8. A system for determining whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content, comprising: a first module determining if the email content contains predetermined suspected malicious phrases, the first module includes a scoring engine, a security device, at least one mail server, and an intelligence database; a second module determining if at least one link in the email content references potentially malicious web content using at least one of an IP address, URL, and domain name, the second module including a search engine, the security device, the email crawler, a web crawler, and the exclusion processor, the determining being a two step process of performing an initial analysis based on existing identification information about said at least one link, which includes IP address, URL, and the domain name, before accepting a remaining portion of the email content, which includes message body data; and a third module evaluating metadata in the email content to determine if the email content is potentially malicious, the third module includes a scoring engine, the security device, and the email crawler, the scoring engine performing a scoring process and providing a page score for a digital document to represent a likelihood that the digital document includes potentially malicious content, the scoring engine using a Word Expression equation, which includes at least one variable to represent a number of occurrences of at least specific keywords, and patterning in the potentially malicious content in the digital document, the scoring engine comparing information extracted from the digital document and forwards the digital document for review and analysis, and the scoring engine providing at least one of real-time and post-production evaluation of the digital document and provides an output value, including the page score.
9. The system of claim 8 , wherein the third module also determines whether the evaluated metadata indicates that the email content originated from a suspicious entity, including at least one of a suspicious individual, organization, and a geographic region.