[mikeash]

Despite the objections you raise, Google manages to detect malicious URLs without sending everything to their own servers:

http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...

Instead of worrying about how impossible this idea is, I'd suggest looking at how others are accomplishing it.