EDIT: I found out that there isn't 2 requests, only one and only with the prefix. The prefix is first lookup in the client database, and if it's there, a reques

EDIT: I found out that there isn't 2 requests, only one and only with the prefix. The prefix is first lookup in the client database, and if it's there, a request is made to get the URL related to that prefix. My idea still works but then they would need to give theses specific prefix in the database already, which will be pretty obvious. > If it's a hot new URL that hasn't been firewalled yet, then it's also not going to be in the safe browsing database, which means that your browser won't make that second request (with the full hash) to verify it. Who say you need the full hash? Keep all prefix with the timestamp and their IP address and believe me, you can get a pretty good picture. All you need is to keep a bunch of URL you don't block but consider harmful, and a bunch of of others URL from theses same domains. Here's a partial hash that I'm pretty sure would be quite useful: > 18ec It map to this URL: > https://www.reddit.com/api/submit https://www.reddit.com/api/submit From your database, find everyone that called for 18ec. It may matches many other URL, but use your backup for Reddit and the timestamps. You now got the username linked to their IP. Someone doesn't post? Use 1483, B5E7, 13F9, 5B58, 0859, etc... The funniest is that you could probably find the URL yourself using theses prefixes... but yeah the goal is to find out who went to theses URL, not really which URL they went to. You don't need that many matches to confirm they truly went there.