URL Analysis & Web Sandbox
Every link Shield inspects — whether submitted through the API, or found inside an SMS, WhatsApp, or email message during antispam/antiphishing inspection — is checked for safety before your team or your customers ever click it.
How it works
URL analysis works like a ladder: Shield starts with the fastest, cheapest check and only climbs to the next rung if the link is still unclear.
- Known-verdict check. Shield first checks whether it already has a confident answer for this link from its own threat-intelligence store. Most links are resolved instantly at this step.
- Deep analysis. If the link is unfamiliar, Shield analyzes the URL itself — its structure, its domain, and known risk signals — to reach a verdict without visiting the page.
- Web Sandbox (detonation). If the link is still ambiguous after deep analysis, Shield can open it inside an isolated, disposable browser environment — the Web Sandbox — to see exactly what the page does: where it redirects to, what it tries to download, and what content it actually shows. The sandbox never touches your systems or your data; it only observes the destination page and reports back a verdict.
At every step, once Shield reaches a confident verdict the link is classified and the result is remembered, so the next time anyone checks that same link the answer comes back instantly.
Plans
| Plan | What's included |
|---|---|
| Basic | Known-verdict check + deep analysis for every link. |
| Premium | Everything in Basic, plus Web Sandbox detonation for links that need the deepest look. |
Monthly detonation cap
Web Sandbox detonations are the most resource-intensive check Shield performs, so each Premium tenant has a configurable monthly cap on how many detonations it can run. Your cap is set for your account and can be adjusted on request.
If your tenant reaches its monthly cap, Shield doesn't stop analyzing links — it simply falls back to the known-verdict check and deep analysis (the same protection every Basic plan gets) for the rest of the month, and resumes Web Sandbox detonations the following month.
What you'll see
- Inside the portal, a link that's still being analyzed by the Web Sandbox shows a brief loading indicator while the result comes back — most checks resolve in a matter of seconds.
- Every verdict — clean, suspicious, or malicious — is shown with a plain-language classification, not raw technical data.
Powered by ROUNDBOX Orbis Labs
All URL safety verdicts are produced by ROUNDBOX Orbis Labs, the analysis engine behind every ROUNDBOX Orbis Shield module. Classifications are normalized to a consistent risk scale across every product surface, so a "malicious" verdict means the same thing whether it came from an API call, an inbound SMS, or a portal search.
See also: Shield API overview for how to call URL lookups directly from your own systems.