Checking the reputation of a URL is a useful approach but of course does not cover every malware or phishing URL. URL based filtering is very fast when compared to the analysis of the response payload. This allows for an early and cheap blocking of the access to potential malicious resources and thus might also preserve more resources to deeper analysis of yet unknown sites.
Reputation is commonly not done based on a specific URL but on the site, i.e. if there is a single definite malware infection on this site then the whole site (or sometimes even the IP address) gets a bad reputation. This makes sense because if the attacker manages to have one URL on the site deliver malware then chances are high that the attacker is able to control more than this one URL.
Reputation services can also not simply be tricked by letting somebody like virustotal check the URL or a even the whole site. Instead these reputation services scan the web themselves and also get user input or information about bad sites from analyzing phishing or spam mails. They also include historical information about domains, i.e. how old the domain is, how often the IP addresses have changed in the past etc. One widely used reputation service is Google Safe Browsing which is enabled by default in Chrome and Firefox.
This does not mean that attackers don't try to work around these reputation services because they actually hamper their business. One way is to hack sites with a good reputation and use these for malware distribution. For example Jamie Olivers website was hacked multiple times in 2015 and used to spread malware.