Computer-implemented method executed by a computer that is associated with a recipient of a document, the method to identify attributes of the document, the method comprising: receiving the document (100, 103) from a sender and processing the document according to visual elements (110, 120) of the document by applying rules (502a, 502b) to provide document data (500, 503), deriving a document class; receiving protocol data that is associated with the transmission of the document (100, 103) from the sender to the recipient, receiving the protocol data (740-1, 740-2, 740-3) from a channel that transmitted the document, wherein a transmission path is the path via the nodes of the channel, which are identified by processing the protocol data of the transmission of the document; obtaining the identification of nodes (1, 3, 5, 7) of the channel that by training have been identified as belonging to transmission in a standard class, wherein the standard class comprises transmission paths, which have been identified as a standard route during training, standard path in the following, wherein - by training - the standard path has been related to a particular document class, and wherein the standard class and a non-standard class are transmission classes; processing the protocol data according to transmission elements (710, 720) by applying protocol rules to obtain transmission data (800, 503), and deriving a transmission class, with identifying particular transmission elements by identifying nodes (1, 2, 3, 4, 5, 6, 7) of the channel and by classifying the transmission path to coincide with a standard class or with a non-standard class; and comparing the document class and the transmission class by applying comparison rules to provide a document attribute. receiving the document (100, 103) from a sender and processing the document according to visual elements (110, 120) of the document by applying rules (502a, 502b) to provide document data (500, 503), deriving a document class; receiving protocol data that is associated with the transmission of the document (100, 103) from the sender to the recipient, receiving the protocol data (740-1, 740-2, 740-3) from a channel that transmitted the document, wherein a transmission path is the path via the nodes of the channel, which are identified by processing the protocol data of the transmission of the document; obtaining the identification of nodes (1, 3, 5, 7) of the channel that by training have been identified as belonging to transmission in a standard class, wherein the standard class comprises transmission paths, which have been identified as a standard route during training, standard path in the following, wherein - by training - the standard path has been related to a particular document class, and wherein the standard class and a non-standard class are transmission classes; processing the protocol data according to transmission elements (710, 720) by applying protocol rules to obtain transmission data (800, 503), and deriving a transmission class, with identifying particular transmission elements by identifying nodes (1, 2, 3, 4, 5, 6, 7) of the channel and by classifying the transmission path to coincide with a standard class or with a non-standard class; and comparing the document class and the transmission class by applying comparison rules to provide a document attribute.