I have not seen anything pivot between the browser and the user that can inform them before the connection is made. Any add-on or application would take a serious beating processing so many variables. Let's have a look:
Requester (via browser whether initiated or not) --> browser --> Go get this malice.com/bad.cgi
How far do you think you'd be able to process the iterations when bad.cgi changes every N amount of minutes, seconds, etc? Forget the iterations, what are you planning on doing when the request becomes:
Requester --> browser --> www.urlshortenerservice.com/tempURI
The connection is/was already initiated. For all you know, the malice could occur on the URL shortening service before being passed off to a legitimate page.
My view when it comes to malware/malicious sites/networks, is blacklisting on the OUTBOUND side of the equation. I noted the mention of "security zones" which don't always work. There have been instances, where malware authors buy legitimate ad space to infect visitors. Imagine the following: Malicious attacks purchases ad words/graphics on say Yahoo.com. It is a whitelisted site, the browser in its "security zones" wisdom would allow the connection through. There is no definitive method to stop this from happening, no matter how deep your "deep packet inspection" is.
On the flip side of the equation, remember, we (you) are trying to stop your machine from making a bad choice (connection). Malware/malicious website operators often program quite a few different mechanism to "get out" e.g.:
maliciousSomething --> try getting here --> Interwebs ; if fail then ;
try getting here instead --> Interwebst ; if fail then ;
generate obfuscation --> try getting here
What is the commonality here? ... The destination "here" where "here" can be isolated on not only the corp. firewall, but on local firewalls as well (local as in Windows firewalls). Downside of this is, malicious authors compromise machines all the time, so blacklisting, whitelisting is a losing battle.
If things are "that extreme" where security is of the "utmost" priority, then I'd recommend using a proxy (Squid or so) along with netsed, and outright stripping potentially dangerous strings before the connection is made. e.g.
machineOnNetwork --> gohere.com/malicious.js --> proxy --> interwebs
proxy --> before I send you anywhere... Let me regex check and replace things --> interwebs
That too becomes cumbersome since you'd have potentially an infinite amount of regex rules at the end of the day. What you posted is an ongoing battle most AV vendors go through on a daily, as well as software developers. I'd love to see your solution at the end of the day. If you ask me, there are only bandaids to this problem.