16. A system comprising: one or more processors; one or more memories; a uniform resource locator (URL) input module, stored on the one or more memories and executable by the one or more processors, to receive a URL; a feature extraction module, stored on the one or more memories and executable by the one or more processors, to: determine a similarity measure between a whole or a part of the URL and a brand name; and determine a domain confidence level for the URL, the domain confidence level indicating a reliability of at least one of a domain or a second level domain of the URL based on a ratio of a number of known benign URLs hosted by the at least one of the domain or the second level domain of the URL compared to a number of known malicious URLs hosted by the at least one of the domain or the second level domain; and a malicious URL detection module, stored on the one or more memories and when executable by the one or more processors, to apply classification models to the similarity measure and the domain confidence level to classify the URL as a malicious URL or a non-malicious URL.
16. A system comprising: one or more processors; one or more memories; a uniform resource locator (URL) input module, stored on the one or more memories and executable by the one or more processors, to receive a URL; a feature extraction module, stored on the one or more memories and executable by the one or more processors, to: determine a similarity measure between a whole or a part of the URL and a brand name; and determine a domain confidence level for the URL, the domain confidence level indicating a reliability of at least one of a domain or a second level domain of the URL based on a ratio of a number of known benign URLs hosted by the at least one of the domain or the second level domain of the URL compared to a number of known malicious URLs hosted by the at least one of the domain or the second level domain; and a malicious URL detection module, stored on the one or more memories and when executable by the one or more processors, to apply classification models to the similarity measure and the domain confidence level to classify the URL as a malicious URL or a non-malicious URL. 18. The system as recited in claim 16 , wherein the similarity measure comprises a minimum of edit distances between substrings of the whole or the part of the URL and a text string associated with the brand name.