Google Safe Browsing Checker & Threat Validator

Perform deep, real-time validation against the Google Safe Browsing v4/v5 APIs. Check URLs, hostnames, and IP addresses for malware, phishing, and unwanted software classifications to ensure domain reputation and email deliverability.

No signup

Instant results

100% free

Why Real-Time Safe Browsing Validation Matters

If your domain or email infrastructure gets flagged by Google Safe Browsing (GSB), your email deliverability will plummet, and users will see full-page interstitial warnings (Red Screens of Death) when clicking your links. Monitoring your domains via the Update API or Web Risk API ensures you can detect and mitigate compromise—such as cross-site scripting (XSS) payloads or rogue subdomains—before mail providers block your outbound MTA traffic.

Why It Matters

If your domain or email infrastructure gets flagged by Google Safe Browsing (GSB), your email deliverability will plummet, and users will see full-pag...

Common GSB & Web Risk Pitfalls

Failing to monitor third-party assets and CDNs linked in your email templates, which can trigger a phishing classification.

URL_HASH

GSB_API_QUERY

THREAT_MATCH

MALWARE_DETECTED

SAFE_BROWSING_V4

UNSAFE_URL

How It Works

Step

URL Normalization: The input URL is canonicalized following RFC 3986, stripping unnecessary query pa

Step

SHA-256 Hashing: The normalized URL expressions (domain and path variations) are hashed using SHA-25

Step

Prefix Lookup: The tool queries a localized cache of 32-bit hash prefixes provided by the GSB Update

Step

Full Hash Verification: If a prefix match occurs, a secure real-time query is dispatched to fetch fu

Real-Time Threat List Queries

Validates against live Google threat databases to immediately flag active phishing, malware, and social engineering vectors.

SHA-256 Prefix Hashing Support

Implements standard prefix-based checks to ensure privacy-preserving lookups without transmitting raw URLs to the upstream API.

Canonical URL Normalization

Automatically normalizes complex and obfuscated URIs, unescaping percent-encoding to accurately match Google's backend format.

Actionable Deliverability Insights

Correlates Safe Browsing flags with potential MTA SMTP rejection codes to help diagnose email blacklisting.

Subdomain & Path Granularity

Identifies localized compromises by checking specific hostname, path, and query parameter variations concurrently.

Cache Control Compliance

Respects Google's caching directives (positive/negative TTLs) to provide accurate status without rate-limiting.

Frequently Asked Questions

How does Google Safe Browsing impact email deliverability?

Major ISPs and MTAs (like Gmail and Yahoo) scan incoming emails for links. If any hyperlink resolves to a domain flagged by Google Safe Browsing, the message is typically rejected at the SMTP transaction layer with a 5xx error or routed directly to the spam folder, drastically harming sender reputation.

What is the difference between the Update API and the Lookup API?

The Lookup API sends plain-text URLs to Google to check their status, which is simpler but less private. The Update API (v4/v5) downloads lists of 32-bit hashed URL prefixes to check locally first, only requesting full hashes from Google when a local prefix match occurs, ensuring greater privacy.

Which threat types does this tool detect?

It checks against standard GSB threat lists, primarily MALWARE, SOCIAL_ENGINEERING (phishing), UNWANTED_SOFTWARE, and POTENTIALLY_HARMFUL_APPLICATION. Being listed under any of these categories will trigger red warnings in modern browsers like Chrome, Firefox, and Safari.

How quickly are domains removed after mitigation?

Once you have cleaned the compromised resources and submitted a review request via Google Search Console, the automated re-crawling and delisting process typically takes between 12 to 72 hours, assuming the malicious payloads are fully remediated.

Why is URL normalization critical before hashing?

Attackers often use obfuscation—such as hex encoding, excessive trailing slashes, or mixed casing—to bypass filters. Normalizing the URL according to Google's strict canonicalization rules ensures that the generated SHA-256 hashes perfectly match the threat lists.

Can a single bad link compromise my entire domain's reputation?

Yes. If a malicious file is hosted on a deep path (e.g., example.com/uploads/malware.exe), Google may flag the specific URL. However, repeated violations or severe infrastructure compromises can result in the entire hostname or even the root domain being globally blacklisted.

Does this tool use the new Web Risk API?

Yes, our validation logic is aligned with Google Cloud's Web Risk API and the latest GSB v5 protocols, ensuring compliance with modern enterprise security standards and accurate threat intelligence.

Guru Guides

Phishing Threats

Phishing is the #1 ransomware entry point. Learn the technical and human controls that stop them.

Typosquatting

Learn how lookalike domains exploit user mistakes and brand trust for phishing and abuse.

Attack Surface Management

Understand why unknown assets, exposed paths, and weak internet-facing controls need continuous review.

Related Security Tools

Validate Your URLs Now

Don't let hidden malware or phishing flags destroy your domain reputation. Use our real-time Safe Browsing checker to instantly verify your infrastructure.

Start Free Trial View Pricing