URL Scanner

Checks where a link actually goes — four sources, cheapest first, and the free ones answer almost everything.

Overview

A link is text until somebody opens it. The URL Scanner is what decides where it actually goes — following redirects, resolving invites, and asking four independent sources whether the destination is known to be a scam. It runs inside Ad Protection because a link to a phishing page is an advertisement in the sense that matters, and it acts through that system's punishment and log channel rather than inventing a second set.

How it works

Four sources, in order of cost

A list held in memory, then Sylon's own reputation table, then a free aggregator, then VirusTotal. Each is only asked what the ones before it could not answer.

The free ones do the work

The first two need no network call at all. Most scam links never reach the third source, and a raid posting the same domain a thousand times costs a thousand hash lookups and zero requests.

Failure means unknown, never clean

A timeout, a rate limit or a service having a bad afternoon leaves the decision to the analyser. No source is ever allowed to wave a link through by failing.

Key capabilities

About 44,000 known phishing domains held in memory, updated within seconds over a live feed

Redirect chains followed hop by hop, so a shortener cannot hide the destination

Discord invites resolved to the server behind them

The destination's own title and description read and handed to the analyser

Roughly 390,000 more domains covered by a free aggregator

VirusTotal's seventy antivirus vendors, when a key is configured

Every source switchable per server, with the rest continuing to run

Mainstream and first-party domains protected from every source at once

Setup

1.Enable Ad Protection — the scanner acts through it, so it does nothing on its own.

2.Open Protection → URL Scanner. All four sources are already on; nothing needs configuring.

3.Optionally set a VirusTotal API key on the bot to enable the fourth source.

4.Add any link roots your server genuinely uses to Ad Protection's approved list, so they are never fetched or judged at all.

How it works in detail

Cheapest first is the whole design

The sources are not equal and are not interchangeable. One is a set lookup against memory; one is a database read; two are network calls, and one of those is limited to 500 lookups a day for the entire network. Asking them in that order means the scarce resource is spent only on the questions nothing else could answer — and during a raid, when the volume is highest, the answer is almost always free.

A shortener is a carrier, not a destination

`bit.ly/x` says nothing about where it leads, which is exactly why it gets used. The scanner follows the chain hop by hop and validates every hop's address, so what reaches the reputation table is the destination rather than the carrier. Shorteners themselves are never learned as malicious: doing so would block every shortened link anyone posts anywhere.

An invite to your own server is not an advertisement

Invites are resolved before anything is judged, so a member sharing this server with a friend is not treated as promoting somewhere else. Invites the owner has explicitly approved are not resolved at all — the answer could not change the outcome, and the cheapest request is the one never sent.

Settings

Known phishing listAbout 44,000 known phishing domains, kept in memory and updated over a live feed within seconds of a report. Free, instant, and the source that catches Discord scams first.

Sylon's own reputationDomains this server — or the network — has blocked before. Local, and the only source that learns from your own moderation.

Anti-phishing aggregatorA free service aggregating several phishing databases, covering roughly 390,000 domains the local list does not. One request, only for links nothing local could judge.

VirusTotalSeventy antivirus vendors' verdict on a URL. The deepest source and the scarcest — the free tier allows 500 lookups a day for the whole network — so it is asked last and only when nothing else could answer.

Good to know

The scanner needs Ad Protection enabled; it shares that system's punishment and log channel.

Turning a source off skips only that source. The remaining ones still run.

Links under Ad Protection's approved roots are never fetched, resolved or judged.

A wrong verdict from any source is reportable to us from the log entry — nothing in the dashboard can correct a third party's list.

Frequently asked questions

Where do I find it in the dashboard?

Under Protection, next to Ad Protection — it is that system's link half. The toggle that stops it entirely is Ad Protection's own, because the scanner decides where a link goes and Ad Protection is what acts on the answer.

Do I need a VirusTotal key?

No. The first three sources need no key and no configuration, and between them they catch the overwhelming majority of Discord scams. A key adds a fourth opinion for the links nothing else recognised.

Can a bad list entry get a real site blocked?

Not a mainstream one. Discord, the major platforms, media hosts, URL shorteners and Sylon's own domains are excluded before any source is consulted and again on the way back, so no third party can cause them to be blocked here.

Related features

AI Advertisement Protection

Spam Protection

Server Guard (Anti-Nuke & Recovery)