元数据
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
本文档适用于以下方法：
元数据是有助于区分威胁类型的信息，并且提供更有用的警告（请参阅建议的警告语言）。元数据是 fullHashes.find 响应中返回的 ThreatMatch 对象的一部分，包括：
- 威胁列表描述符（threat/platform/threatEntry 类型组合）：用于标识安全浏览（威胁）列表。
- 威胁：对于
threatMatches，是一个网址。对于 fullHashes，表示完整长度的哈希值。
- 元数据：有关威胁的其他信息。
元数据以键值对字符串对的形式提供（请参阅 ThreatEntryMetadata 字段）。对于 JSON 请求，键和值都是采用 base64 编码的。返回的元数据类型因特定的安全浏览列表（威胁/平台/threatEntry 类型组合）而异。
恶意软件网站
元数据目前可用于恶意软件 threatType 和网址 threatEntryType 的所有可用列表。下文介绍了键值对。
| key |
value |
说明 |
| malware_threat_type |
着陆页： |
恶意软件着陆网站。这些网站是通往恶意软件的通道。这类网站通常是被黑客入侵的网站，其中包含的 iframe、脚本或重定向会加载来自其他网站的内容，从而发起实际攻击。 |
| malware_threat_type |
内容分发 |
恶意软件传播网站。这些网站发起了恶意软件攻击。 |
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eThis documentation focuses on metadata within the Safe Browsing Lookup and Update APIs (v4), aiding in threat distinction and providing informative warnings.\u003c/p\u003e\n"],["\u003cp\u003eMetadata, found within ThreatMatch objects, includes the threat list descriptor, the threat itself (URL or hash), and additional information about the threat.\u003c/p\u003e\n"],["\u003cp\u003eMetadata is presented as key/value string pairs (base64-encoded for JSON) and varies based on the specific Safe Browsing list.\u003c/p\u003e\n"],["\u003cp\u003eCurrently, metadata is available for all lists with \u003ccode\u003eMALWARE\u003c/code\u003e threatType and \u003ccode\u003eURL\u003c/code\u003e threatEntryType, and distinguishes between malware landing and distribution sites.\u003c/p\u003e\n"]]],["The document details metadata within the Lookup and Update APIs (v4), specifically related to `threatListUpdates.fetch` and `fullHashes.find`. Metadata, provided as key/value string pairs, enhances threat differentiation. This is part of the `ThreatMatch` object, that includes threat list descriptor, the threat itself and the associated metadata. For malware, metadata keys like `malware_threat_type` are used, with values such as \"landing\" (gateway sites) or \"distribution\" (attack launching sites). The key and values are base64-encoded in JSON.\n"],null,["# Metadata\n\nThis document applies to the following methods:\n\n- [Lookup API (v4)](/safe-browsing/v4/lookup-api): [threatListUpdates.fetch](/safe-browsing/v4/update-api#example-threatListUpdatesfetch)\n- [Update API (v4)](/safe-browsing/v4/update-api): [fullHashes.find](/safe-browsing/v4/update-api#example-fullHashesfind)\n\nAbout metadata\n--------------\n\nMetadata is information that helps distinguish between threat types and allows for more informative warnings\n(see [Suggested Warning Language](/safe-browsing/v4/usage-limits#UserWarnings)).\nMetadata is part of the\n[ThreatMatch](/safe-browsing/reference/rest/v4/ThreatMatch)\nobject returned in the\n[fullHashes.find response](/safe-browsing/v4/update-api#http-post-response_2)\nand includes:\n\n- The threat list descriptor (threat/platform/threatEntry type combination): Identifies the Safe Browsing (threat) list.\n- The threat: For `threatMatches`, a URL. For `fullHashes`, a full-length hash.\n- The metadata: Additional information about the threat.\n\nMetadata is provided in the form of key/value string pairs (see the\n[ThreatEntryMetadata](/safe-browsing/reference/rest/v4/ThreatMatch#ThreatEntryMetadata)\nfield). For JSON requests, the key and value are both base64-encoded. The *type* of metadata\nreturned will vary depending on the specific Safe Browsing list (the threat/platform/threatEntry\ntype combination).\n\nMalware sites\n-------------\n\nMetadata is currently available for all available lists with the MALWARE `threatType`\nand the URL `threatEntryType`. The key/value pairs are described here.\n\n| key | value | Description |\n|---------------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| malware_threat_type | landing | Malware landing site. These sites are gateways to malware. They are often hacked sites that include iframes, scripts, or redirects that load content from other sites that launch the actual attacks. |\n| malware_threat_type | distribution | Malware distribution site. These sites launch the malware attacks. |"]]
