1. A method comprising: receiving a uniform resource locator (URL); extracting features associated with the URL, the features including a distinct domain link ratio that compares a number of unique domains that link to the received URL to a total number of incoming links that link to the received URL; employing, via one or more processors, a binary classification model to determine that the URL is a malicious URL based at least in part on the extracted features; and categorizing the malicious URL as one of a spam URL, a phishing URL, a malware URL, or a multi-type attack URL.