1. A method for detecting an illegitimate web link on a web page, the method comprising: receiving a web link including link text and a link address, wherein the link text includes a plurality of characters; converting the plurality of characters of the link text to normalized characters by: determining whether the plurality of characters correspond to normalized characters included in a reference table, and identifying a presence of a visually similar glyph in the reference table; determining whether the link text having the normalized characters corresponds to a syntax of the link address; and when the link text having the normalized characters corresponds to the syntax of the link address: determining whether the normalized characters match the link address; providing an indication that the web link is unsafe when the link text having normalized characters does not match the link address; and providing an indication that the web link is safe when the link text having normalized characters matches the link address.