DECIM (Detecting Endpoint Compromise in Messaging) Tag