1. A system, comprising: a message scanner that receives a plurality of messages in a network comprising a plurality of endpoints and an application server; a database that stores a plurality of address-of-record (AOR) records in an address-of-record (AOR) table, the AOR table stores properties of previously received messages from the plurality of endpoints and learned behaviors of the plurality of endpoints; an analysis engine that analyzes a message from an endpoint of the plurality of endpoints and correlates the message with the plurality of AOR records in the database; a processing engine that classifies the message into one of a whitelist, a blacklist, and a graylist based on the results of analysis by the analysis engine, wherein the whitelist contains AOR records that are legitimate, the blacklist contains AOR records that are a potential attack, and the graylist contains AOR records that belong to neither the whitelist nor the blacklist.