What Web Risk actually is
Google Web Risk is the API layer over the same threat-intelligence data that powers Safe Browsing warnings across Chrome, Gmail, and Google Search. It's not a scanner that inspects a page live when you ask about it — it's a lookup against a maintained list of destinations Google has already classified as malicious, checked against one of three threat types: MALWARE, SOCIAL_ENGINEERING (phishing), and UNWANTED_SOFTWARE.
How the underlying data gets built
Google's threat-intelligence pipeline draws from several sources working together:
- Automated web crawling — the same infrastructure that indexes the web for Search also flags pages matching known malicious patterns.
- User and partner reports — security researchers, other companies, and end users flag suspicious pages directly.
- Behavioral analysis — pages that attempt credential harvesting, drive-by downloads, or deceptive software installs get flagged based on what they actually do, not just how they look.
This is fundamentally different from a static blocklist someone manually curates — it's a continuously operating detection system at the scale of Google's own crawling infrastructure.
Update latency: the part that matters most
No threat-intelligence system is instantaneous. Between a malicious page going live and it being crawled, analyzed, and classified, there's a real window of time — this can range from hours to a few days depending on how the page is distributed and whether it matches known attack patterns already in the system.
Quishing campaigns often use freshly registered domains specifically to exploit this window — a page built for a single scam campaign may never accumulate enough signal to get flagged before the campaign moves on. This is precisely why we pair the safety check with guidance on physical inspection and domain scrutiny, rather than treating the check as sufficient on its own.
False positives and false negatives
A false positive is a safe page incorrectly flagged — rare, but possible if a legitimate site was previously compromised and hasn't been fully re-verified as clean. A false negative — a genuinely malicious page not yet flagged — is the more common and more consequential failure mode, precisely because of the latency described above. Both are inherent to any real-time-adjacent threat-intelligence system; no such system achieves perfect, instant accuracy at internet scale.
How CheckThisQR actually uses it
When you check a code, we decode it locally, resolve any redirect chain to the final destination (see our full methodology), and query that final URL against Web Risk's three threat categories. The specific category is shown in your result when something's flagged — not just a generic warning — so you know whether the concern is phishing, malware, or deceptive software specifically.
See the full technical picture
Our methodology page covers the complete flow: decoding, bot verification, redirect resolution, caching, and verdict mapping, end to end.
Read the methodology →