1. A method for identify Web sites that may include malware, the method comprising: receiving an initial URL associated with a Web site; downloading content associated with the initial URL, the content including HTML, a script program, and code related to a button-click event that executes a function; searching the HTML in the downloaded content for an embedded URL; identifying a non-obfuscated URL in the script program; identifying an obfuscated URL in the script program; executing the function corresponding to the button-click event; receiving a new URL as a result of executing the function; adding the embedded URL, the non-obfuscated URL and the new URL to a URL database; and adding a high-priority indicator to the URL database, the high-priority indicator corresponding to the obfuscated URL.