1. A method comprising: receiving a uniform resource locator (URL); extracting features associated with the URL, the features including a distinct domain link ratio that compares a number of unique domains that link to the received URL to a total number of incoming links that link to the received URL; employing, via one or more processors, a binary classification model to determine that the URL is a malicious URL based at least in part on the extracted features; and categorizing the malicious URL as one of a spam URL, a phishing URL, a malware URL, or a multi-type attack URL.
1. A method comprising: receiving a uniform resource locator (URL); extracting features associated with the URL, the features including a distinct domain link ratio that compares a number of unique domains that link to the received URL to a total number of incoming links that link to the received URL; employing, via one or more processors, a binary classification model to determine that the URL is a malicious URL based at least in part on the extracted features; and categorizing the malicious URL as one of a spam URL, a phishing URL, a malware URL, or a multi-type attack URL. 6. The method as recited in claim 1 , wherein at least one feature extracted is a link popularity feature selected from a group comprising: a maximum domain link ratio, a phishing link ratio, a spamming link ratio, and a malware link ratio.