A method for detecting a phishing web page, the method executable by a server, the method comprising: - receiving, by a server, a known phishing web page; - detecting, by the server, at least one unique attribute that allows to identify the known phishing web page as a phishing web page; - generating, by the server, at least one phishing detection rule that is based on the at least one unique attribute, the at least one phishing detection rule for detecting a new potential phishing page as the phishing web page based on attributes thereof; - determining, by the server, additional data associated with the known phishing web page, the additional data including a phishing target identification, wherein additional attributes include at least one of: a phishing target brand, brand's official domain, phishing venue, phishing object, and phishing vector; - associating, by the server, the additional data with the at least one phishing detection rule; - storing, by the server, the at least one phishing detection rule and the associated additional data, in a data storage; - receiving, by the server, at least one new web page to be checked for phishing; - extracting, by the server, the at least one phishing detection rule from the data storage; - executing, by the server, a code of the at least one new web page and, applying, by the server, the at least one phishing detection rule to analyze the at least one new web page; and - based on an outcome of the at least one phishing detection rule, identifying the at least one new web page as a phishing web page, in response to the outcome being indicative of phishing activity in the code, wherein the phishing detection rule is a single regular expression. - receiving, by a server, a known phishing web page; - detecting, by the server, at least one unique attribute that allows to identify the known phishing web page as a phishing web page; - generating, by the server, at least one phishing detection rule that is based on the at least one unique attribute, the at least one phishing detection rule for detecting a new potential phishing page as the phishing web page based on attributes thereof; - determining, by the server, additional data associated with the known phishing web page, the additional data including a phishing target identification, wherein additional attributes include at least one of: a phishing target brand, brand's official domain, phishing venue, phishing object, and phishing vector; - associating, by the server, the additional data with the at least one phishing detection rule; - storing, by the server, the at least one phishing detection rule and the associated additional data, in a data storage; - receiving, by the server, at least one new web page to be checked for phishing; - extracting, by the server, the at least one phishing detection rule from the data storage; - executing, by the server, a code of the at least one new web page and, applying, by the server, the at least one phishing detection rule to analyze the at least one new web page; and - based on an outcome of the at least one phishing detection rule, identifying the at least one new web page as a phishing web page, in response to the outcome being indicative of phishing activity in the code, wherein the phishing detection rule is a single regular expression.