# web measurement

Using a Puppeteer crawler on AWS Lambda, the authors ran a 40-day longitudinal measurement (March 13–April 21, 2026) over 55,393 trending Google queries across 19 topical categories and found that AI Overviews activate on 13.7% of queries overall (64.7% for question-form queries), that cited domains are more credible than co-displayed first-page results yet 29.8% do not appear on the first page at all, that 11.0% of 98,020 atomic claims are unsupported by the cited pages with omission as the dominant failure mode, and that at least 50.6% of cited pages carry display advertising.

Using a Puppeteer crawler on AWS Lambda, the authors ran a 40-day longitudinal measurement (March 13–April 21, 2026) over 55,393 trending Google queries across 19 topical categories and found that AI Overviews activate on 13.7% of queries overall (64.7% for question-form queries), that cited domains are more credible than co-displayed first-page results yet 29.8% do not appear on the first page at all, that 11.0% of 98,020 atomic claims are unsupported by the cited pages with omission as the dominant failure mode, and that at least 50.6% of cited pages carry display advertising.

The authors built an automated detection system combining lexical URL filtering, dynamic rendering, OCR-based extraction, and content classification, applied it to 6,094,475 public URLs collected from VirusTotal, URLScan.io, Hybrid Analysis, the Wayback Machine, and RedHunt paste sites, and identified 12,331 potential exposures across authentication, financial, personal, and document-related categories, including 26 live password-reset links, 83 API keys, 12 publicly accessible e-signature workflows, 7 fully visible 2FA backup codes, and 62 JWTs lacking expiration constraints.

The authors built an automated detection system combining lexical URL filtering, dynamic rendering, OCR-based extraction, and content classification, applied it to 6,094,475 public URLs collected from VirusTotal, URLScan.io, Hybrid Analysis, the Wayback Machine, and RedHunt paste sites, and identified 12,331 potential exposures across authentication, financial, personal, and document-related categories, including 26 live password-reset links, 83 API keys, 12 publicly accessible e-signature workflows, 7 fully visible 2FA backup codes, and 62 JWTs lacking expiration constraints.