1. In a computing environment, a method for determining whether a site accessible by a network is likely a phishing site, the method comprising: recording a plurality of properties and features corresponding to a site, the properties and features being received from a plurality of data sources, each data source of the plurality of data sources comprising: raw data submissions from one or more users corresponding to phishing sites, and raw data from closely monitored data sources, each closely monitored data source of the closely monitored data sources comprising: a seeded dummy email address, suspicious word lists, Internet traffic lists, and domain lists, tracking each of the plurality of properties at each of a plurality of distinct time resolutions, wherein tracking each property of the plurality of properties comprises: tracking a URL associated with the site, tracking a domain associated with the site, tracking an IP address associated with the site; wherein each of the plurality of distinct time resolutions comprises a span of time during which the raw data associated with each of the plurality of properties is tracked and collected; processing information from at least one data source of the plurality of data sources related to a known phishing site; based upon the recorded plurality of properties and features and based upon the information from at least one data source related to a known phishing site, building a plurality of predictive models using machine learning based on a plurality of different sets of training data; and constructing a decision tree based upon a plurality of classified training examples, the decision tree having leaf nodes which correspond to the probability of a site being a phishing site based upon the node path used in reaching the leaf node; and using the predictive models to determine a probability value that the site is a phishing site.
1. In a computing environment, a method for determining whether a site accessible by a network is likely a phishing site, the method comprising: recording a plurality of properties and features corresponding to a site, the properties and features being received from a plurality of data sources, each data source of the plurality of data sources comprising: raw data submissions from one or more users corresponding to phishing sites, and raw data from closely monitored data sources, each closely monitored data source of the closely monitored data sources comprising: a seeded dummy email address, suspicious word lists, Internet traffic lists, and domain lists, tracking each of the plurality of properties at each of a plurality of distinct time resolutions, wherein tracking each property of the plurality of properties comprises: tracking a URL associated with the site, tracking a domain associated with the site, tracking an IP address associated with the site; wherein each of the plurality of distinct time resolutions comprises a span of time during which the raw data associated with each of the plurality of properties is tracked and collected; processing information from at least one data source of the plurality of data sources related to a known phishing site; based upon the recorded plurality of properties and features and based upon the information from at least one data source related to a known phishing site, building a plurality of predictive models using machine learning based on a plurality of different sets of training data; and constructing a decision tree based upon a plurality of classified training examples, the decision tree having leaf nodes which correspond to the probability of a site being a phishing site based upon the node path used in reaching the leaf node; and using the predictive models to determine a probability value that the site is a phishing site. 10. The method of claim 1 further comprising: determining a rate of false positives; determining a rate of false negatives; and determining a comparative cost of a false negative compared to a false positive.