Does SafeBrowsing actually work with the URL paths or does it only look at the domains? If it is just the domains, does it also look at the subdomains or are the results for example.com and x.example.com going to be the same?


The details of Google's SafeBrowsing request can be found in their API documentation, which is freely available here.

On this page, the URL expected is described as "valid URL string following the RFC 1738", or more verbosely:

The url parameter indicates the URL to look up. This must be a valid and properly encoded URL. Non-ASCII characters must be in UTF-8. For example, if the URL contains an '&', it could be interpreted as the CGI parameter separator. Therefore, all reserved characters must use percent encoding, which is defined in RFC 3986 .

Therefore SafeBrowsing works with the full URL (which does not mean that, seeing too many suspicious URL matching the same domain, it may not internally flag the domain itself as suspicious, but this is Google's internal recipe and I doubt any official public information is available on the exact algorithms they use).

| improve this answer | |
  • I checked the documentation, but wanted to know what actually happens. As far as my limited experience goes, there is a blanket blacklisting for the entire domain. So I wanted to know what the experts think – r.v Jan 25 '15 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.