Methods and systems for detecting a phishing attack on a computer device can involve scanning one or more email messages, and separating email parts from the one or more email messages, in response to scanning the at least one email message. In addition, the email parts of the at least one email message can be subject to a feature extraction operation. The email features extracted from the email parts can be then analyzed to determine whether or not any of the email features contain suspected phishing content, confirmed phishing content and benign email content.