This namespace is for measuring web security as it is deployed — TLS on public sites, the headers a crawl can see, the label sources people use for “malicious”, phishing sites in the wild, web vulnerabilities classified in papers that also measured the web. It is not a tutorial on attacks, and it is not the rest of computer security. The publication corpus behind these pages is seven broad security, privacy and measurement venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, 5,859 extracted papers), so a keyword search for “security” is not a population. Each child page names its own.

These pages already exist and already cover the overlapping question. Do not recreate them under security::

• ethics — the scanning-ethics checklist (Hantke et al.), acceptable-use, identifying your crawler. A “vulnerability scanning ethics” child was considered and rejected for this reason.
• notifying_websites — how to tell an operator, and the response rates in this corpus.
• website_classification — VirusTotal as a topic classifier (Vallina et al., vendor taxonomies, the public-API rate cap already dated there). VirusTotal is the other use of the same API.
• mobile_and_app_measurement — certificate pinning and TLS interception inside apps.
• ip_classification — reputation and geolocation of addresses, including some of the same feeds.
• javascript — script-level analysis; XSS-as-a-JavaScript-phenomenon belongs with Web vulnerabilities when the question is “is this live site exploitable”, and there when the question is “what did this script do”.

Three candidates from the original brief were measured and not given a page. Google Safe Browsing was measured too and folded into Phishing rather than rejected:

Google Safe Browsing (full-text 110) sits on Phishing next to PhishTank, not as a sixth page: it is a feed, and the phishing page is about feeds.

Every number in the table above is a count of papers, from the 5,859-paper extraction, with the denominator named in the same cell. Full-text probes read paper.cols.txt (4 of 5,859 have none and are counted as negatives). 2025–2026 venue-years are provisional — see corpus. The queries, the folds, the residue, and the unedited report output are on security.

[1]

Holz, Ralph; Braun, Lothar; Kammenhuber, Nils; Carle, Georg (2011): "The SSL landscape: a thorough analysis of the X.509 PKI using active and passive measurements", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Durumeric, Zakir; Kasten, James; Bailey, Michael D.; Halderman, J. Alex (2013): "Analysis of the HTTPS certificate ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Kotzias, Platon; Razaghpanah, Abbas; Amann, Johanna; Paterson, Kenneth G.; Vallina-Rodriguez, Narseo; Caballero, Juan (2018): "Coming of Age: A Longitudinal Study of TLS Deployment", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[4]

Durumeric, Zakir; Adrian, David; Mirian, Ariana; Bailey, Michael D.; Halderman, J. Alex (2015): "A Search Engine Backed by Internet-Wide Scanning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[5]

Aas, Josh; Barnes, Richard; Case, Benton; Durumeric, Zakir; Eckersley, Peter; Flores-López, Alan; Halderman, J. Alex; Hoffman-Andrews, Jacob; Kasten, James; Rescorla, Eric; Schoen, Seth D.; Warren, Brad (2019): "Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[6]

Durumeric, Zakir; Adrian, David; Stephens, Phillip; Wustrow, Eric; Halderman, J. Alex (2024): "Ten Years of ZMap", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[7]

Weichselbaum, Lukas; Spagnuolo, Michele; Lekies, Sebastian; Janc, Artur (2016): "CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[8]

Roth, Sebastian; Barron, Timothy; Calzavara, Stefano; Nikiforakis, Nick; Stock, Ben (2020): "Complex security policy? A longitudinal analysis of deployed content security policies", in: Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).

[9]

Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[10]

Peng, Peng; Yang, Limin; Song, Linhai; Wang, Gang (2019): "Opening the Blackbox of VirusTotal: Analyzing Online Phishing Scan Engines", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[11]

Zhang, Penghui; Oest, Adam; Cho, Haehyun; Sun, Zhibo; Johnson, RC; Wardman, Brad; Sarker, Shaown; Kapravelos, Alexandros; Bao, Tiffany; Wang, Ruoyu; Shoshitaishvili, Yan; Doupé, Adam; Ahn, Gail-Joon (2021): "CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[12]

Steffens, Marius; Rossow, Christian; Johns, Martin; Stock, Ben (2019): "Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild", in: Proceedings of the Network and Distributed System Security Symposium. (Link)