1. A method for classifying a message, comprising: extracting a plurality of reference points; classifying the plurality of reference points; and detecting that the message is a phish message based on the classified reference points.