1. A method of determining a probability that a received email comprises a phishing attempt, comprising: receiving an email, analyzing a link within the email to determine whether the link comprises a phishing attempt by: comparing at least some features of the link with records stored in a remote database to determine whether the link comprises a phishing attempt and determining that the link comprises a phishing attempt if the compared features match the records stored in the remote database; building a multi-dimensional input vector from at least features of the link if the compared features do not match the records stored in the remote database and evaluating a plurality of the features of the link to set or reset at least one bit of the multi-dimensional input vector; inputting the built multi-dimensional input vector into a phishing probability engine; computing, in the phishing probability engine, a probability that the link comprises a phishing attempt; and acting upon the received email depending upon the computed probability that the link comprises a phishing attempt.