> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lakera.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lakera.ai/_mcp/server.

# Malicious Links

Malicious URLs are one of the most common attack vectors for phishing and spreading malware. Attackers will often use domains that are typos of popular websites or use a subdomain with the name of a popular website in an attempt to trick users into trusting a link.

These URLs can be especially dangerous in [indirect prompt injection](https://www.lakera.ai/blog/guide-to-prompt-injection#direct-prompt-injection-vs-indirect-prompt-injection) attacks where an attacker embeds some content into a document used as context for responding to a user prompt via [retrieval augmented generation](https://www.lakera.ai/blog/retrieval-augmented-generation) (RAG) or a similar GenAI setup.

Any time an LLM receives untrusted content from another source to help respond to an end user, it should be screened for prompt attacks and the LLM output screened for unknown links. This prevents attackers manipulating the LLM into displaying a phishing link.

## Details

The Unknown Links detector detects URLs that are not one of the top one million [most popular domains](https://www.domcop.com/top-10-million-domains).

It can be customized by adding a list of allowed domains that are known to your
application but might not be part of the million most popular domains. These trusted
domains will not be flagged when detected in screened contents, even for the projects in [Enforce mode](/docs/projects#project-mode).

Allowed domains can be added via a policy. Please refer to the [Policies](./policies) documentation for more information and guides to doing this.

> **Note**
>
> Do not include a subdomain when defining your allowed domains, please only include the domain name and [top-level domain](https://en.wikipedia.org/wiki/Top-level_domain) (TLD).

Note that the [confidence threshold level](./defenses) of the unknown links detector cannot be fine-tuned.

## Learn more

To help you learn more about protecting your application and its users from malicious URLs, we have curated more resources for you.

#### [Indirect Prompt Injection](https://atlas.mitre.org/techniques/AML.T0051.001/)

Learn more about indirect prompt injection from MITRE ATLAS

#### [Malicious URLs](https://nordlayer.com/blog/what-are-malicious-websites/)

Learn more about malicious URLs from NordLayer

#### [Slack AI Vulnerability](https://www.theregister.com/2024/08/21/slack_ai_prompt_injection/)

Learn how Slack's AI can be indirectly prompt injected