[TETENAL]

So how does Safari's phishing-protection actually work?

Does it send every URL to Google for verification? I'm not sure I'd like this. At least I would like to know about it if it was the case.
Or does it download a list of known phishing-sites and compares the URL to such a local list? Then how often is the list updated? Where does it come from? And where is it located on my machine?

Why is Apple so secretive about this feature?

[CharlesS]

If you really want to know, you could watch Safari with a packet logger to see what it does.