Menlo Security just released their third annual "State of the Web" report and it's not pretty. The headline finding is that 42% of the top 100,000 sites as ranked by Alexa are more dangerous than you think.
The report defines a risky site as one that meets one of three criteria:
The site, or one of its associated background sites (from which news articles or video is pulled), is running software with a known security vulnerability
The site has been used to launch attacks or distribute malware
The site has suffered a security breach in the past twelve months
This first point is key, and often overlooked by security professionals.