Malicious Links

Malicious Link Detection identifies and validates URLs in LLM outputs to protect users from phishing, malware, and other harmful websites.

The Risk

LLMs can include URLs in their responses from:

• Training data — Memorized URLs that may now be compromised
• User requests — “Generate a link to…” prompts
• Injected content — Attackers embedding malicious links

These URLs may lead to:

• Phishing sites
• Malware downloads
• Compromised domains
• Typosquatting attacks

Detection Approach

Glitch uses a multi-layer approach:

1. Known Malicious Domains

Block URLs from domains on threat intelligence feeds.

2. Unknown Domain Flagging

Flag URLs from domains not in your known-safe list for review.

3. Pattern Analysis

Detect suspicious URL patterns (unusual TLDs, excessive subdomains, URL shorteners).

Configuration

Basic Link Protection

{
  "output_detectors": [
    { "detector_type": "unknown_links", "threshold": "L2", "action": "flag" }
  ]
}

Strict Link Protection

{
  "output_detectors": [
    { "detector_type": "unknown_links", "threshold": "L3", "action": "block" }
  ],
  "allow_list": {
    "entries": [
      "*.yourcompany.com",
      "github.com",
      "docs.python.org"
    ],
    "match_type": "wildcard"
  }
}

Threshold Behavior

Level	Behavior
L1	Only flag known malicious URLs
L2	Flag known malicious + highly suspicious patterns
L3	Flag all unknown domains
L4	Flag all URLs not in allow list

Tip

Start with L2 to catch obvious threats without over-flagging. Move to L3 if your application should only link to known-safe domains.

Detection Examples

Known Malicious

Output: "Download from http://malware-site.ru/file.exe"

Detection: unknown_links
Confidence: 0.99
Action: BLOCKED

Note: Domain is on threat intelligence blocklist.

Typosquatting

Output: "Check out https://goggle.com for more info"

Detection: unknown_links
Confidence: 0.85
Action: FLAGGED

Note: Similar to legitimate domain (google.com).

URL Shortener

Output: "Visit https://bit.ly/abc123 for details"

Detection: unknown_links
Confidence: 0.70
Action: FLAGGED (at L2)

Note: URL shorteners hide the true destination.

Allowed Domain

Output: "See the docs at https://docs.yourcompany.com/guide"

Detection: unknown_links
Confidence: 0.0 (allow-listed)
Action: ALLOWED

Note: Domain matches allow list pattern.

Allow List Configuration

Define safe domains to bypass link detection:

Exact Match

{
  "allow_list": {
    "entries": [
      "docs.yourcompany.com",
      "github.com"
    ],
    "match_type": "exact"
  }
}

Wildcard Match

{
  "allow_list": {
    "entries": [
      "*.yourcompany.com",
      "*.github.com",
      "*.python.org"
    ],
    "match_type": "wildcard"
  }
}

Caution

Be careful with wildcards. *.com would allow any .com domain!

Deny List for Known Bad Domains

Block specific domains regardless of threat intelligence:

{
  "deny_list": {
    "entries": [
      "competitor-scam.com",
      "*.suspicious-tld.xyz"
    ],
    "match_type": "wildcard"
  }
}

Response Handling

Blocked Link

HTTP/1.1 403 Forbidden
X-Risk-Blocked: true
X-Risk-Categories: unknown_links
X-Risk-Confidence: 0.95

{
  "error": {
    "message": "Response blocked: malicious URL detected",
    "type": "link_safety",
    "code": "malicious_link_detected"
  }
}

Flagged Link

HTTP/1.1 200 OK
X-Risk-Blocked: false
X-Risk-Categories: unknown_links
X-Risk-Confidence: 0.70

Content is delivered but your application can:

• Show a warning before users click
• Require confirmation for unknown links
• Log for security review

Best Practices

1. Start with Flagging

Begin by flagging unknown links to understand your baseline:

{
  "output_detectors": [
    { "detector_type": "unknown_links", "threshold": "L2", "action": "flag" }
  ]
}

Review flagged links to build your allow list.

2. Build an Allow List

Identify domains your application should link to:

{
  "allow_list": {
    "entries": [
      "*.yourcompany.com",
      "docs.python.org",
      "github.com",
      "stackoverflow.com"
    ],
    "match_type": "wildcard"
  }
}

3. Consider Use Case

Application Type	Recommendation
Internal tool	L3-L4 + strict allow list
Customer support	L2 + allow list of your domains
Creative writing	L2 (flag only, don’t block)
Children’s app	L4 + minimal allow list

4. Handle URL Shorteners

URL shorteners (bit.ly, t.co) hide destinations. Options:

• Block all shortened URLs (strict)
• Flag for review (moderate)
• Allow only from specific shorteners (permissive)

{
  "deny_list": {
    "entries": ["bit.ly/*", "tinyurl.com/*", "t.co/*"],
    "match_type": "wildcard"
  }
}

Limitations

Note

Link detection works on URLs in LLM output text. It cannot:

• Follow and analyze URL destinations in real-time
• Detect malicious content hosted at allowed domains
• Prevent users from manually visiting flagged URLs

Combine with client-side link scanning for comprehensive protection.

Next Steps

• Allow & Deny Lists — Configure domain lists
• Prompt Defense — Prevent injection attacks
• Custom Detectors — Add domain-specific rules