embodiment of the present invention the steps for analyzing a suspect webpage in step 402 the computer readable code such as the html code that implements the webpage is analyzed for hyperlink references and for credential information transaction constructs e g one that requests the user to enter login information such as userid password or identification information such as name birth date social security number driver license number or financial related information such as bank account number credit card number etc in step 404 the hyperlinks ascertained in step 402 are ranked to determine which linked to webpages and thus websites are most relevant if the suspect webpage is not a transaction webpage no further analysis is necessary since the purpose of phishing is to acquire the transaction information and the suspect webpage is now no longer a suspect since that suspect webpage does not ask for transaction information in an embodiment such ranking may be deemed optional and may be omitted if desired as mentioned certain hyperlinks may be deemed more relevant than others based on types the identity of the linked to webpages and or linked to websites etc from step 404 a set of websites deemed relevant is ascertained in step 406 link relationship analysis is performed for the most relevant website that is either ranked in step 404 or depending on the specific embodiments.