Malicious URL Detection

​

What it detects

• MALWARE — pages distributing malware.
• SOCIAL_ENGINEERING — phishing or social-engineering pages.
• UNWANTED_SOFTWARE — sites distributing unwanted software (toolbars, bundleware).

​

How it works

1. Extract URLs from the input using the urlextract library and a recent TLD list (refreshed when older than 7 days).
2. For each extracted URL, call the Web Risk API.
3. Return per-URL verdicts and counts.

​

Parameters

​

Outputs and metrics

{
  "urls": [
    { "url": "https://safe-corp.example",
      "is_safe": true,  "threat_types": [] },
    { "url": "https://phish.bad.example",
      "is_safe": false, "threat_types": ["SOCIAL_ENGINEERING"] }
  ],
  "metrics": {
    "processing_time_ms": 12.4,
    "urls_detected_count": 2,
    "unsafe_urls_count": 1
  },
  "status": "OK"
}

​

Termination signals

​

Limits and cost

​

Typical latency

​

When to use it

• Always on. URL Risk is one of the cheapest analyzers and catches a category of attack the ML analyzers do not.
• Both directions. Inbound: catches user-submitted phishing. Outbound: catches LLMs that hallucinated a malicious link.
• Pair with YARA. YARA is the right tool for URL patterns you care about beyond Web Risk’s categories (e.g. internal hostnames you do not want appearing in outputs).

​

Failure modes

• Web Risk error on a URL → that URL is treated as unsafe; the metric overcounts. The analyzer does not error; the run continues.
• Web Risk fully unreachable → analyzer_unavailable 503 with Retry-After.

​

Next

• Combined analyzer — wire url_risk into termination rules.
• YARA — for URL patterns Web Risk does not cover.