This paper presented a hybrid rule-based and machine-learning system that intercepts navigation at the browser and blocks phishing, malware, ransomware, and DGA-style malicious destinations in real time, without requiring network-level packet capture. A Random Forest classifier trained on eight lexical and structural URL features reached 95.83% accuracy and a 95.52% F1-score on a held-out test set, at an inference cost of under 6 ms per request, well within the latency budget of a normal page navigation. More importantly, a real false-positive failure was found, measured, and fixed: restricting an entropy rule from the full URL to the hostname alone, combined with removing a spurious pattern from the training corpus, reduced false blocks on ordinary websites from 7 of 10 to 1 of 12 with no loss of true detections. A live per-attack-type accuracy view complements the usual offline benchmark by scoring every trained algorithm against real traffic as it happens, and a per-class confusion matrix shows the two remaining error types clearly enough to prioritize future work: at the current dataset scale, missed detections (2 of 34) matter more than false alarms (1 of 38), which argues for growing the malicious-class training data before anything else. Taken together, these results suggest that a browser-level hybrid detector is a practical, lightweight complement to network-level intrusion detection for the individual users and small deployments that flow-based systems do not reach.