IDENTIFYING A PHISHING ATTEMPT

Systems, methods, and software can be used to determine a classification of a network accessible page, for example a web page on Internet. In some aspects, a method comprises receiving, at a gateway, a request for accessing a network accessible page from an end-user device; processing the network accessible page to generate a first embedding that characterizes network attributes of a domain of the network accessible page, and a second embedding that characterizes content attributes of the network accessible page; generating, from the first embedding, a first score that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages; generating, from the second embedding, a second score that characterizes a predicted likelihood that the network accessible page is asking for sensitive information; and using at least the first score and the second score to determine a classification of the network accessible page.