Abstract: A computing device is described. The computing device includes a processor, a memory, and instructions stored in the memory. When executed, the instructions cause the processor to collect a set of uniform resource locators (URLs) from an email. When executed, the instructions further cause the processor to navigate to a final destination URL for each URL of the set of URLs to determine a set of final destination URLs. When executed, the instructions also cause the processor to identify a single publisher domain based on the set of final destination URLs.