, 000 (the number of sites under consideration).
 
### USENIX/2022/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement   n=567   [design-reason] reduced the domain set citing diminishing returns and minimising risk
    Given our ethical goal to minimize risk combined 31st USENIX Security Symposium 455 with the likelihood of diminishing returns [31], we selected a shift would move an experiment into the consistency state, subset of domains from this list spread across categories.
 
### WWW/2022/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps   n=231,449   [not-sizing] a 100-site verification subsample described as limited; no calculation
    We manually verify our government website dataset (with a limited sample size of 100, selected randomly) to ensure false positives are eliminated.
 
### CCS/2023/read-between-the-lines-detecting-tracking-javascript-with-bytecode-classificatio   n=50,000   [not-sizing] explains a recall difference by a smaller training set
    Bytecode classification using D3 dataset had lower recall compared to D1 and D2 datasets, which can be attributed to the smaller sample size due to only processing 1,500 websites.
 
### PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation   n=100,000   [derives-n] 383 sites hand-inspected, sized for 100K at +-5% margin of error
    We excluded a total of 117 websites and manually inspected 383 websites, which is a statistically significant sample size for 100K websites with ± 5% margin of error [16].
 
### USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking   n=5,000   [derives-n] 272 of 933 sites hand-inspected, sized for 95%/+-5%
    To further confirm our results for AutoFR and EasyList, we randomly selected 272 sites (a sample size out of 933 sites to get a confidence level of 95% with a 5% confidence interval), and we visually inspected them.
 
### WWW/2024/a-study-of-gdpr-compliance-under-the-transparency-and-consent-framework   n=2,230   [not-sizing] a caveat that one rank band had too few domains
    domains ranked between 2,000 and 4,000 which suffered from a Thus, TCF non-compliance is not only occurring on small domains small sample size).
 
### WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari   n=200,000   [design-reason] a fixed 10,000-per-country target, met by descending the ranking
    However, for countries such as Bangladesh, Pakistan, Nigeria, and the Philippines, less popular websites were included to meet the target sample size of 10,000 websites per country.
 
### USENIX/2025/websites-global-privacy-control-compliance-at-scale-and-over-time   n=42,312   [not-sizing] CI on an estimate derived from an already-fixed population
    Based on this calculation we estimate that 4,465-5,929 of the 9,578 sites, 47-62% according to the 95% confidence interval, that had a request from an SAFG service in December 2023 also meet the traffic requirement per §3.2.
 
### PETS/2025/understanding-regional-filter-lists-efficacy-and-impact   n=10,000   [not-sizing] diminishing returns of larger filter-rule sets, not of more sites
    Proceedings on Privacy Enhancing Technologies 2025(2) Larger rule sets offer diminishing returns, increasing runtime, and resource usage without proportionate benefits in blocked URLs.
 
### PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc   n=924   [not-sizing] a robustness remark about variation in sample size
    1) examined whether Guard MV3, Stands MV2, Stands MV3, uBlock MV2, uBlock our findings hold despite variations in sample size and website se-MV3) with the number of websites (924) yields the number lection.
 
==========================================================================
6. ARITHMETIC (not a corpus measurement) — precision on a prevalence
==========================================================================
Wald half-width of a 95% interval on a proportion: 1.96*sqrt(p(1-p)/n).
Nothing about the web is in this table; it is here so the page can be checked.
 
n          p = 0.5    p = 0.2    p = 0.05   p = 0.01    p = 0.001
---------  ---------  ---------  ---------  ----------  ----------
100        +-9.80 pp  +-7.84 pp  +-4.27 pp  +-1.950 pp  +-0.619 pp
1,000      +-3.10 pp  +-2.48 pp  +-1.35 pp  +-0.617 pp  +-0.196 pp
10,000     +-0.98 pp  +-0.78 pp  +-0.43 pp  +-0.195 pp  +-0.062 pp
100,000    +-0.31 pp  +-0.25 pp  +-0.14 pp  +-0.062 pp  +-0.020 pp
1,000,000  +-0.10 pp  +-0.08 pp  +-0.04 pp  +-0.020 pp  +-0.006 pp
 
-- n needed for a given half-width at p = 0.5, the worst case --
Target half-width  n needed
-----------------  --------
+-5.0 pp           385
+-3.0 pp           1,068
+-1.0 pp           9,604
+-0.3 pp           106,712
+-0.1 pp           960,400
 
==========================================================================
7. ARITHMETIC (not a corpus measurement) — capturing a rare thing
==========================================================================
Expected count is n*p. P(at least one) = 1-(1-p)^n. The n for a 95% chance of
seeing at least one is ceil(ln(0.05)/ln(1-p)), which is about 3/p. If you see
zero in n trials, the 95% upper bound on p is about 3/n (the rule of three).
 
Prevalence p  Expected hits at n=10,000  at n=100,000  at n=1,000,000  n for P(>=1 hit) >= 95%  n for a +-20% relative CI
------------  -------------------------  ------------  --------------  -----------------------  -------------------------
10%           1000.00                    10000.0       100000          29                       865
1%            100.00                     1000.0        10000           299                      9,508
0.1%          10.00                      100.0         1000            2,995                    95,944
0.01%         1.00                       10.0          100             29,956                   960,304
0.001%        0.10                       1.0           10              299,572                  9,603,904
 
-- what a zero buys you: 95% upper bound on p after seeing no hits in n --
n with zero hits  95% upper bound on p  i.e. at most ... sites in a million
----------------  --------------------  -----------------------------------
100               3.0000%               30,000
1,000             0.3000%               3,000
10,000            0.0300%               300
100,000           0.0030%               30
1,000,000         0.0003%               3
 
==========================================================================
8. ARITHMETIC (not a corpus measurement) — sites are not independent draws
==========================================================================
Design effect for equal clusters of size m with intra-class correlation rho:
deff = 1 + (m-1)*rho, and the effective sample size is n/deff. The ICC of any
real web-measurement outcome has never been measured (see the open question on
statistics:hypothesis_testing), so these rho values are illustrative, chosen to
match the sweep published on that page.
 
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              1.2x        1.4x        2.8x
100             3.0x        6.0x        20.8x
1,000           21.0x       51.0x       200.8x
 
-- effective n for a 1,000,000-site crawl --
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              847,458     689,655     357,143
100             335,570     168,067     48,077
1,000           47,664      19,627      4,980
 
-- half-width on p=0.05 at n=1,000,000 once deflated --
Cluster size m  rho = 0.02  rho = 0.05  rho = 0.20
--------------  ----------  ----------  ----------
10              +-0.046 pp  +-0.051 pp  +-0.071 pp
100             +-0.074 pp  +-0.104 pp  +-0.195 pp
1,000           +-0.196 pp  +-0.305 pp  +-0.605 pp
 
==========================================================================
9. THE RANK TAIL — papers reporting the same measurement per rank band
==========================================================================
Probe: one sentence containing a rank band, a phrase comparing across rank, and
a percentage. Whitespace-collapsed. Every hit is printed with --ranktail; the
count is not the claim.
 
papers with >=1 rank-band sentence: 28  2.5% of 1121
after reading: 19 report a measurement per rank band; 9 are a long tail of something else
 
  IMC/2015/neither-snow-nor-rain-nor-mitm-an-empirical-analysis-of-email-delivery-security
     TLS support lags in the long tail of 700,000 SMTP servers behind the Alexa top million
  USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
     Wayback coverage better for more popular trackers: 75% of the top 100 against 53% of all
  IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking
     Luminati-protected domains 0.05% of the wide sample against 0.2% of the Alexa top 10K
  USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account
     SSO support higher in more popular sites, 10.8% coverage in the top 100K
  CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web
     CA market share RISES down the ranking: 5% of top 1K, 20% of top 100K, 35% of top 1M
  PETS/2019/a-quic-look-at-web-tracking
     QUIC support at six nested depths: 21.00% (top 100) down to 0.02% (top 1M)
  WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading
     dependency chains marginally more common in more popular sites (55% in the top 10K)
  IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne
     third-party CA use 71% in top-100 against 77% in top-100K
  IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio
     valid HTTPS on government sites ~30% in the top million and in the long tail alike — FLAT
  IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment
     security.txt adoption FALLS down the ranking: 3-4% of top 10K, ~1% of top 100K
  WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web
     Server-Sent Events on 0.4% of the top thousand against 0.05% of the top million — an 8x head/tail gap
  IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web
     category mix shifts across the ranking: News & Media above 15% of top-50 sites and dropping
  CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security
     archive hit rate plotted across Tranco rank buckets — the tail is less archived
  USENIX/2023/a-large-scale-measurement-of-website-login-policies
     BOTH directions in one paper: cleartext password submission 0.44%/0.50%/0.62% rising across top 10K/100K/1M, rate limiting 33.6%/26.7%/24.1% falling
  USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting
     DMARC misconfiguration ~10% in the most popular 10K against ~20% in the least popular 10K
  CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka
     PII leakage share quoted separately for the 500K-1M band
  PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law
     policy-generator use and disclosure rates tabulated by rank group; generators used by less popular sites
  WWW/2025/harmful-terms-and-where-to-find-them-measuring-and-modeling-unfavorable-financia
     unfavorable financial terms more prevalent on less popular sites within the Tranco top 100K
  USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
     lower-ranked and unranked sites less susceptible than the Tranco top 1K
 
==========================================================================
9b. EVERY RANK-BAND HIT, IN FULL
==========================================================================
 
### WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod  n=115,706  [not-rank] long tail of vulnerable applications, not of site rank
    It is interesting to observe that even though a relatively high detection rate can be achieved with a small number of applications (about 90% with the top 5 applications), the detection curve is characterized by a long tail (one would have to install 22 applications to achieve 98% of detection).
 
### IMC/2011/towards-understanding-modern-web-traffic  n=1,197  [not-rank] a figure fragment about URL popularity distributions
    .4 2008 86 2010 2010 % Requests % Requests 0.2 0.3 84 82 0.2 0.1 80 US 0.1 CN 78 FR BR 0 0 76 0 1 2 3 4 5 0 1 2 3 4 5 10 10 10 10 10 10 10 10 10 10 10 10 2006 2008 2010 URL Ranking URL Ranking Year (a) US: Top 100K URLs by % requests (b) CN: Top 100K URLs by % requests (c) % accessed once URLs (tail) Figure 12: URL popularity: The popular URLs grow, but the long tail of the content is also growing.
 
### IMC/2015/neither-snow-nor-rain-nor-mitm-an-empirical-analysis-of-email-delivery-security  n=1,000,000  [per-band] TLS support lags in the long tail of 700,000 SMTP servers behind the Alexa top million
    However, such best practices continue to lag for the long tail of 700,000 SMTP servers associated with the Alexa Top Million: only 82% support TLS, of which a mere 35% are properly configured to allow server authentication.
 
### IMC/2015/who-is-com-learning-to-parse-whois-records  n=102,077,202  [not-rank] long tail of WHOIS service names
    Although there is a long tail of service names, the top 10 account for 73% of protected domains.
 
### IMC/2016/characterizing-website-behaviors-across-logged-in-and-not-logged-in-users  n=345  [not-rank] long tail of FQDNs within the data, not a rank band
    Limiting to the top 80% also ensures we could focus on categorizing the most prevalent FQDNs while avoiding the very long tail of FQDNs that were not frequently encountered.
 
### USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w  n=500  [per-band] Wayback coverage better for more popular trackers: 75% of the top 100 against 53% of all
    In general, more popular trackers are better represented in Wayback data: 75% of the top 100 live trackers, compared to 53% of all live trackers.
 
### CCS/2018/measuring-information-leakage-in-website-fingerprinting-attacks-and-defenses  n=2,000  [not-rank] a figure fragment: top-100 most informative FEATURES by rank
    Top 100 Most Informative Features (indexed by rank) Category Index (a) (b) 8 INFORMATION LEAKAGE IN WF DEFENSES Figure 9: Information Leakage Measurement Validation: 90% This section firstly gives the theoretical analysis on why accuracy Confidence Interval for the Measurement is not a reliable metric to validate a WF defense.
 
### IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking  n=87,000,000  [per-band] Luminati-protected domains 0.05% of the wide sample against 0.2% of the Alexa top 10K
    This is only 0.05% of our sample, compared to 0.2% of Alexa Top 10K domains, indicating that more popular websites are more Total 5,462 238 (4.4%) protected by Luminati.
 
### USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account  n=1,000,000  [per-band] SSO support higher in more popular sites, 10.8% coverage in the top 100K
    We find that more popular websites are more likely to support SSO, as shown in Figure 4, with a 10.8% coverage in the top 100K, Cascading account compromise.
 
### CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web  n=223,000,000  [per-band] CA market share RISES down the ranking: 5% of top 1K, 20% of top 100K, 35% of top 1M
    The CA's market Let's Encrypt has seen rapidly growing adoption among top share increases as site popularity decreases: 5% of the top 1K, 20% million sites since its launch, while most other CAs have not (Figof the top 100K, and 35% of the top 1M sites with HTTPS use Let's ure 4b).
 
### PETS/2019/a-quic-look-at-web-tracking  n=1,000,000  [per-band] QUIC support at six nested depths: 21.00% (top 100) down to 0.02% (top 1M)
    However, this share decreases for larger Top Alexa lists to only 0.0186% within the Alexa Top 1 Million.
 
### WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading  n=200,000  [per-band] dependency chains marginally more common in more popular sites (55% in the top 10K)
    It The propensity to form dependency chains is marginally higher has been commonly used in the academic literature to detect ma- in more popular websites; for example, 55% in the Alexa top 10K licious apps, executables, software and domains [7, 11, 13, 16, 17].
 
### WWW/2019/unnecessarily-identifiable-quantifying-the-fingerprintability-of-browser-extensi  n=50  [not-rank] popularity bands of browser EXTENSIONS, not of websites
    bloat with more than 9% of the top 5K extensions containing bloat, and approximately 4% of the less popular extensions.
 
### IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne  n=100,000  [per-band] third-party CA use 71% in top-100 against 77% in top-100K
    The use of third party CAs is also higher (77% in top-100K) in less popular websites as compared to more popular (71% in top-100) websites.
 
### IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio  n=135,408  [per-band] valid HTTPS on government sites ~30% in the top million and in the long tail alike — FLAT
    not representative of the world, both having high human develop-Though ranking does have an effect, overall valid https use ment index scores (USA:15, ROK:22) and Internet adoption rates in government websites in the top million is similar to results (USA:90%, ROK:96%), among other unique factors, their relative in the long tail dataset, at ∼30%.
 
### IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment  n=100,000  [per-band] security.txt adoption FALLS down the ranking: 3-4% of top 10K, ~1% of top 100K
    We observe a higher adoption rate for higher-ranked percentage decreases to 3-4% for the top 10K sites, and only a per- websites, aligning with our observation that higher-ranked sites cent for the top 100K.
 
### PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  n=5,506,818  [not-rank] a figure-legend fragment; the comparison is not in the sentence
    CNAME-cloaking publisher domains in Tranco top 10k Less popular trackers in Tranco top 10k Change in # publishers 20% the list of IPs we found in October through a scan with zdns.
 
### WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web  n=1,000,000  [per-band] Server-Sent Events on 0.4% of the top thousand against 0.05% of the top million — an 8x head/tail gap
    Higher-ranked sites more commonly use polling, with 19.8% of the top thousand sites leveraging the technique compared to 9.2% of sites in the top million.
    We find them in use on only 0.4% of the top thousand and 0.05% of websites in the top million.
 
### IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web  n=1,000,000  [per-band] category mix shifts across the ranking: News & Media above 15% of top-50 sites and dropping
    government services (26), and then a long tail of other types of sites Other categories are disproportionately represented in the middle that include gig economy (3), EdTech (6), ISPs and telecoms (9, 4 of of the range: News & Media peaks above 15% of top-50 sites and which provide TV service and 2 of which provide email), and job drops to less than 7% of top-10K sites.
    Top million lists capture well the vast majority of user tra�c (⇡95%), but studies that focus on the top million sites evenly are skewed heavily towards the long tail of the web.
 
### IMC/2022/toppling-top-lists-evaluating-the-accuracy-of-popular-website-lists  n=1,000,000  [not-rank] measures the ACCURACY OF THE LIST by rank bucket, not a web phenomenon per band
    For instance, of the 1,790 domains we measure in the Alexa top 10K, 70% of them are ranked by Cloud�are in a lower rank-magnitude bucket, and 27.2% of them are ranked by Cloud�are in a bucket two or more orders of magnitude less popular.
    The CrUX list much more closely approximates the Cloud�are list by rank-magnitude movement: 47.1% of the 1410 domains in the CrUX top 10K are overranked compared to Cloud�are, and only 1% of them are overranked by two or more orders of magnitude.
 
### CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security  n=20,000  [per-band] archive hit rate plotted across Tranco rank buckets — the tail is less archived
    The only archive able to provide 3172 ACM CCS, November 26-30, 2023, Copenhagen Internet Archive Archive-It Arquivo Congress 100% 75% Hits 50% 25% 0% 100k 200k 300k 400k 500k 600k 700k 100% 75% Fresh Hits 50% 25% 0% Rank bucket Figure 3: Hit rates across popularity buckets fresh hits for a significant number of domains across the Tranco top 1M is again the IA.
 
### USENIX/2023/a-large-scale-measurement-of-website-login-policies  n=1,000,000  [per-band] BOTH directions in one paper: cleartext password submission 0.44%/0.50%/0.62% rising across top 10K/100K/1M, rate limiting 33.6%/26.7%/24.1% falling
    As with HTTP-only login pages, we see a slight increase in HTTP password submission for lower-ranked: 0.44% of top 10K domains transmitted passwords in the clear, compared to 0.50% of top 100K domains and 0.62% of top 1M domains.
    Among domains successfully analyzed, we observe that rate limiting logins was more prevalent amongst higher-ranked domains; 33.6% of the domains in the top 10K and 26.7% of domains in the top 100K demonstrated rate limiting, compared to the 24.1% for domains in the top 1M.
 
### USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting  n=384,000,000  [per-band] DMARC misconfiguration ~10% in the most popular 10K against ~20% in the least popular 10K
    Interestingly, we also observe an increasing trend of such misconfiguration as the ranking increases; for example, almost 20% of the least 10K popular Alexa top-1M domains with DMARC that use external domains are misconfigured compared to about 10% for the most 10K popular domains.
 
### CCS/2025/piixel-leaks-passive-identification-of-personally-identifiable-information-leaka  n=1,000,000  [per-band] PII leakage share quoted separately for the 500K-1M band
    The adoption rates follow a clear declining trend as website popularity decreases, starting at approximately 23% for the most popular sites (0-10K) and dropping to 17.24% for less popular sites (500K-1M).
 
### PETS/2026/overcoming-language-barriers-multilingual-analysis-of-the-2023-swiss-privacy-law  n=90,000  [per-band] policy-generator use and disclosure rates tabulated by rank group; generators used by less popular sites
    Moreover, generators are mostly used by less popular websites, with less than 5% of the policies from Top 5k websites indicating use.
    .0% 52.6% 69.5% hum 34.6% 14.9% 22.6% 13.9% Average 74.7% 79.0% 67.3% 72.9% Total policies 1061 47 6224 1000 Proceedings on Privacy Enhancing Technologies 2026(4) Top 100k+ rank No generator Generator used 76.1% 89.3% 98.7% 100.0% 77.4% 82.1% 79.9% 82.2% 55.8% 67.7% 52.2% 67.1% 20.1% 16.3% 65.7% 72.1% 5028 973 Table 21: Disclosure rates per obligation by rank group and generator use (October 2023).
 
### WWW/2025/harmful-terms-and-where-to-find-them-measuring-and-modeling-unfavorable-financia  n=100,000  [per-band] unfavorable financial terms more prevalent on less popular sites within the Tranco top 100K
    When applied to shopping websites from the Tranco top 100K, we find that 42.06% of these sites contain at least one unfavorable financial term, with such terms being more prevalent on less popular websites.
 
### IMC/2025/towards-a-non-binary-view-of-ipv6-adoption  n=100,000  [not-rank] long tail of third-party DOMAINS to fix, not a rank band of sites
    The distribution exhibits a long tail: enabling IPv6 on just the top 500 (3.3%) IPv4-only third-party domains would allow over 25% of IPv6-partial websites to become IPv6-full.
 
### USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web  n=18,000,000  [per-band] lower-ranked and unranked sites less susceptible than the Tranco top 1K
    Figure 8b reveals a different picture: lower-ranked sites and even unranked ones are less susceptible than higher-ranked sites in 100% -5% the Tranco top 1k.
 
==========================================================================
10. RARE IN PRACTICE — site-level phenomena under 0.5%, in papers with n >= 200,000
==========================================================================
detection[].prevalence is free text. This is a PROBE, not an aggregate: it keeps
tuples whose prevalence string names a web unit and contains a percentage below
0.5, and prints them so each can be read. It is not a rate of anything.
 
papers in scope with n >= 200,000: 368
tuples kept: 21, across 21 papers
  2015 USENIX/2015/cookies-lack-integrity-real-world-implications  n=961,857
     Secure cookies over HTTP :: 152 of 48,039 responding domains (0.32%)
  2016 CCS/2016/predator-proactive-recognition-and-elimination-of-domain-abuse-at-time-of-regist  n=12,824,401
     Malicious .net domains :: 61% detection rate on .net domains under a 0.35% false positive rate
  2016 IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates  n=286,788,250
     non-secure DNS dynamic updates :: 1,877 (0.065%) of the random sample and 587 (0.062%) of Alexa top 1 million domains
  2017 IMC/2017/millions-of-targets-under-attack-a-macroscopic-characterization-of-the-dos-ecosy  n=210,000,000
     attack intensity and migration delay :: 98.6% of top-0.1% intensity websites migrated within six days
  2017 IMC/2017/mission-accomplished-https-security-after-diginotar  n=193,000,000
     HPKP deployment and validity :: 6181 domains (0.02%); 86.0% use HPKP correctly
  2017 IMC/2017/understanding-the-role-of-registrars-in-dnssec-deployment  n=118,147,199
     Registrar policy over time :: PCExtreme increased from 0.44% to 98.3% DNSSEC-enabled domains in 10 days.
  2018 CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense  n=1,000,000
     drive-by cryptocurrency mining :: 1,735 websites (0.18%)
  2018 IMC/2018/a-first-joint-look-at-dos-attacks-and-bgp-blackholing-in-the-wild  n=228,100,000
     Services in blackholed prefixes :: 0.33% of websites, 0.40% of MX names, and 0.13% of NS names
  2018 IMC/2018/digging-into-browser-based-crypto-mining  n=137,000,000
     browser-based mining prevalence :: less than 0.08% of probed sites
  2018 IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri  n=4,599,802
     malicious re-registrations :: 0.4 % of domains re-registered with a delay of 0 s were labelled malicious; fewer than 0.5 % overall.
  2018 IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild  n=657,663
     squatting phishing pages :: 1,175 confirmed domains, approximately 0.2% of 657,663 domains.
  2019 PETS/2019/a-quic-look-at-web-tracking  n=1,000,000
     QUIC server deployment :: 186 websites in the Alexa Top Million supported QUIC; 0.02% in the Top 1M.
  2019 USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking  n=48,948,669
     Internet-wide cryptojacking prevalence :: 0.011% of all domains, or one in 9,090 websites
  2019 USENIX/2019/protecting-accounts-from-credential-stuffing-with-password-breach-alerting  n=746,853
     breached-credential reuse by domain category :: 0.2–0.3% for finance and government; 3.6–6.3% for entertainment and adult sites
  2019 WWW/2019/who-watches-the-watchmen-exploring-complaints-on-the-web  n=1,054,248,823
     Domain content replicas :: Fewer than 0.01% of domains have any replicas
  2021 WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web  n=1,000,000
     Server-Sent Events :: 0.4% of the top thousand and 0.05% of websites in the top million
  2022 IMC/2022/zdns-a-fast-dns-toolkit-for-internet-measurement  n=234,531,389
     CAA tag configuration :: 459 domains (0.04%) are configured with invalid tags
  2022 USENIX/2022/a-large-scale-and-longitudinal-measurement-study-of-dkim-deployment  n=3,627,871
     Insecure l= tags :: 6,860 domains (0.3%)
  2023 IMC/2023/ecn-with-quic-challenges-in-the-wild  n=183,280,000
     QUIC ECN validation :: less than 2% of QUIC hosts, providing less than 0.3% of HTTP/3 websites, pass validation
  2026 PETS/2026/cryptographically-secured-domain-validation  n=400,800,000
     CAA and DNSSEC readiness :: 689.3K domains (0.34%)
  2026 NDSS/2026/phishlang-a-real-time-fully-client-side-phishing-detection-framework-using-mobilebert  n=42,700,000
     phishing websites in live stream :: 25,796 phishing URLs out of 42.7M domains (0.057%)
 
==========================================================================
11. RESIDUES AND WHAT IS NOT COUNTED
==========================================================================
web-unit papers with NO stated size, excluded from this page: 32  2.8% of 1153
papers in scope with >=1 detection prevalence string: 1114  99.4%
prevalence strings in scope: 6203; naming a web unit: 1626 (26.2%); of those with a %: 837 (51.5%)
The 48.5% of unit-naming prevalence strings that carry no
parseable percentage, and the percentages that turn out to be false-positive
rates or classifier metrics rather than site shares,
are why no aggregate of prevalence-versus-n is published. An earlier draft
cross-tabulated them; it was dropped. See the provenance page.

hms_quotecheck.py

#!/usr/bin/env python3
"""Quote check for statistics:how_many_sites.
 
Every quotation the page publishes is listed here with the paper it is
attributed to. The check is done on WHITESPACE-COLLAPSED text, because a PDF
line break inside a phrase makes an exact search fail for no good reason, and
against paper.cols.txt (the repaired column reading order), never paper.norm.txt.
 
A quote that fails the exact test is retried as a set of five-word windows, and
the share of windows found is printed, so a two-column splice shows up as a
partial rather than as an absence.
 
    python3 scripts/hms_quotecheck.py
"""
import os
import re
import sys
 
ROOTS = ["/workspace/publications_dataset/data", "/workspace/publications_dataset"]
ROOT = next(r for r in ROOTS if os.path.isdir(os.path.join(r, "fulltext")))
 
# (paper key, the phrase as the page prints it)
QUOTES = [
    ("WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services",
     "to obtain the number of sampled cloud directories n = 500"),
    ("IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni",
     "we chose a sample size of 384 phishing sites for each entity"),
    ("IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni",
     "Our goal was to obtain a power of 0.95 at the significance level of 0.05 in a one-way independent ANOVA test"),
    ("IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni",
     "All sites ultimately delivered 100% uptime during deployment, thus we ended up with an effective sample size of 396 per experiment"),
    ("USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish",
     "To obtain a power of 0.95 at a p-value of 0.05, we initially assumed a medium effect size of 0.25"),
    ("PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation",
     "manually inspected 383 websites, which is a statistically significant sample size for 100K websites"),
    ("USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking",
     "we randomly selected 272 sites (a sample size out of 933 sites to get a confidence level of 95% with a 5% confidence interval)"),
    ("CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense",
     "1,735 websites"),
    ("PETS/2019/a-quic-look-at-web-tracking",
     "We found 186 websites within the Alexa Top Million that support the QUIC protocol"),
    ("PETS/2019/a-quic-look-at-web-tracking",
     "Alexa Top 10 20.00% Alexa Top 100 21.00% Alexa Top 1K 8.10% Alexa Top 10K 1.69% Alexa Top 100K 0.19% Alexa Top 1M 0.02%"),
    ("PETS/2019/a-quic-look-at-web-tracking",
     "this share decreases for larger Top Alexa lists to only 0.0186% within the Alexa Top 1 Million"),
    ("WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web",
     "a random sample of 1000 sites from each of the top 10K, top 100K, and top 1M, for a total sample size of 4000 websites"),
    ("CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web",
     "5% of the top 1K, 20%"),
    ("USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking",
     "meaning that one in every 9,090 websites is cryptojacking"),
    ("USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking",
     "In the Alexa Top 1M, 0.065% of the websites was actively cryptojacking, in this random sample only 0.011% of the websites, which is almost 6 times lower"),
    ("USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting",
     "increasing trend of such misconfiguration as the ranking increases"),
    ("IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment",
     "higher adoption rate for higher-ranked"),
    ("USENIX/2022/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement",
     "the likelihood of diminishing returns"),
    ("WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari",
     "less popular websites were included to meet the target sample size of 10,000 websites per country"),
    ("CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security",
     "Hit rates across popularity buckets"),
    ("IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web",
     "a conservative sample size of"),
    ("IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates",
     "We analyze a random sample of 2.9 million domains and the Alexa top 1 million domains and find that at least 1,877 (0.065%) and 587 (0.062%) of domains are vulnerable, respectively"),
    ("IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment",
     "This percentage decreases to 3-4% for the top 10K sites, and only a percent for the top 100K"),
    ("IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne",
     "The use of third party CAs is also higher (77% in top-100K) in less popular websites as compared to more popular (71% in top-100) websites"),
    ("USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting",
     "almost 20% of the least 10K popular Alexa top-1M domains with DMARC that use external domains are misconfigured compared to about 10% for the most 10K popular domains"),
    ("WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web",
     "We find them in use on only 0.4% of the top thousand and 0.05% of websites in the top million"),
    ("CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense",
     "1,735 websites"),
    ("USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w",
     "more popular trackers are better represented in Wayback data"),
    ("USENIX/2023/a-large-scale-measurement-of-website-login-policies",
     "0.44% of top 10K domains transmitted passwords in the clear, compared to 0.50% of top 100K domains and 0.62% of top 1M domains"),
    ("USENIX/2023/a-large-scale-measurement-of-website-login-policies",
     "33.6% of the domains in the top 10K and 26.7% of domains in the top 100K demonstrated rate limiting, compared to the 24.1% for domains in the top 1M"),
    # This paper's sentence is spliced by the two-column reading order; the page
    # quotes only the two intact fragments and paraphrases the join.
    ("IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio",
     "Though ranking does have an effect, overall valid https use"),
    ("IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio",
     "in the long tail dataset, at"),
    # Added after the citations review: the ANALYSED n of each rare-event row.
    ("CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense",
     "we managed to crawl 991,513 of them"),
    ("IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates",
     "From the total 286,788,250 unique domains in the set, we randomly sampled 1%"),
    ("IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates",
     "1% Sample Alexa 1M Domains 2,865,393 947,823"),
    ("WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web",
     "we obtained data for a total of 88.1% of websites in the top million"),
    ("USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking",
     "Total 48,948,669 5,190 (0.011)%"),
    ("PETS/2019/a-quic-look-at-web-tracking",
     "to send a client hello message to UDP port 443 of each Alexa-listed host"),
    ("CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web",
     "we selected a statistically significant (95% confidence interval) random sample of 363 websites for manual inspection"),
    # Damaged by column order: the page quotes the intact run only.
    ("WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide",
     "domized sample of 2,000 websites (margin of error = 2."),
    ("IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking",
     "500 random combinations of different sample sizes"),
    ("IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking",
     "This is only 0.05% of our sample, compared to 0.2% of Alexa Top 10K domains, indicating that more popular websites are more"),
]
 
 
def collapse(s: str) -> str:
    s = s.replace("’", "'").replace("‘", "'")
    s = s.replace("“", '"').replace("”", '"')
    s = s.replace("–", "-").replace("—", "-").replace("−", "-")
    return re.sub(r"\s+", " ", s)
 
 
def dehyphenate(s: str) -> str:
    """Rejoin a word broken across a PDF line by a hyphen.
 
    "ran-\ndomized" collapses to "ran- domized", which no exact search for
    "randomized" will match. A reviewer found this: a quote that IS in the
    paper would have been reported MISSING. Applied only as a second pass, and
    reported as such, because it also joins genuine hyphenated compounds.
    """
    return re.sub(r"(\w)-\s+(\w)", r"\1\2", s)
 
 
def load(k: str) -> str:
    venue, year, slug = k.split("/", 2)
    p = os.path.join(ROOT, "fulltext", year, venue, slug, "paper.cols.txt")
    with open(p, encoding="utf8", errors="replace") as fh:
        return collapse(fh.read())
 
 
# ---------------------------------------------------------------- coverage
# Curating QUOTES by hand failed twice: two footnoted quotes and one McDonald
# quote were printed on the page and never checked, while the docstring and the
# provenance page both claimed "every quotation". So the list is now AUDITED
# against the pages rather than trusted: every //"..."// span on either page
# must be covered by some QUOTES entry, and an uncovered one fails the run.
# Only the CONTENT page is audited. The provenance page's //"..."// spans are
# mostly quotations of this page's own earlier drafts and of extraction records
# ("the same crawler, the same week", "96/(p.4)"), which have no paper to check
# against; the paper quotes it repeats are already covered here.
PAGES = ["pages/statistics_how_many_sites.txt"]
# A DokuWiki italic run (//X//) inside a quotation would otherwise let the span
# run from one quotation into the next, so reject any match containing //.
WIKI_QUOTE = re.compile(r'//"([^"]+?)"//')
 
 
def page_quotes():
    seen = []
    for rel in PAGES:
        path = os.path.join("/workspace/artifacts/wiki", rel)
        if not os.path.exists(path):
            continue
        text = open(path, encoding="utf8").read()
        # Strip the wiki's downloadable-code blocks: those hold this script's
        # own output, not page prose. The tag name is assembled rather than
        # written literally, because this file is itself published inside one
        # of those blocks and a literal closing tag here would end it early.
        tag = "fi" + "le"
        text = re.sub(rf"<{tag}[^>]*>.*?</{tag}>", "", text, flags=re.S)
        for mm in WIKI_QUOTE.finditer(text):
            if "//" in mm.group(1):
                continue
            seen.append((rel, mm.group(1)))
    return seen
 
 
def audit_coverage():
    listed = [collapse(q).lower() for _, q in QUOTES]
    missing = []
    for rel, q in page_quotes():
        qq = collapse(q).lower()
        if any(qq in l or l in qq for l in listed):
            continue
        missing.append((rel, q))
    return missing
 
 
uncovered = audit_coverage()
if uncovered:
    print("!! QUOTES on a page that this script does not check:")
    for rel, q in uncovered:
        print(f"   {rel}: {q}")
    print()
 
fails = 0
for k, q in QUOTES:
    txt = load(k)
    qq = collapse(q)
    if qq.lower() in txt.lower():
        print(f"EXACT    {k}\n         {q}")
        continue
    if collapse(dehyphenate(qq)).lower() in dehyphenate(txt).lower():
        print(f"EXACT-DH {k}   (matched only after rejoining a hyphenated line break)\n         {q}")
        continue
    words = qq.split()
    wins = [" ".join(words[i:i + 5]) for i in range(max(1, len(words) - 4))]
    found = sum(1 for w in wins if w.lower() in txt.lower())
    verdict = "PARTIAL" if found else "MISSING"
    if not found:
        fails += 1
    print(f"{verdict}  {k}  ({found}/{len(wins)} five-word windows)\n         {q}")
 
distinct = len({(k, collapse(q).lower()) for k, q in QUOTES})
print(f"\n{len(QUOTES)} entries ({distinct} distinct), {fails} not located at all.")
print(f"page-quote coverage audit: {len(uncovered)} uncovered")
sys.exit(1 if (fails or uncovered) else 0)

hms_quotecheck-output.txt

PARTIAL  WWW/2016/characterizing-long-tail-seo-spam-on-cloud-web-hosting-services  (4/7 five-word windows)
         to obtain the number of sampled cloud directories n = 500
EXACT    IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
         we chose a sample size of 384 phishing sites for each entity
EXACT    IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
         Our goal was to obtain a power of 0.95 at the significance level of 0.05 in a one-way independent ANOVA test
EXACT    IEEE-SP/2019/phishfarm-a-scalable-framework-for-measuring-the-effectiveness-of-evasion-techni
         All sites ultimately delivered 100% uptime during deployment, thus we ended up with an effective sample size of 396 per experiment
EXACT    USENIX/2020/phishtime-continuous-longitudinal-measurement-of-the-effectiveness-of-anti-phish
         To obtain a power of 0.95 at a p-value of 0.05, we initially assumed a medium effect size of 0.25
EXACT    PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation
         manually inspected 383 websites, which is a statistically significant sample size for 100K websites
EXACT    USENIX/2023/autofr-automated-filter-rule-generation-for-adblocking
         we randomly selected 272 sites (a sample size out of 933 sites to get a confidence level of 95% with a 5% confidence interval)
EXACT    CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
         1,735 websites
EXACT    PETS/2019/a-quic-look-at-web-tracking
         We found 186 websites within the Alexa Top Million that support the QUIC protocol
EXACT    PETS/2019/a-quic-look-at-web-tracking
         Alexa Top 10 20.00% Alexa Top 100 21.00% Alexa Top 1K 8.10% Alexa Top 10K 1.69% Alexa Top 100K 0.19% Alexa Top 1M 0.02%
EXACT    PETS/2019/a-quic-look-at-web-tracking
         this share decreases for larger Top Alexa lists to only 0.0186% within the Alexa Top 1 Million
EXACT    WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web
         a random sample of 1000 sites from each of the top 10K, top 100K, and top 1M, for a total sample size of 4000 websites
EXACT    CCS/2019/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web
         5% of the top 1K, 20%
EXACT    USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
         meaning that one in every 9,090 websites is cryptojacking
EXACT    USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
         In the Alexa Top 1M, 0.065% of the websites was actively cryptojacking, in this random sample only 0.011% of the websites, which is almost 6 times lower
EXACT    USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting
         increasing trend of such misconfiguration as the ranking increases
EXACT    IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment
         higher adoption rate for higher-ranked
EXACT    USENIX/2022/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement
         the likelihood of diminishing returns
EXACT    WWW/2025/digital-disparities-a-comparative-web-measurement-study-across-economic-boundari
         less popular websites were included to meet the target sample size of 10,000 websites per country
EXACT    CCS/2023/you-call-this-archaeology-evaluating-web-archives-for-reproducible-web-security
         Hit rates across popularity buckets
EXACT    IMC/2022/a-world-wide-view-of-browsing-the-world-wide-web
         a conservative sample size of
EXACT    IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates
         We analyze a random sample of 2.9 million domains and the Alexa top 1 million domains and find that at least 1,877 (0.065%) and 587 (0.062%) of domains are vulnerable, respectively
PARTIAL  IMC/2021/who-you-gonna-call-an-empirical-evaluation-of-website-security-txt-deployment  (8/14 five-word windows)
         This percentage decreases to 3-4% for the top 10K sites, and only a percent for the top 100K
EXACT    IMC/2020/analyzing-third-party-service-dependencies-in-modern-web-services-have-we-learne
         The use of third party CAs is also higher (77% in top-100K) in less popular websites as compared to more popular (71% in top-100) websites
EXACT    USENIX/2023/youve-got-report-measurement-and-security-implications-of-dmarc-reporting
         almost 20% of the least 10K popular Alexa top-1M domains with DMARC that use external domains are misconfigured compared to about 10% for the most 10K popular domains
EXACT    WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web
         We find them in use on only 0.4% of the top thousand and 0.05% of websites in the top million
EXACT    CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
         1,735 websites
EXACT    USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
         more popular trackers are better represented in Wayback data
EXACT    USENIX/2023/a-large-scale-measurement-of-website-login-policies
         0.44% of top 10K domains transmitted passwords in the clear, compared to 0.50% of top 100K domains and 0.62% of top 1M domains
EXACT    USENIX/2023/a-large-scale-measurement-of-website-login-policies
         33.6% of the domains in the top 10K and 26.7% of domains in the top 100K demonstrated rate limiting, compared to the 24.1% for domains in the top 1M
EXACT    IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio
         Though ranking does have an effect, overall valid https use
EXACT    IMC/2020/accept-the-risk-and-continue-measuring-the-long-tail-of-government-https-adoptio
         in the long tail dataset, at
EXACT    CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense
         we managed to crawl 991,513 of them
EXACT    IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates
         From the total 286,788,250 unique domains in the set, we randomly sampled 1%
EXACT    IMC/2016/zone-poisoning-the-how-and-where-of-non-secure-dns-dynamic-updates
         1% Sample Alexa 1M Domains 2,865,393 947,823
EXACT    WWW/2021/websocket-adoption-and-the-landscape-of-the-real-time-web
         we obtained data for a total of 88.1% of websites in the top million
EXACT    USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking
         Total 48,948,669 5,190 (0.011)%
EXACT    PETS/2019/a-quic-look-at-web-tracking
         to send a client hello message to UDP port 443 of each Alexa-listed host
EXACT    CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web
         we selected a statistically significant (95% confidence interval) random sample of 363 websites for manual inspection
EXACT    WWW/2017/security-implications-of-redirection-trail-in-popular-websites-worldwide
         domized sample of 2,000 websites (margin of error = 2.
EXACT    IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking
         500 random combinations of different sample sizes
EXACT    IMC/2018/403-forbidden-a-global-view-of-cdn-geoblocking
         This is only 0.05% of our sample, compared to 0.2% of Alexa Top 10K domains, indicating that more popular websites are more
 
42 entries (41 distinct), 0 not located at all.
page-quote coverage audit: 0 uncovered

Four reviewers, all told explicitly that the author's context may not be exhaustive, all handed the page text, the report script, its unedited output and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were acted on. Rejections are listed as well as fixes, because they are the only record of whether a reviewer slot earns its place.

Eight things found by re-reading rather than by any check, listed because they are the class of error no automated check can see:

Re-ran all three scripts, diffed the committed outputs, recomputed the arithmetic tables independently in Python, and re-derived the design:sampling cross-check.

Read every {[key]} marker against a fresh export of the live bibliography, re-verified the two external references against JAMA/PMC full text as well as Crossref and PubMed, and re-checked twelve of the fourteen rank-band rows against paper.cols.txt by hand.

Fetched rather than recalled: alexa.com and alexa.com/topsites, tranco-list.eu and its /latest_list endpoint, developer.chrome.com/docs/crux and its methodology page, the zakird/crux-top-lists repository, the IETF datatracker entry for RFC 9116, and both external DOIs through Crossref and doi.org.

No checklist. Read both pages end to end against the neighbours. 19 findings; 14 accepted, 4 rejected or deferred, 1 already fixed.

Four reviewers, seven substantive defects between them, and one false positive that was the author's fault for naming the wrong file in a brief.

The pattern worth carrying forward: the focused passes caught wrong numbers, and the generic pass caught wrong arguments. Every defect that changed what the page advises — as opposed to what it reports — came from the unstructured pass or from re-reading. A review layer of only the three focused reviewers would have shipped a numerically correct page that answered its own question three different ways.

• How many sites — the content page this log is behind.
• Corpus — corpus-level caveats: venues, funnel, provisional years.
• sampling — the neighbouring draw-side log, and the source of the tuple-level size figures reconciled above.
• hypothesis_testing — the source of the ICC sweep whose ρ values section C reuses.

[1]

Korczyński, Maciej; Król, Michal; van Eeten, Michel (2016): "Zone Poisoning: The How and Where of Non-Secure DNS Dynamic Updates", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Konoth, Radhesh Krishnan; Vineti, Emanuele; Moonsamy, Veelasha; Lindorfer, Martina; Kruegel, Christopher; Bos, Herbert; Vigna, Giovanni (2018): "MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[3]

Bijmans, Hugo L.J.; Booij, Tim M.; Doerr, Christian (2019): "Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale", in: Proceedings of the USENIX Security Symposium. (Link)

[4]

Sy, Erik; Burkert, Christian; Federrath, Hannes; Fischer, Mathias (2019): "A QUIC Look at Web Tracking", Proceedings on Privacy Enhancing Technologies 2019(3):255-266. (DOI)

[5]

Murley, Paul; Ma, Zane; Mason, Joshua; Bailey, Michael D.; Kharraz, Amin (2021): "WebSocket Adoption and the Landscape of the Real-Time Web", in: Proceedings of the ACM Web Conference. (DOI)

[6]

Moore, Tyler; Leontiadis, Nektarios; Christin, Nicolas (2011): "Fashion Crimes: Trending-Term Exploitation on the Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[7]

Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)

[8]

Liao, Xiaojing; Liu, Chang; McCoy, Damon; Shi, Elaine; Hao, Shuang; Beyah, Raheem A. (2016): "Characterizing Long-tail SEO Spam on Cloud Web Hosting Services", in: Proceedings of the ACM Web Conference. (DOI)

[9]

Tang, Jenny; Bauer, Lujo; Christin, Nicolas (2025): "Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers", in: Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS), pp. 475-493. USENIX Association. (Link)

[10]

Hanley, James A.; Lippman-Hand, Abby (1983): "If Nothing Goes Wrong, Is Everything All Right? Interpreting Zero Numerators", JAMA 249(13):1743-1745. (DOI)

[11]

Killip, Shersten; Mahfoud, Ziyad; Pearce, Kevin (2004): "What Is an Intracluster Correlation Coefficient? Crucial Concepts for Primary Care Researchers", The Annals of Family Medicine 2(3):204-208. (DOI)

[12]

Ikram, Muhammad; Masood, Rahat; Tyson, Gareth; Kaafar, Mohamed Ali; Loizon, Noha; Ensafi, Roya (2019): "The Chain of Implicit Trust: An Analysis of the Web Third-party Resources Loading", in: Proceedings of the ACM Web Conference. (DOI)

[13]

Singanamalla, Sudheesh; Jang, Esther Han Beol; Anderson, Richard; Kohno, Tadayoshi; Heimerl, Kurtis (2020): "Accept the Risk and Continue: Measuring the Long Tail of Government https Adoption", in: Proceedings of the ACM Internet Measurement Conference. (DOI)