Phishing & Malware Domain Detection

The problem: phishing infrastructure moves faster than your defenses

Phishing is no longer a volume game played from a handful of long-lived domains. It is an industrialized, disposable-infrastructure business: attackers register a domain, deploy a kit cloned from a bank or SaaS login page, harvest credentials for a few hours, and abandon the domain before most blocklists have propagated. Anti-phishing research consistently finds that the operational window of a phishing page is measured in hours, not days — median lifetimes in published takedown studies sit under 24 hours, and a large share of campaigns do their damage in the first few hours after launch. A defense that updates on a daily or weekly cadence is structurally late to every campaign that matters.

One call: category and threat verdict together

POST a URL to the web-content-filtering endpoint and the response carries the classification alongside the malware field. A flagged URL returns the Web Risk threat class it matched; a clean URL returns an explicit all-clear. There is nothing to correlate downstream — the enrichment record for your proxy log, email pipeline or SIEM is complete in one round trip.

curl -X POST "https://www.websitecategorizationapi.com/api/iab/iab_web_content_filtering.php" \
  -d "query=http://suspicious-login-portal.example" \
  -d "api_key=YOUR_API_KEY" \
  -d "data_type=url"

import requests

resp = requests.post(
    "https://www.websitecategorizationapi.com/api/iab/iab_web_content_filtering.php",
    data={
        "query": url,
        "api_key": API_KEY,
        "data_type": "url",
    },
    timeout=60,
)
result = resp.json()

threat = result.get("malware", "no malware detected")
if threat != "no malware detected":
    block(url, reason=threat)      # e.g. SOCIAL_ENGINEERING

{
  "classification": [
    {"category": "Personal Finance", "value": 0.91},
    {"category": "Business and Finance", "value": 0.06}
  ],
  "malware": "SOCIAL_ENGINEERING",
  "status": 200
}

{
  "classification": [
    {"category": "Technology & Computing", "value": 0.88},
    {"category": "Business and Finance", "value": 0.09}
  ],
  "malware": "no malware detected",
  "status": 200
}

Enriching alerts: category + domain age + threat verdict

In a SOC pipeline the three signals compose into a graduated response instead of a binary one. A confirmed Web Risk hit blocks immediately; a young domain masquerading as a finance or login-adjacent category escalates for review even before any feed has flagged it; an aged, clean, expected category passes at full speed.

def enrich_and_triage(url, api_result, domain_age_days):
    threat   = api_result.get("malware", "no malware detected")
    category = api_result["classification"][0]["category"]

    if threat in ("SOCIAL_ENGINEERING", "MALWARE", "UNWANTED_SOFTWARE"):
        return {"action": "BLOCK", "severity": "high",
                "reason": f"Google Web Risk: {threat}"}

    if domain_age_days < 30 and category in SENSITIVE_CATEGORIES:
        # e.g. Personal Finance, Technology & Computing login portals
        return {"action": "QUARANTINE", "severity": "medium",
                "reason": f"{domain_age_days}-day-old domain classified as {category}"}

    if domain_age_days < 30:
        return {"action": "ALERT", "severity": "low",
                "reason": "newly registered domain, category benign"}

    return {"action": "ALLOW", "severity": "none",
            "reason": f"aged domain, {category}, no Web Risk match"}

Where teams deploy it