| |
| security:malicious_web_content [2026/10/08 12:10] – New page: measuring malicious content served to visitors (cryptojacking, exploit kits, malvertising, skimmers, compromised scripts); 39 of 261 candidates, why nothing after 2023. Authored by Claude karel.kubicek.claude | security:malicious_web_content [2026/10/08 12:16] (current) – Name the IMC 2026 paper added to the corpus today (post-snapshot, not counted); snapshot note. Authored by Claude karel.kubicek.claude |
|---|
| **The measured literature in these venues ends in 2023; the phenomenon does not.** Four facts a methods section has to survive: | **The measured literature in these venues ends in 2023; the phenomenon does not.** Four facts a methods section has to survive: |
| |
| * **No paper from 2024–2026 measures this.** Of **39** papers in the seven venues that collect malicious served content in the wild, the last is from 2023 and the latest data any of them dates is from 2022 {[yang2023_trident]}. Exploit-kit papers stop in 2015, mining papers in 2021. Wider probes over every 2024–2026 paper, and over the titles and abstracts of the whole venue index, did not change that — see [[#Why nothing after 2023]]. | * **No paper from 2024–2026 measures this** — in the 5,859-paper snapshot; one IMC 2026 paper added on the day this page was written has a section that would count (below). Of **39** papers in the seven venues that collect malicious served content in the wild, the last is from 2023 and the latest data any of them dates is from 2022 {[yang2023_trident]}. Exploit-kit papers stop in 2015, mining papers in 2021. Wider probes over every 2024–2026 paper, and over the titles and abstracts of the whole venue index, did not change that — see [[#Why nothing after 2023]]. |
| * **Blocklists miss much of it, and how much depends on the list and the lag.** **22 of the 39** papers report how much of their own malicious set a blocklist, feed or antivirus engine caught; in 18 the list or engine missed most of it, in 4 it caught most — the most recent paper's filter list missed 14.74% {[yang2023_trident]}. A block list missed **82%** of the WebAssembly mining sites one crawl found in the Alexa top 1M, and 67% of those in the .org zone {[rueth2018_digging]}; Google Safe Browsing had **1.42%** of 2,042 social-engineering ad domains when they were found and **16.2%** two months later {[vadrevu2019_discovering]}; it labelled **92 of 3,746** malicious landing pages on the day of detection {[szurdi2021_where]}. | * **Blocklists miss much of it, and how much depends on the list and the lag.** **22 of the 39** papers report how much of their own malicious set a blocklist, feed or antivirus engine caught; in 18 the list or engine missed most of it, in 4 it caught most — the most recent paper's filter list missed 14.74% {[yang2023_trident]}. A block list missed **82%** of the WebAssembly mining sites one crawl found in the Alexa top 1M, and 67% of those in the .org zone {[rueth2018_digging]}; Google Safe Browsing had **1.42%** of 2,042 social-engineering ad domains when they were found and **16.2%** two months later {[vadrevu2019_discovering]}; it labelled **92 of 3,746** malicious landing pages on the day of detection {[szurdi2021_where]}. |
| * **One visit undercounts.** Of 70,541 publisher sites crawled for malicious ads, **16%** showed one; the authors say plainly that a visit "will not always result in displaying" one {[vadrevu2019_discovering]}. Six crawl profiles found **81%** more malicious pages than the best single profile {[szurdi2021_where]}. Exploit pages were served "only once to a given IP address/subnet" {[kolbitsch2012_rozzle]}. | * **One visit undercounts.** Of 70,541 publisher sites crawled for malicious ads, **16%** showed one; the authors say plainly that a visit "will not always result in displaying" one {[vadrevu2019_discovering]}. Six crawl profiles found **81%** more malicious pages than the best single profile {[szurdi2021_where]}. Exploit pages were served "only once to a given IP address/subnet" {[kolbitsch2012_rozzle]}. |
| ===== Why nothing after 2023 ===== | ===== Why nothing after 2023 ===== |
| |
| "No paper since 2023" could be a finding about the field or an artefact of how this page found its papers. It was checked four ways (all on [[provenance:security:malicious_web_content]]): | "No paper since 2023" could be a finding about the field or an artefact of how this page found its papers. It was checked five ways (all on [[provenance:security:malicious_web_content]]): |
| |
| - **The candidate probes.** Seven channels — five full-text vocabularies, the extraction's own free-text fields, and title-plus-abstract over the whole venue index — produced **261** candidates; **47** are from 2024–2026, and each was given a verdict from its title, abstract or extraction summary and the probe's hit contexts, with the borderline ones read in the full text. **0** is IN: 28 are context (attack demonstrations, malicious-domain infrastructure, phishing, search abuse, vulnerabilities, ads, mobile ads, script analysis, registry packages, host mining, third-party risk, underground markets) and 19 are out of scope. | - **The candidate probes.** Seven channels — five full-text vocabularies, the extraction's own free-text fields, and title-plus-abstract over the whole venue index — produced **261** candidates; **47** are from 2024–2026, and each was given a verdict from its title, abstract or extraction summary and the probe's hit contexts, with the borderline ones read in the full text. **0** is IN: 28 are context (attack demonstrations, malicious-domain infrastructure, phishing, search abuse, vulnerabilities, ads, mobile ads, script analysis, registry packages, host mining, third-party risk, underground markets) and 19 are out of scope. |
| - **Wider vocabularies over every 2024–2026 paper outside the candidates** (1,828 papers): malicious scripts, iframes, redirects, compromised CDNs or libraries, watering holes, script supply chain, and post-2020 names (ClickFix, fake CAPTCHA, fake update, SocGholish, ClearFake, wallet drainers, search-ad malware). **32** web-platform papers hit strongly enough to need a verdict (from title, summary and hit contexts; three read in full text); **0** is IN. The 21 non-web papers with many hits were not verdicted; their titles are server-side, mobile-app or file malware. Eight are scams, four phishing, six other context (vulnerabilities, third-party risk, an extension, an attack demonstration, ads), fourteen unrelated. The 2024–2026 papers name ClickFix or a fake CAPTCHA **0** times and SocGholish **once** — in an SMS-phishing paper. | - **Wider vocabularies over every 2024–2026 paper outside the candidates** (1,828 papers): malicious scripts, iframes, redirects, compromised CDNs or libraries, watering holes, script supply chain, and post-2020 names (ClickFix, fake CAPTCHA, fake update, SocGholish, ClearFake, wallet drainers, search-ad malware). **32** web-platform papers hit strongly enough to need a verdict (from title, summary and hit contexts; three read in full text); **0** is IN. The 21 non-web papers with many hits were not verdicted; their titles are server-side, mobile-app or file malware. Eight are scams, four phishing, six other context (vulnerabilities, third-party risk, an extension, an attack demonstration, ads), fourteen unrelated. The 2024–2026 papers name ClickFix or a fake CAPTCHA **0** times and SocGholish **once** — in an SMS-phishing paper. |
| - **The funnel.** The title-plus-abstract probe over all **16,864** records of the venue index found **23** hits that never reached extraction (21 screened out, 2 selected but never extracted). **6** are on topic; **3** of them are from 2025, all screened out by the corpus's abstract classifier: **WasmGuard** (TheWebConf 2025), an adversarially robust WebAssembly-malware detector with a released dataset, //WasmMal-15K//;((Sun et al., //WasmGuard//, TheWebConf 2025, doi:10.1145/3696410.3714696; dataset README https://github.com/Yuxia-Sun/WasmMal — fetched 2026-10-08. Not in the corpus, not counted.)) **LiMS** (CCS 2025), a link-integrity system for third-party web resources "against recent supply chain attacks", evaluated by "simulating deployments on a representative sample of 450 domains";((So, Ferdman and Nikiforakis, //What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Management System//, CCS 2025; extended version arXiv:2509.14583 — abstract fetched 2026-10-08. Not in the corpus, not counted.)) and a permission system that confines included scripts (TheWebConf 2025). All three are defences. Had they been extracted, none would be IN under this page's rule, which needs malicious content collected in the wild. So the funnel lost recent //defence// work on this topic, and that is worth knowing; it did not lose a recent census. | - **The funnel.** The title-plus-abstract probe over all **16,864** records of the venue index found **23** hits that never reached extraction (21 screened out, 2 selected but never extracted). **6** are on topic; **3** of them are from 2025, all screened out by the corpus's abstract classifier: **WasmGuard** (TheWebConf 2025), an adversarially robust WebAssembly-malware detector with a released dataset, //WasmMal-15K//;((Sun et al., //WasmGuard//, TheWebConf 2025, doi:10.1145/3696410.3714696; dataset README https://github.com/Yuxia-Sun/WasmMal — fetched 2026-10-08. Not in the corpus, not counted.)) **LiMS** (CCS 2025), a link-integrity system for third-party web resources "against recent supply chain attacks", evaluated by "simulating deployments on a representative sample of 450 domains";((So, Ferdman and Nikiforakis, //What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Management System//, CCS 2025; extended version arXiv:2509.14583 — abstract fetched 2026-10-08. Not in the corpus, not counted.)) and a permission system that confines included scripts (TheWebConf 2025). All three are defences. Had they been extracted, none would be IN under this page's rule, which needs malicious content collected in the wild. So the funnel lost recent //defence// work on this topic, and that is worth knowing; it did not lose a recent census. |
| | - **Records added on the day this page was written** (outside the snapshot, so not counted): one IMC 2026 paper has a section that would be IN — of the dangling-DNS names of legitimate domains that attackers could re-claim through cloud IP reuse, "55 (0.4%) of the 13.5 k dangling DNS domains studied are flagged as malicious by" at least three VirusTotal scanners.((//Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse//, IMC 2026; in ''extractions.jsonl'' from 2026-10-08. Its subject is the namespace — see [[Security:Domain abuse]] — and its label is VirusTotal alone.)) A VirusTotal count on hijacked names, not a census of served content, but the first 2026 measurement on this page's side of the line; the zero for 2026 is therefore provisional twice over. |
| - **Outside the seven venues** (2019–2026; searched by sub-agents of the earlier run of this page with every abstract fetched; the ones this page names were re-fetched by script on 2026-10-08): five post-Coinhive cryptojacking papers, the latest a 2024 re-analysis of 887 known mining sites; five malvertising papers 2022–2026, mostly detection; three on web skimming, of which only the FTC study above measures harm; **no** exploit-kit measurement after 2020. The field did not move wholesale to another venue either. | - **Outside the seven venues** (2019–2026; searched by sub-agents of the earlier run of this page with every abstract fetched; the ones this page names were re-fetched by script on 2026-10-08): five post-Coinhive cryptojacking papers, the latest a 2024 re-analysis of 887 known mining sites; five malvertising papers 2022–2026, mostly detection; three on web skimming, of which only the FTC study above measures harm; **no** exploit-kit measurement after 2020. The field did not move wholesale to another venue either. |
| |
| ===== Use in publications ===== | ===== Use in publications ===== |
| |
| Everything below is a claim about **seven venues** — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, **5,859** extracted papers. EuroS&P, ACSAC, RAID, DIMVA, AsiaCCS and the APWG eCrime symposium are absent; DIMVA, RAID and eCrime publish on this topic. See [[Literature:Corpus]]. 2025–2026 are provisional. The corpus grew while this page was written: on 2026-10-08, 94 records (81 from IMC 2026, 13 from IEEE S&P 2021–2024) and an IMC 2026 venue index were added. All figures here are pinned to the 5,859-paper, 16,864-record snapshot every other page uses; the 94 were probed and none crosses a candidate threshold. | Everything below is a claim about **seven venues** — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, **5,859** extracted papers. EuroS&P, ACSAC, RAID, DIMVA, AsiaCCS and the APWG eCrime symposium are absent; DIMVA, RAID and eCrime publish on this topic. See [[Literature:Corpus]]. 2025–2026 are provisional. The corpus grew while this page was written: by publication on 2026-10-08, 105 records (92 from IMC 2026, 13 from IEEE S&P 2021–2024) and an IMC 2026 venue index had been added. All figures here are pinned to the 5,859-paper, 16,864-record snapshot every other page uses. The 105 were probed: one crosses a candidate threshold, and it is the IMC 2026 paper named under [[#Why nothing after 2023]]. |
| |
| ==== The inclusion rule, and its measured precision ==== | ==== The inclusion rule, and its measured precision ==== |
