Uniform resource locator (URL) patterns are found in browsing histories of client computers. The URL patterns are employed to find URL browsing chains for particular client computers. A URL browsing chain includes URL requests that match URL patterns arranged in sequential order by time stamp. The URL browsing chains may be normalized and then evaluated for web threat infection chains. URL browsing chains that are deemed to be web threat infection chains are built into a model. The model may be deployed locally in a client computer or in a remotely located server computer to detect web threat infection chains.