As illustrated in flow 700 of FIG. 19, the system may also respond to messages other than simulated phishing attack messages. As in FIG. 18, the system may receive a message identified as a potential phishing attack in stage 704 (step S1) and proceed to stage 706 (step S2), where the message is decoded and/or decrypted. Unlike FIG. 18, after stage 706 (step S2), the flow 700 may proceed to stage 720, where the message is determined to be a simulated or known phishing attack. If the message is not a known phishing attack or simulated phishing attack message, the system treats the message as non-simulated suspicious message and processes accordingly by, e.g., forwarding it to a pre-configured address and proceeds to stage 730. Additionally, if the header data relating to an expiration time (expr=hh:mm:ss:UTC) has expired, then the message may also be treated as suspicious, continuing to stage 730. In those embodiments, as a non-limiting example, some of or all of the reported message may be forwarded to an address accessible in a mail server by any appropriate protocol, such as, but not limited to, Internet Message Access Protocol (IMAP), Post Office Protocol (POP), ActiveSync?, or Exchange? The reported message address may be at an intermediate message store configured for collecting the reported messages. In stage 730, if the system determines that the message is not from a non-phishing or trusted source flow 700 proceeds to stage 740, otherwise flow 700 proceeds to stage 712. In a stage 740, the message and associated metadata are further analyzed to determine if the message is a phishing attack message.
