Systems and methods are provided for automatically detecting phishing attacks. Network traffic may be monitored to detected phishing attacks and/or identify phishing websites and/or target websites. The monitoring may comprise generating and analysing logs corresponding to the monitored network traffic, with the logs comprising network traffic events and/or information relating to requesting and responding addresses. The network traffic events used in detecting phishing attacks may comprise sequences each comprising one or more requests and responses. Requested websites may be identified as phishing websites based on event sequences meeting particular criteria. Components and/or functions utilized for monitoring the network traffic and/or automatic phishing detection based thereon may be implemented as parts of a browser and/or network routers utilized during typical and normal use operations.