A system for detecting phishing events is provided. A data receiver is configured to receive datasets representative of web traffic associated with access to or on-going usage of an application hosted on a server of a production environment by a user. Bait user credentials are generated and inserted into a malicious online resource. When the bait user credentials are used to access a secure online resource, a malicious interaction fingerprint dataset is generated for similarity analysis and classification.