9. One or more computer storage media comprising instructions that, when executed by a processor, perform operations comprising: receiving a uniform resource locator (URL) that includes a plurality of tokens, wherein each token comprises one or more characters; determining a similarity measure between a whole or part of the URL and a brand name; determining a domain confidence level for the URL, the domain confidence level indicating a reliability of a domain or a second level domain of the URL based on a ratio of a number of known benign URLs hosted by the domain or the second level domain of the URL compared to a number of known malicious URLs hosted by the domain or the second level domain; applying classification criteria to the similarity measure and the domain confidence level to determine whether a resource located by the URL is a counterfeit resource; and classifying the URL as a malicious URL if the resource located by the URL is the counterfeit resource.
10. The one or more computer storage media as recited in claim 9 , wherein the malicious URL is included as part of a phishing cyber attack.