77. The system of claim 56 , where, when analyzing data or attributes associated with the suspect document, the processing unit is further to: analyze references to the suspect document, or to a domain associated with the suspect document, over time in received electronic messages.
78. The system of claim 77 , where the processing unit is further to: determine if the references to the suspect document appear in the received electronic messages.