A system for phishing domain detection receives a communication associated with a particular domain. The system extracts a first set of features from the communication, the first set of features including a name of the sender, a name of the domain, a time of receipt, a sentiment message, and attachment file associated with the communication. The system compares the first set of features with a second set of features associated with a historical communication labeled with a phishing domain. In response to determining that the first set of features corresponds to the second set of features, the system determines that the particular domain is the phishing domain.