If they had a limited objective of stopping malicious sites like Google does, they could reject the malicious domains at the moment they are attempted to be pos

If they had a limited objective of stopping malicious sites like Google does, they could reject the malicious domains at the moment they are attempted to be posted, instead of scaring users from leaving facebook.com each time they try to navigate away. I happen to run a well known service, and we encountered the malicious links problem. It has never even crossed our mind to display those pop-ups, instead we stop malicious links from being posted after a domain is reported or detected otherwise.