Abstract: A system for protecting an endpoint device of a user includes a web interface module that identifies a present URL visited by the user and target URLs to which navigation is available. A password management module installed on the endpoint device stores multiple entries. One entry includes a username, a password, and a login URL. The password management module selectively supplies credentials to the web interface module, including supplying the password to the web interface module in response to the web interface module identifying the login URL as the present URL. A URL analysis module evaluates the target URLs to classify each of the target URLs as either safe or suspicious and initiates a warning to the user in response to one of the target URLs being classified as suspicious. The URL analysis module performs the classification based in part on login URLs stored by the password management module.