You are about to measure malicious code that websites, ads or redirect chains serve to the people who visit them — an exploit page, an in-browser miner, an ad that ends in a malware download, a script that copies a payment form, a compromised library on a CDN. Three decisions decide what your number means, and the literature you will cite makes all three harder than it looks:

1. Whether the phenomenon is still alive. Most of what these venues published is about attacks that ended: the mass-market plug-in exploit kits died with Flash and Internet Explorer (browser-engine kits survive, mostly in targeted use), and in-browser mining collapsed when Coinhive shut down. The routes that did not end — malvertising, injected scripts on compromised sites, payment skimmers, a swapped third-party library — are the ones the venues stopped measuring (malvertising, injected scripts) or never measured (skimmers, a swapped library).
2. What labels the content. Blocklists and antivirus engines miss most of what these papers found. In this literature the detector is the method, and a list used as ground truth measures the list.
3. What your crawler is. One visit, from a datacenter address, with a headless browser and no referrer, is exactly the visitor this content is built to skip.

This page is about malicious content served to a visitor's browser, measured in the wild. The lines with its neighbours: content whose harm is a payment the victim chooses to make is Online scams; content that takes credentials or a wallet signature is Phishing; how a script is analysed, deobfuscated or attributed is JavaScript; a vulnerability in a site is Web vulnerabilities; what a VirusTotal verdict is worth is VirusTotal. Mining malware on servers, routers, IoT devices or CI runners, malicious packages in npm or PyPI that never reach a visitor, and the physical card skimmers on gas pumps are outside; they are listed under Use in publications as context, not counted.

The status column is a claim about today (2026-10-08) and rests on the dated primary sources in its row, not on the corpus. The In the corpus column is the year span of this page's papers of that type; the two download-path papers (2015–2016) and the two redirect-system papers (2018, 2021) are not given rows of their own — their payloads are the malvertising and injected-script rows'.

How to read the status column. Historical means you should not design a 2026 study around it unless you are measuring the tail or the decline, and you should not quote its prevalence as current. Current, unmeasured is a research opportunity, not a gap in this page: the corpus checks below say the venues stopped publishing on it, and the dated industry and government sources say it continued.

“No paper since 2023” could be a finding about the field or an artefact of how this page found its papers. It was checked four ways (all on malicious_web_content):

1. The candidate probes. Seven channels — five full-text vocabularies, the extraction's own free-text fields, and title-plus-abstract over the whole venue index — produced 261 candidates; 47 are from 2024–2026, and each was given a verdict from its title, abstract or extraction summary and the probe's hit contexts, with the borderline ones read in the full text. 0 is IN: 28 are context (attack demonstrations, malicious-domain infrastructure, phishing, search abuse, vulnerabilities, ads, mobile ads, script analysis, registry packages, host mining, third-party risk, underground markets) and 19 are out of scope.
2. Wider vocabularies over every 2024–2026 paper outside the candidates (1,828 papers): malicious scripts, iframes, redirects, compromised CDNs or libraries, watering holes, script supply chain, and post-2020 names (ClickFix, fake CAPTCHA, fake update, SocGholish, ClearFake, wallet drainers, search-ad malware). 32 web-platform papers hit strongly enough to need a verdict (from title, summary and hit contexts; three read in full text); 0 is IN. The 21 non-web papers with many hits were not verdicted; their titles are server-side, mobile-app or file malware. Eight are scams, four phishing, six other context (vulnerabilities, third-party risk, an extension, an attack demonstration, ads), fourteen unrelated. The 2024–2026 papers name ClickFix or a fake CAPTCHA 0 times and SocGholish once — in an SMS-phishing paper.
3. The funnel. The title-plus-abstract probe over all 16,864 records of the venue index found 23 hits that never reached extraction (21 screened out, 2 selected but never extracted). 6 are on topic; 3 of them are from 2025, all screened out by the corpus's abstract classifier: WasmGuard (TheWebConf 2025), an adversarially robust WebAssembly-malware detector with a released dataset, WasmMal-15K;¹⁸⁾ LiMS (CCS 2025), a link-integrity system for third-party web resources “against recent supply chain attacks”, evaluated by “simulating deployments on a representative sample of 450 domains”;¹⁹⁾ and a permission system that confines included scripts (TheWebConf 2025). All three are defences. Had they been extracted, none would be IN under this page's rule, which needs malicious content collected in the wild. So the funnel lost recent defence work on this topic, and that is worth knowing; it did not lose a recent census.
4. Outside the seven venues (2019–2026; searched by sub-agents of the earlier run of this page with every abstract fetched; the ones this page names were re-fetched by script on 2026-10-08): five post-Coinhive cryptojacking papers, the latest a 2024 re-analysis of 887 known mining sites; five malvertising papers 2022–2026, mostly detection; three on web skimming, of which only the FTC study above measures harm; no exploit-kit measurement after 2020. The field did not move wholesale to another venue either.

The answer, then. Two of the four headline phenomena did end as mass phenomena — plug-in exploit kits with Flash and Internet Explorer, in-browser mining with Coinhive — and the literature's decline tracks that. The other two (malvertising and skimming), plus injected scripts on compromised sites and third-party script compromise, did not end: government and vendor sources document them through 2026. What changed is what these venues measure. From 2024 the papers that reach this page's probes are about scams and phishing (the wider probe), malicious-domain infrastructure, vulnerabilities and attack demonstrations (the candidate probes), wallet drainers and malicious registry packages — and the web-delivered malware routes went unmeasured. Treat that as the finding. The 2025–2026 venue-years are provisional (CCS and IMC 2026 have not been held; IEEE S&P and TheWebConf 2026 are largely un-indexed), so the zero is firm for 2024 and provisional after.

*provisional. The words did not disappear — cryptojacking is still named by 7–10 papers a year — but after 2021 they name host, router, CI and IoT mining, or cite the old web papers. A mention count is the vocabulary; the 39 are the measurements.

What the 39 papers used to find malicious content, and what their labels rested on (hand-coded from full text; a paper can use several):

What the detection rows hide:

• Thresholds miss throttled miners. MineSweeper measured both obvious detectors on its own data: “relying only on pattern matching on the payload would result in 6.23% false negatives”, and relying on high CPU load “for detection would result in 11.36% false negatives” [6Konoth, Radhesh Krishnan; Vineti, Emanuele; Moonsamy, Veelasha; Lindorfer, Martina; Kruegel, Christopher; Bos, Herbert; Vigna, Giovanni (2018): "MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. Miners throttle; a CPU threshold is a choice of what to miss.
• The miner lists are stale. The NoCoin browser extension's repository has been archived since 2020; the adblock-nocoin-list filter list is still committed to, most recently to remove false positives (2026-09-12); the CoinBlockerLists maintainer put the project “on hold indefinitely” — in 2024, according to a mirror's README; the maintainer's own statement is undated.²⁰⁾ A list that stopped in 2020–2024 will find 2018's miners.
• Antivirus labels outlive the threat. MINOS found VirusShare samples that “try to use the obsolete Coinhive mining service. Since Coinhive is no longer maintained, these samples do not perform any mining operations” — and engines still label them as cryptojacking [15Naseem, Faraz; Aris, Ahmet; Babun, Leonardo; Tekiner, Ege; Uluagac, A. Selcuk (2021): "MINOS: A Lightweight Real-Time Cryptojacking Detection System", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]. Label age is a property of the label.
• No paper in the population classifies with an LLM (0 of 39; 5 of the 108 context papers do, all 2025–2026). Corpus-wide, papers with an LLM classification step went from 2 of 719 (2023) to 77 of 770 (2025*) and 71 of 415 (2026*). Outside the venues, LLMs are applied to malicious npm packages (SocketAI, ICSE 2025) and to JavaScript deobfuscation at Google (CASCADE, an arXiv industry paper) — neither measures content served to visitors. If you use one, validate it the way Which methods are current describes.

Each row is the paper's own figure with its own denominator, checked against its text. They are not comparable with each other — different lists, phenomena, years and lags — and that is the point: no general-purpose list is a census. The first fourteen rows are the papers where the list or engine missed most of the set; the last four are the papers where it caught most; four further papers that measured it (deSEO, Manufacturing Compromise, Red Fox, the 2016 indicators-of-compromise paper) are in the per-paper codes on the provenance page.

Two consequences for a design. First, using a list as the label and then reporting its coverage is circular — and 13 of the 39 papers rest part of their ground truth on a list. Second, lag is the variable that matters: Google's own Safe Browsing migration guide, writing about phishing, says that “as of 2021, 60% of sites that deliver attacks live less than 10 minutes”, against the 20 to 50 minutes a v4 client took to update its lists.²¹⁾ Report which list, queried when, how long after your own detection. Seeds that are live on 2026-10-08, each a seed and not a census: URLhaus, “dedicated to sharing malicious URLs that are being used for malware distribution”;²²⁾ Safe Browsing (see Google Safe Browsing); VirusTotal (VirusTotal); and the indicator lists that vendor and agency reports such as those in the currency table publish with each campaign.

Malicious content is selective about whom it serves. The papers name six filters, each with its measured effect:

• One visit. Ads rotate and malicious ones are a fraction of impressions; Vadrevu and Perdisci saw a malicious ad on 16% of 70,541 publishers and warn that a visit “will not always result in displaying” one [3Vadrevu, Phani; Perdisci, Roberto (2019): "What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. MineSweeper spent four seconds per page, notes that miners spread through ad networks “are not served on every visit”, and missed miners loaded in pop-under windows [6Konoth, Radhesh Krishnan; Vineti, Emanuele; Moonsamy, Veelasha; Lindorfer, Martina; Kruegel, Christopher; Bos, Herbert; Vigna, Giovanni (2018): "MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)].
• IP address. Two of eleven ad networks served nothing malicious when requests came from “our institution's machines, Tor exit nodes, and Amazon AWS IP ranges” [3Vadrevu, Phani; Perdisci, Roberto (2019): "What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]; exploit servers served an attack “only once to a given IP address/subnet or only once within a given time period” [5Kolbitsch, Clemens; Livshits, Benjamin; Zorn, Benjamin G.; Seifert, Christian (2012): "Rozzle: De-cloaking Internet Malware", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]; traffic distribution systems that led to an exploit server on the first crawl “later give 404 responses or forward the crawler to google.com on subsequent visits” [28Li, Zhou; Alrwais, Sumayah A.; Xie, Yinglian; Yu, Fang; Wang, XiaoFeng (2013): "Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)].
• User profile. Crawling as six kinds of user found 81% more malicious pages than the best single profile, and the authors estimate that new cloaking techniques “could decrease by half the number of malicious pages observed” [4Szurdi, Janos; Luo, Meng; Kondracki, Brian; Nikiforakis, Nick; Christin, Nicolas (2021): "Where are you taking me?Understanding Abusive Traffic Distribution Systems", in: Proceedings of the ACM Web Conference. (DOI)].
• Environment checks. “Most malicious code contains at least some form of cloaking, environment matching, or fingerprinting” [5Kolbitsch, Clemens; Livshits, Benjamin; Zorn, Benjamin G.; Seifert, Christian (2012): "Rozzle: De-cloaking Internet Malware", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]; multi-path execution raised offline detections almost seven-fold. Of all URLs EvilSeed's search-engine gadgets returned, 26.2% “were in fact cloaked” — served differently to a search-engine crawler than to a browser [29Invernizzi, Luca; Comparetti, Paolo Milani; Benvenuti, Stefano; Kruegel, Christopher; Cova, Marco; Vigna, Giovanni (2012): "EvilSeed: A Guided Approach to Finding Malicious Web Pages", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)].
• Device. Szurdi et al. found that popular blacklists “miss the vast majority of malicious pages targeting mobile users” [4Szurdi, Janos; Luo, Meng; Kondracki, Brian; Nikiforakis, Nick; Christin, Nicolas (2021): "Where are you taking me?Understanding Abusive Traffic Distribution Systems", in: Proceedings of the ACM Web Conference. (DOI)]; the 2025 iOS kit and the polyfill.io payload were both served only to selected mobile devices (above and below). Run at least one mobile profile — user agent, viewport, touch — per URL.
• Time. Rogue landing pages in search poisoning lived 1.7 days on average [19Lu, Long; Perdisci, Roberto; Lee, Wenke (2011): "SURF: detecting and measuring search poisoning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]; BLADE's feed of fresh malicious URLs had already decayed — “only about half of the malicious URLs were observed to be delivering drive-by download attacks when tested” [22Lu, Long; Yegneswaran, Vinod; Porras, Phillip A.; Lee, Wenke (2010): "BLADE: an attack-agnostic approach for preventing drive-by malware infections", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)].

And what the 39 did about it. Of the 26 that sent their own requests (25 browser crawls and one Internet-wide server scanner), 13 visited each site once as far as the paper says (two of them only by implication), 18 do not state where they crawled from, and 12 do not discuss cloaking as affecting their count. Across all 39, 11 measured cloaking or evasion on their own data, 9 took a countermeasure without measuring its effect, and 19 say nothing. The detail on looking like a visitor — and on measuring your own block rate — is Crawler detection; which vantage point and the ethics of residential proxies is Crawling location. The rule specific to this page: record, per URL, which identity saw what, how many times, so a benign page is a reading from one vantage, not a verdict.

Two alternatives to crawling that the population used, and that sidestep the visitor problem: passive network data from a campus or ISP [23Nelms, Terry; Perdisci, Roberto; Antonakakis, Manos; Ahamad, Mustaque (2015): "WebWitness: Investigating, Categorizing, and Mitigating Malware Download Paths", in: Proceedings of the USENIX Security Symposium. (Link)] [26Nelms, Terry; Perdisci, Roberto; Antonakakis, Manos; Ahamad, Mustaque (2016): "Towards Measuring and Mitigating Social Engineering Software Download Attacks", in: Proceedings of the USENIX Security Symposium. (Link)] [7Bijmans, Hugo L.J.; Booij, Tim M.; Doerr, Christian (2019): "Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale", in: Proceedings of the USENIX Security Symposium. (Link)], and a host's site backups [10Kasturi, Ranjita Pai; Fuller, Jonathan; Sun, Yiting; Chabklo, Omar; Rodriguez, Andres; Park, Jeman; Saltaformaggio, Brendan (2022): "Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces", in: Proceedings of the USENIX Security Symposium. (Link)]. Both need a partner, and both see what was served or stored rather than what a crawler was shown.

The current delivery route this page's population never measured is a trusted third-party script that changes owner. polyfill.io is the dated, primary-sourced case:

• February 2024. Cloudflare set up a mirror on cdnjs after “the transition of the domain polyfill.io to a new provider (Funnull)”.²³⁾
• 25 June 2024. Sansec reported that “100K+ sites embed it using the cdn.polyfill.io domain” and that the injected code “only activates on specific mobile devices at specific hours” and “does not activate when it detects an admin user”.²⁴⁾ The next day Cloudflare began to “rewrite any link to polyfill.io found in a website proxied by Cloudflare” to its mirror; Sansec's page records that Namecheap then put the domain on hold.²⁵⁾
• 2 July 2024. Censys “still detects 384,773 hosts embedding a polyfill JS script linking to the malicious domain” — hosts, not sites, from an Internet-wide scan.²⁶⁾
• 29 May 2025. The US Treasury sanctioned Funnull, stating that in 2024 it “purchased a repository of code used by web developers and maliciously altered the code to redirect visitors of legitimate websites to scam websites and online gambling sites”.²⁷⁾ No later public government action on polyfill.io or Funnull was found as of 2026-10-08.

What a measurement learns from it:

• Inclusion is measurable; activation is not, from one crawl. The payload targeted mobile devices, at certain hours, and hid from administrators. A desktop crawler from a datacenter at one time of day would have reported every one of those sites clean. Measure who includes the script (a crawl or an archive can do that, historically too: see Archives) separately from what it served to whom, and say which you measured.
• The corpus saw the library, not the attack. A longitudinal crawl of the Alexa top 1M listed polyfill.io among the libraries it version-checked (6,755 sites, 0.9%) and found that “99.7% of websites have at least one externally-hosted JavaScript library without the integrity attribute” [30Lim, Kyungchan; Kwon, Yonghwi; Kim, Doowon (2023): "A Longitudinal Study of Vulnerable Client-side Resources and Web Developers' Updating Behaviors", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]; a 2026 study of government websites found polyfill.io on sites in 41 countries and describes the compromise [31Singh, Sachin Kumar; Mahmud, Faisal; Ricci, Robert; Siby, Sandra (2026): "The Empire Strikes Back (at Your Privacy): An Archaeology of Tracking on Government Websites", Proceedings on Privacy Enhancing Technologies 2026(2):108-126. (DOI)]. Neither measures what was served. The integrity defences — Subresource Integrity adoption, and third parties that block it — are on Headers [32Chapuis, Bertil; Omolola, Olamide; Cherubini, Mauro; Humbert, Mathias; Huguenin, Kévin (2020): "An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources", in: Proceedings of the ACM Web Conference. (DOI)] [33Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]; how often legitimate scripts change, which is why a raw hash breaks, was measured as early as [34Soni, Pratik; Budianto, Enrico; Saxena, Prateek (2015): "The SICILIAN Defense: Signature-based Whitelisting of Web JavaScript", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)].
• Payment pages have a compliance hook. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, effective 31 March 2025, require payment-page scripts to be authorised, integrity-checked and monitored (see the skimming row above). SAQ A merchants (who outsource the payment page) were taken out of these two requirements in January 2025 and instead attest that their site is “not susceptible to attacks from scripts”; the merchants that must inventory their payment-page scripts are a population a study can ask.

The general checklist is Ethics; telling a site that it is compromised, and how often that works, is Notifying websites (start with [35Li, Frank; Ho, Grant; Kuan, Eric; Niu, Yuan; Ballard, Lucas; Thomas, Kurt; Bursztein, Elie; Paxson, Vern (2016): "Remedying Web Hijacking: Notification Effectiveness and Webmaster Comprehension", in: Proceedings of the ACM Web Conference. (DOI)]). Three questions are particular to this page:

• Executing malicious content. Honeyclients run exploits by design; BLADE reverted its virtual machine before every URL [22Lu, Long; Yegneswaran, Vinod; Porras, Phillip A.; Lee, Wenke (2010): "BLADE: an attack-agnostic approach for preventing drive-by malware infections", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. Isolate, revert, and never run a crawler that executes payloads on a network you share.
• Clicking malicious ads costs advertisers. Vadrevu and Perdisci estimated the worst case for one legitimate advertiser at about US$4.8 and limited repeat visits per user agent to keep it there [3Vadrevu, Phani; Perdisci, Roberto (2019): "What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. Say what your clicks cost, and whom.
• Downloading the payload. “Milking” a malicious download URL every 15 minutes [3Vadrevu, Phani; Perdisci, Roberto (2019): "What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] collects malware; say where it is stored and whether it is shared.

In the extraction's own ethics field, 2 of the 39 papers report an approved review, 26 mention none, 1 sought review with no stated outcome, 1 discussed ethics and stated no review was sought, and 9 have no ethics record at all. On notifying the affected parties: 5 partial, 3 no, 2 not applicable, 20 not stated, 9 no record.

“Current” here means used by a 2022–2026 paper in these seven venues — a low bar, and a wider window than Online scams uses (2023–2026), because only two papers in this population are from 2022 or later. The Status column of the detector table further up means something looser — a method you can still use — and says so where it differs. Where a row adds a judgement about what you should do, it is marked.

Everything below is a claim about seven venues — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 extracted papers. EuroS&P, ACSAC, RAID, DIMVA, AsiaCCS and the APWG eCrime symposium are absent; DIMVA, RAID and eCrime publish on this topic. See Corpus. 2025–2026 are provisional. The corpus grew while this page was written: on 2026-10-08, 94 records (81 from IMC 2026, 13 from IEEE S&P 2021–2024) and an IMC 2026 venue index were added. All figures here are pinned to the 5,859-paper, 16,864-record snapshot every other page uses; the 94 were probed and none crosses a candidate threshold.

Seven probes produce a 261-paper candidate set: the 2026-09-22 gap-pass regex; vocabularies for in-browser mining, for drive-by downloads and malicious JavaScript, for malvertising, and for skimming and script supply chain; the extraction's own free-text fields; and, added when the post-2023 zero was re-checked, title plus abstract over the whole venue index. Each candidate was read against a rule written before the verdicts were counted:

• IN — the measured objects include malicious code or content that websites, ads or redirect chains serve to a visitor's browser and that acts against the visitor without consent (exploits, malicious JavaScript, forced or deceptive malware downloads, malicious ads, search poisoning that delivers malware, cryptojacking, payment skimming, malicious code injected into or included by a legitimate site), and the paper collects instances in the wild and measures, detects, clusters or labels them. A detector counts only if evaluated on in-the-wild content. A paper is IN as primary (about it) or section (one section measures it).
• CONTEXT — the adjacent subject owned elsewhere or outside the visitor frame: scams, phishing, script-analysis technique, malicious extensions, host and IoT mining, search abuse with non-malware destinations, malicious-domain infrastructure, how sites get compromised, third-party dependency risk without malicious content, registry packages, mobile in-app ads, lab-only defences, attack demonstrations, exploit-kit server code.
• OUT — incidental mention, non-web malware, physical card skimmers (a homonym), fraud against a platform.

Of the 39, 38 include the web platform and 33 ran a crawl. 5 are also IN on Online scams (malicious ads and redirect systems whose destinations mix malware and scams).

How well each probe finds the population:

The gap pass chose this topic on 124 papers (87 web, 70 crawled, 20 from 2024–2026). The regex re-runs to exactly those numbers; none of its 20 recent papers is in the population. The title-and-abstract channel added 44 candidates no other probe caught, and no IN paper.

*provisional. By venue: CCS 11, TheWebConf 9, USENIX Security 8, IMC 5, IEEE S&P 4, NDSS 2, PETS 0. The decline is real against a growing corpus: from 29 per thousand papers to 1.

Hand-coded from each paper's full text by three coders working from structured reading notes, one batch each, with conservative defaults where the paper is silent; not double-coded. The codes and the quote behind each are on the provenance page.

Released artifacts still online on 2026-10-08 include MineSweeper, Outguard, CMTracker, SEACMA, TRIDENT, the TDS crawler ODIN and the WasmBench WebAssembly corpus; the last commits are 2018–2023. Rüth et al.'s mining data is on Zenodo.

Each figure is the paper's own, with its own denominator, checked against the paper's text. All are historical measurements; date them when you cite them.

Every corpus number is a count of papers, from the 5,859-paper extraction, with its denominator named. The 39 is a hand verdict over a 261-paper candidate set; the report script exits if the candidates and the verdicts diverge in either direction, if an IN paper lacks a method code, or if the funnel or the 2024–2026 reading lists change. The method table was coded from full text by three coders (one batch each) working from reading notes, with two codes made stricter by the page author; it is not double-coded, so treat single-paper differences as soft. One paper (EKHUNTER, NDSS 2015) was moved from IN to context during coding because it analyses exploit-kit server code in a lab rather than content served to visitors. Full-text probes read paper.cols.txt (4 of 5,859 papers have none). Per-paper figures were checked against the papers' text, not the extraction's summaries. The status column of the currency table rests on dated industry and government sources, each re-fetched by a script on 2026-10-08; vendor telemetry is labelled as such. The probes, every verdict with a reason, the codes, the unedited report output, the funnel and the external checks are on malicious_web_content; corpus-wide caveats are on Corpus.

• The phenomenon, and that it was alive when you measured. Name it and date it; if it is on the historical side of the table above, say you are measuring the tail.
• The detector and its validation. Which signals, which thresholds, and the false-positive rate on a hand-checked sample from your own crawl — not the benchmark's.
• The label source with its date and lag. Which list or engine, queried when, how long after your detection. If a list is your label, do not also report its coverage.
• Visits per URL, identity per visit. How many times, from which IP type and location, with which device, user agent and referrer, at what time of day. A cloaking verdict per URL, not a limitations paragraph.
• Inclusion separately from activation. For a third-party script: who included it, and what it served to which visitor — two measurements.
• The window, and the delay to publication. Collection dates; what changed between them and submission.
• Executing, clicking and downloading. What you ran, where, what it cost others, and where the samples are.

• ClickFix, fake CAPTCHAs and fake browser updates on compromised sites are documented by government and vendors through 2026 and named by 0 of the 2024–2026 corpus papers. How many sites serve them, to whom, and for how long, is unmeasured here.
• Web skimming has never been measured in these seven venues. The only academic measurement found is an FTC study at eCrime 2020.
• Third-party script compromise has no prevalence study. Inclusion of a risky script is measurable from crawls and archives; conditional activation needs many identities and times.
• Malvertising since 2023. The vendor reports move from exploits to software-download lures and illegal-streaming redirectors; the last measurement here is of social-engineering ads, from data collected in 2022; the last of ads delivering exploits or malware directly is from 2015.
• Cryptojacking after Coinhive. One vendor reports 3,500+ infected sites in 2025; the only post-shutdown measurements are outside the venues. Whether this is a tail or a revival is open.
• No paper in this population uses an LLM to detect or label served content.
• No PETS paper is in the population. That is a finding about seven venues and 39 papers, not about PETS.

• Security — namespace outline.
• Online scams — content whose harm is a payment; shares the malicious-ad and traffic-distribution papers.
• Phishing — credentials and wallet drainers; Safe Browsing as a feed.
• VirusTotal — what a “detected” bit is.
• Headers — Subresource Integrity and CSP, the defences against a swapped script.
• Web vulnerabilities — the hole, not what comes through it.
• JavaScript — script analysis, obfuscation and attribution methods.
• Crawler detection and Crawling location — being shown what a visitor is shown.
• Archives — historical inclusion of a script.
• Ethics and Notifying websites — review, and telling a compromised site.

[1]

Yang, Zheng; Allen, Joey; Landen, Matthew; Perdisci, Roberto; Lee, Wenke (2023): "TRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks", in: Proceedings of the USENIX Security Symposium. (Link)

[2]

Rüth, Jan; Zimmermann, Torsten; Wolsing, Konrad; Hohlfeld, Oliver (2018): "Digging into Browser-based Crypto Mining", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Vadrevu, Phani; Perdisci, Roberto (2019): "What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[4]

Szurdi, Janos; Luo, Meng; Kondracki, Brian; Nikiforakis, Nick; Christin, Nicolas (2021): "Where are you taking me?Understanding Abusive Traffic Distribution Systems", in: Proceedings of the ACM Web Conference. (DOI)

[5]

Kolbitsch, Clemens; Livshits, Benjamin; Zorn, Benjamin G.; Seifert, Christian (2012): "Rozzle: De-cloaking Internet Malware", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[6]

Konoth, Radhesh Krishnan; Vineti, Emanuele; Moonsamy, Veelasha; Lindorfer, Martina; Kruegel, Christopher; Bos, Herbert; Vigna, Giovanni (2018): "MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[7]

Bijmans, Hugo L.J.; Booij, Tim M.; Doerr, Christian (2019): "Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Li, Zhou; Alrwais, Sumayah A.; Wang, XiaoFeng; Alowaisheq, Eihal (2014): "Hunting the Red Fox Online: Understanding and Detection of Mass Redirect-Script Injections", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Borgolte, Kevin; Kruegel, Christopher; Vigna, Giovanni (2013): "Delta: automatic identification of unknown web-based infection campaigns", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[10]

Kasturi, Ranjita Pai; Fuller, Jonathan; Sun, Yiting; Chabklo, Omar; Rodriguez, Andres; Park, Jeman; Saltaformaggio, Brendan (2022): "Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces", in: Proceedings of the USENIX Security Symposium. (Link)

[11]

Li, Zhou; Zhang, Kehuan; Xie, Yinglian; Yu, Fang; Wang, XiaoFeng (2012): "Knowing your enemy: understanding and detecting malicious web advertising", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[12]

Zarras, Apostolis; Kapravelos, Alexandros; Stringhini, Gianluca; Holz, Thorsten; Kruegel, Christopher; Vigna, Giovanni (2014): "The Dark Alleys of Madison Avenue: Understanding Malicious Advertisements", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[13]

Grier, Chris; Ballard, Lucas; Caballero, Juan; Chachra, Neha; Dietrich, Christian J.; Levchenko, Kirill; Mavrommatis, Panayiotis; McCoy, Damon; Nappa, Antonio; Pitsillidis, Andreas; Provos, Niels; Rafique, M. Zubair; Rajab, Moheeb Abu; Rossow, Christian; Thomas, Kurt; Paxson, Vern; Savage, Stefan; Voelker, Geoffrey M. (2012): "Manufacturing compromise: the emergence of exploit-as-a-service", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[14]

Hilbig, Aaron; Lehmann, Daniel; Pradel, Michael (2021): "An Empirical Study of Real-World WebAssembly Binaries: Security, Languages, Use Cases", in: Proceedings of the ACM Web Conference. (DOI)

[15]

Naseem, Faraz; Aris, Ahmet; Babun, Leonardo; Tekiner, Ege; Uluagac, A. Selcuk (2021): "MINOS: A Lightweight Real-Time Cryptojacking Detection System", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[16]

Hong, Geng; Yang, Zhemin; Yang, Sen; Zhang, Lei; Nan, Yuhong; Zhang, Zhibo; Yang, Min; Zhang, Yuan; Qian, Zhiyun; Duan, Hai-Xin (2018): "How You Get Shot in the Back: A Systematical Study about Cryptojacking in the Real World", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[17]

Subramani, Karthika; Yuan, Xingzi; Setayeshfar, Omid; Vadrevu, Phani; Lee, Kyu Hyung; Perdisci, Roberto (2020): "When Push Comes to Ads: Measuring the Rise of (Malicious) Push Advertising", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Starov, Oleksii; Zhou, Yuchen; Zhang, Xiao; Miramirkhani, Najmeh; Nikiforakis, Nick (2018): "Betrayed by Your Dashboard: Discovering Malicious Campaigns via Web Analytics", in: Proceedings of the ACM Web Conference. (DOI)

[19]

Lu, Long; Perdisci, Roberto; Lee, Wenke (2011): "SURF: detecting and measuring search poisoning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[20]

Moore, Tyler; Leontiadis, Nektarios; Christin, Nicolas (2011): "Fashion Crimes: Trending-Term Exploitation on the Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[21]

Cova, Marco; Krügel, Christopher; Vigna, Giovanni (2010): "Detection and analysis of drive-by-download attacks and malicious JavaScript code", in: Proceedings of the ACM Web Conference. (DOI)

[22]

Lu, Long; Yegneswaran, Vinod; Porras, Phillip A.; Lee, Wenke (2010): "BLADE: an attack-agnostic approach for preventing drive-by malware infections", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[23]

Nelms, Terry; Perdisci, Roberto; Antonakakis, Manos; Ahamad, Mustaque (2015): "WebWitness: Investigating, Categorizing, and Mitigating Malware Download Paths", in: Proceedings of the USENIX Security Symposium. (Link)

[24]

Nappa, Antonio; Xu, Zhaoyan; Rafique, M. Zubair; Caballero, Juan; Gu, Guofei (2014): "CyberProbe: Towards Internet-Scale Active Detection of Malicious Servers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[25]

Stringhini, Gianluca; Kruegel, Christopher; Vigna, Giovanni (2013): "Shady paths: leveraging surfing crowds to detect malicious web pages", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[26]

Nelms, Terry; Perdisci, Roberto; Antonakakis, Manos; Ahamad, Mustaque (2016): "Towards Measuring and Mitigating Social Engineering Software Download Attacks", in: Proceedings of the USENIX Security Symposium. (Link)

[27]

Kharraz, Amin; Ma, Zane; Murley, Paul; Lever, Charles; Mason, Joshua; Miller, Andrew; Borisov, Nikita; Antonakakis, Manos; Bailey, Michael D. (2019): "Outguard: Detecting In-Browser Covert Cryptocurrency Mining in the Wild", in: Proceedings of the ACM Web Conference. (DOI)

[28]

Li, Zhou; Alrwais, Sumayah A.; Xie, Yinglian; Yu, Fang; Wang, XiaoFeng (2013): "Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[29]

Invernizzi, Luca; Comparetti, Paolo Milani; Benvenuti, Stefano; Kruegel, Christopher; Cova, Marco; Vigna, Giovanni (2012): "EvilSeed: A Guided Approach to Finding Malicious Web Pages", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[30]

Lim, Kyungchan; Kwon, Yonghwi; Kim, Doowon (2023): "A Longitudinal Study of Vulnerable Client-side Resources and Web Developers' Updating Behaviors", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[31]

Singh, Sachin Kumar; Mahmud, Faisal; Ricci, Robert; Siby, Sandra (2026): "The Empire Strikes Back (at Your Privacy): An Archaeology of Tracking on Government Websites", Proceedings on Privacy Enhancing Technologies 2026(2):108-126. (DOI)

[32]

Chapuis, Bertil; Omolola, Olamide; Cherubini, Mauro; Humbert, Mathias; Huguenin, Kévin (2020): "An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources", in: Proceedings of the ACM Web Conference. (DOI)

[33]

Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[34]

Soni, Pratik; Budianto, Enrico; Saxena, Prateek (2015): "The SICILIAN Defense: Signature-based Whitelisting of Web JavaScript", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[35]

Li, Frank; Ho, Grant; Kuan, Eric; Niu, Yuan; Ballard, Lucas; Thomas, Kurt; Bursztein, Elie; Paxson, Vern (2016): "Remedying Web Hijacking: Notification Effectiveness and Webmaster Comprehension", in: Proceedings of the ACM Web Conference. (DOI)

[36]

Zhang, Mingxue; Meng, Wei; Lee, Sangho; Lee, Byoungyoung; Xing, Xinyu (2019): "All Your Clicks Belong to Me: Investigating Click Interception on the Web", in: Proceedings of the USENIX Security Symposium. (Link)

[37]

Liao, Xiaojing; Alrwais, Sumayah A.; Yuan, Kan; Xing, Luyi; Wang, XiaoFeng; Hao, Shuang; Beyah, Raheem A. (2016): "Lurking Malice in the Cloud: Understanding and Detecting Cloud Repository as a Malicious Service", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)