Score URLs for phishing indicators — IP addresses, suspicious keywords, excessive subdomains, and encoding.