1. A method of detecting illegitimate links on a web page, the method comprising: receiving a web link that includes link text and a link address; generating normalized link text based upon the link text, wherein characters in the link text that are visually similar are represented by a single normalized character identifier in the normalized text; determining whether the normalized link text is in the format of a link address; and determining that the text is safe when the normalized link text is not in the format of a link address.