Abstract: The email security computing platform analyzes pattern associated with criminal and/or malicious activities directed towards an enterprise computing system. Domain age is determined for one or more domains associated with inbound and outbound emails. When certain conditions are met or patterns are recognized, additional activities are triggered to predict a likelihood that malicious activity may occur. The email security computing platform may predict a likelihood (e.g., a weighting factor, percentage, and the like) of the possibility that an email or message chain is linked to a certain type of malicious activity. If these predictions meet certain threshold conditions, an alert or other notification may be generated and sent to an appropriate computer system to trigger one or more security procedures.