Google Safe Browsing (GSB) is Google's flagship anti-abuse blocklist used by Chrome, Firefox, Safari and Android. A listing means Google's automated and manual review systems classified the domain as malware, phishing, or unwanted software. GSB has very low false-positive rates, so a listing is a high-confidence malicious indicator.
The questions every analyst asks before acting on this signal.
Google Safe Browsing (GSB) is Google's flagship anti-abuse blocklist used by Chrome, Firefox, Safari and Android. A listing means Google's automated and manual review systems classified the domain as malware, phishing, or unwanted software. GSB has very low false-positive rates, so a listing is a high-confidence malicious indicator.
Google Safe Browsing is one of the most trusted malicious-domain feeds in the industry. Listings are produced by Google's large-scale crawlers, sandbox detonation, machine-learning classifiers, and manual analyst review, and they directly drive browser-level warnings for billions of users. False positives are very rare because of the user-facing impact, so a GSB hit should be treated as high-confidence evidence of phishing, malware, or unwanted-software activity.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "google_safe_browsing",
"name": "Listed in Google Safe Browsing",
"group": "threat_intelligence_feed",
"subgroup": "malware_association",
"direction": "malicious",
"evidence": {
"sources_referencing": 12,
"malware_families": [
"emotet",
"qakbot"
],
"first_reference_days_ago": 11,
"confidence": 0.91
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means that the domain has appeared in public or open-source malware intelligence feeds. These feeds collect indicator…
It means that one or more commercial security vendors, including antivirus engines, sandboxes, or threat intelligence pr…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
avnportalsg[.]asiaHigh78Verified 2026-08-01avnglobalportal[.]liveHigh75Verified 2026-08-01cs-checking[.]comHigh82Verified 2026-08-01bbodpn[.]infoHigh80Verified 2026-08-01dropshipmarket[.]digitalHigh83Verified 2026-08-0178mai15[.]netHigh85Verified 2026-08-01bboht[.]shopHigh83Verified 2026-08-01avnsgportal[.]asiaHigh78Verified 2026-08-01avnserversg[.]internationalHigh79Verified 2026-08-01cryviax[.]comHigh79Verified 2026-08-011drv[.]zoneHigh78Verified 2026-08-01djdsip[.]cnHigh80Verified 2026-08-01avnserversg[.]asiaHigh82Verified 2026-08-01avnhubsg[.]asiaHigh77Verified 2026-08-01avn-sgportal9[.]liveHigh75Verified 2026-08-01avnhub[.]asiaHigh78Verified 2026-08-01danapinjaman[.]biz[.]idHigh84Verified 2026-08-01arabswitze[.]comHigh80Verified 2026-08-01avnsg[.]liveHigh78Verified 2026-08-01avnsghub[.]asiaHigh79Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.