URL risk analysis using heuristics and scanning

A method comprising steps of:

• responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database;
• loading the URL;
• receiving artifacts based on the loading;
• using the plurality of listener modules to run rules based on the received artifacts;
• scoring the URL based on the rules and the received artifacts;
• and
• determining whether the URL is one of benign, suspicious, or malicious based on the scoring.

A server comprising:

• a network interface communicatively coupled to a network;
• a processor communicatively coupled to the network interface;
• and
• memory storing computer-executable instructions that, when executed, cause the processor to
• responsive to starting a plurality of listener modules, receive a Uniform Resource Locator (URL) for a site on the Internet into a database;
• load the URL;
• receive artifacts based on the loading;
• use the plurality of listener modules to run rules based on the received artifacts;
• score the URL based on the rules and the received artifacts;
• and
• determine whether the URL is one of benign, suspicious, or malicious based on the scoring.