Check links in user content against phishing and malware lists

How to do it

Scammers post links to fake sign-in pages and to malware, and a link that was clean when posted can turn bad later. Check at post time to block, and at click time through your own redirect page. Sign the target on that page, so it never becomes an open redirect. Lists come from services such as Google Web Risk, because Google says its Safe Browsing API is for non-commercial use only. Its version 5 lookup sends only a 4-byte hash prefix of each address. Expand short links on the server, within the limits of Fetch only allowed addresses, and check the final address too. A matched link from a new account is a strong signal for Score every sign-up for risk.

Examples

JavaScript example

export async function checkLinks(item) {
  const urls = extractUrls(item.text);
  const finalUrls = await Promise.all(urls.map(expandShortLink));
  const matches = await threatList.lookup(finalUrls);
  if (matches.length) await cases.create({ itemId: item.id, reason: 'scam', source: 'link-scan', matches });
  return matches.length === 0;
}

Python example

async def check_links(item) -> bool:
    final_urls = [await expand_short_link(url) for url in extract_urls(item.text)]
    matches = await threat_list.lookup(final_urls)
    if matches:
        await cases.create(item_id=item.id, reason="scam", source="link-scan", matches=matches)
    return not matches

How to check

A test posts the list provider's test phishing address and a clean address. The first is hidden and a case opens, and the second shows. A short link that redirects to the test address is caught too. A list change after posting makes the click page warn instead of redirecting.

Sources

• Google Safe Browsing overview
• Google Safe Browsing API reference

Related rules

• APS-40 Redirect only to your own pages in Application security
• APS-41 Fetch only allowed addresses in Application security
• TNS-11 Score every sign-up for risk in Trust and safety
• TNS-27 Keep marketplace deals on the platform and flag scams in Trust and safety