---
title: "Check links in user content against · Agent Wranglers"
url: https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/link-scanning
id: TNS-19
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1170
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check links in user content against phishing and malware lists

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TNS-19
- Level: Recommended
- Chapter: [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)
- Rule: Check every link in a post, message, profile or listing against a list of known phishing and malware addresses. Check it when it is posted and again when it is clicked. Hide each match and open a case.
- Check: A test posts the list provider's test phishing address and a clean address. The first is hidden and a case opens, and the second shows. A short link that redirects to the test address is caught too. A list change after posting makes the click page warn instead of redirecting.
- How: Scammers post links to fake sign-in pages and to malware, and a link that was clean when posted can turn bad later. Check at post time to block, and at click time through your own redirect page. Sign the target on that page, so it never becomes an [open redirect](https://agentwranglers.se/playbook/application-security/browser-security-headers/block-open-redirects.md). Lists come from services such as Google Web Risk, because Google says its Safe Browsing API is for non-commercial use only. Its version 5 lookup sends only a 4-byte hash prefix of each address. Expand short links on the server, within the limits of [Fetch only allowed addresses](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery.md), and check the final address too. A matched link from a new account is a strong signal for [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export async function checkLinks(item) {
  const urls = extractUrls(item.text);
  const finalUrls = await Promise.all(urls.map(expandShortLink));
  const matches = await threatList.lookup(finalUrls);
  if (matches.length) await cases.create({ itemId: item.id, reason: 'scam', source: 'link-scan', matches });
  return matches.length === 0;
}
```

### Python example

```python
async def check_links(item) -> bool:
    final_urls = [await expand_short_link(url) for url in extract_urls(item.text)]
    matches = await threat_list.lookup(final_urls)
    if matches:
        await cases.create(item_id=item.id, reason="scam", source="link-scan", matches=matches)
    return not matches
```

## Sources

- [Google Safe Browsing overview](https://developers.google.com/safe-browsing)
- [Google Safe Browsing API reference](https://developers.google.com/safe-browsing/reference)

## Related rules

- APS-40 [Redirect only to your own pages](https://agentwranglers.se/playbook/application-security/browser-security-headers/block-open-redirects.md) in Application security
- APS-41 [Fetch only allowed addresses](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery.md) in Application security
- TNS-11 [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md) in Trust and safety
- TNS-27 [Keep marketplace deals on the platform and flag scams](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/marketplace-scams.md) in Trust and safety

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/link-scanning">Agent Wranglers trust and safety playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Spot banned people who sign up again](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/ban-evasion.md)
- Next: [Keep marketplace deals on the platform and flag scams](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/marketplace-scams.md)
- [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)