Model for Detecting Phishing URLS

Methods, storage systems and computer program products implement embodiments of the present invention for protecting a computing device. These embodiments include detecting that an email is received by the computing device, the email including a Uniform Resource Locator (URL) for a web page in a first domain. The web page is retrieved from the domain, and a set of keywords are extracted from the retrieved web page. A query included the set of keywords is submitted to a search engine, and a response to the query is received from the search engine, the response indicating a set of second domain. Finally, in response to detecting that the first domain does not match any of the second domains, an alert for a phishing attack is generated.