A method for detecting phishing resources through collection of URL links, the method executable by a web server (310, 330), the method comprising: - receiving, by the web server (310, 330), a query for obtaining a web resource hosted by the web server (310, 330), wherein the web resource is a file such as an image, a script, a web page, a Java applet, a CSS file, a text file, an XML file, a PHP file, an HTML file, an HTMLs file, an ASP file, an ASPX file, a web document, or an executable code for a computing device, wherein the method comprises further steps: - extracting, by the web server (310, 330), a URL link pointing to a query source from a query's "Referer" field; - generating, by the web server (310, 330), a plurality of converted URL links, each converted URL link pointing to a different web resource located on the same host as the query source, based on the extracted link; and - sending the plurality of converted URL links for a phishing analysis, wherein the step of the generating each of the plurality of converted URL links further comprises: - determining a path contained in the URL link; and - adding a file name with an extension corresponding to a determined operating system installed on the host of the query source. - receiving, by the web server (310, 330), a query for obtaining a web resource hosted by the web server (310, 330), wherein the web resource is a file such as an image, a script, a web page, a Java applet, a CSS file, a text file, an XML file, a PHP file, an HTML file, an HTMLs file, an ASP file, an ASPX file, a web document, or an executable code for a computing device, wherein the method comprises further steps: - extracting, by the web server (310, 330), a URL link pointing to a query source from a query's "Referer" field; - generating, by the web server (310, 330), a plurality of converted URL links, each converted URL link pointing to a different web resource located on the same host as the query source, based on the extracted link; and - sending the plurality of converted URL links for a phishing analysis, wherein the step of the generating each of the plurality of converted URL links further comprises: - determining a path contained in the URL link; and - adding a file name with an extension corresponding to a determined operating system installed on the host of the query source. - extracting, by the web server (310, 330), a URL link pointing to a query source from a query's "Referer" field; - generating, by the web server (310, 330), a plurality of converted URL links, each converted URL link pointing to a different web resource located on the same host as the query source, based on the extracted link; and - sending the plurality of converted URL links for a phishing analysis, wherein the step of the generating each of the plurality of converted URL links further comprises: - determining a path contained in the URL link; and - adding a file name with an extension corresponding to a determined operating system installed on the host of the query source. - determining a path contained in the URL link; and - adding a file name with an extension corresponding to a determined operating system installed on the host of the query source.