Dynamic phishing detection methods and apparatus

A computer-implemented method for detecting a phishing attempt by a given website, comprising:

• receiving a webpage from said given website, including computer-readable code for said webpage;
• ascertaining a set of hyperlink references in said computer-readable code, each hyperlink reference in said set of hyperlink references referencing at least a component of another webpage that is associated with said given website or a website different from said given website;
• performing linking relationship analysis on at least a subset of websites identified to be referenced by said set of hyperlink references, including determining whether a first website that is associated with a webpage referenced by a first one of said set of hyperlink references is in a bi-directional linking relationship with said given website or in a uni-directional linking relationship with said given website, said first website being one of said subset of websites;
• if said first website is in said bi-directional linking relationship with said given website, designating said given website a non-phishing website;
• and
• if said first website is in said uni-directional linking relationship with said given website, performing anti-phishing measures with respect to said given website.