Embodiments provide a computer implemented method for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the method including: receiving the internet link; replacing one or more visually confusing characters with one or more original characters, wherein the one or more visually confusing characters are similar to the one or more original characters; removing a top-level domain from the internet link; removing a common subdomain from the internet link; splitting the remaining internet link into a list of words; converting the list of words into a list of word vectors; calculating an average word vector of the list of word vectors; and providing a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link.