Discrepancy between Google Web Risk Lookup API and VirusTotal

[drveresh]

Ref - https://stackoverflow.com/questions/78012189/malware-and-phishing-detection-discrepancy-between-google-web-risk-lookup-api-an

Based on my years of observation, I am also facing numerous links that are clearly marked as RED or Dangerous in the Chrome browser and detected by local antivirus software(Avast), and in another portal like VirusTool, but flagged as SAFE via LookAPI API.

Please update me based on the recent updates and enhancements, about its consistency and data integrity.

[rvilgalys]

Hi @drveresh! Thank you for this feedback.

I cannot comment too much on what VirusTotal might be publishing, but we have made some recent (12/2023) updates to Web Risk that brings out coverage very close to 100% of the "Red Screen of Death" warnings shown in Safe Browsing. The previous gap between Safe Browsing and Web Risk had to do with data licensing agreements that needed to be updated, and we have made additional improvements in our detection.

Safe Browsing blocklisting alone is inherently a bit more conservative than some other lists because Safe Browsing covers 5 Billion+ devices worldwide, and as a result Google aims for a high degree of precision in what gets added to those lists (very low false positives).

You might be interested in the Extended Coverage List if you want wider coverage than what is only in the Safe Browsing lists.