Comment by YPCrumble

Interesting - is it just the URL or is it actually crawling the phishing site to assess whether its phishing? And how does it distinguish the site bank.com from bąnk.com (with a little curly ą) if both are an identical clone of bank.com?