A method includes determining whether new phishing site identifiers (URLs and/or IP addresses) have been created. Upon a determination that the new phishing site identifiers have been created, the new phishing site identifiers are compared to site identifiers of sites to which critical values have been provided in the past. Upon a determination that at least one of the new phishing site identifiers matches at least one of the site identifiers, a phishing notification is provided that the user was successfully phished in the past.