While email security services can scan email content and filter out some malicious URLs, attackers have found ways to bypass basic filters. They might use recently-registered domains, reputable web hosting services, URL shorteners, and even typosquatting to evade detection. Although these filters are helpful, combining them with additional security tools and practices is necessary for comprehensive protection against URL phishing.