A filtering system, comprising: an interface operable to receive electronic data; one or more extraction generators operable to: extract a first identifier from the electronic data; and extract first attributes from the electronic data; one or more specificity generators operable to: search a database (180a-n) for identifiers that match the first identifier to determine a number of matching identifiers; determine that the number of matching identifiers exceeds a first threshold; search the database (180a-n) for attributes associated with each of the matching identifiers to determine a subset of matching attributes, wherein the first attributes and the attributes associated with each of the matching identifiers each comprise the subset of matching attributes; and calculate, in response to determining that the number of matching identifiers exceeds the first threshold, a specificity for the subset of matching attributes; and a filter generator operable to: determine that the specificity of the subset of matching attributes is less than or equal to a second threshold; and create a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold, and wherein the filtering system further comprises a threat detector operable to: apply the filter to the electronic data; detect a threat in the electronic data based at least in part on the applied filter; and reject delivery of the electronic data to the specified destination of the electronic data based at least in part on the applied filter. an interface operable to receive electronic data; one or more extraction generators operable to: extract a first identifier from the electronic data; and extract first attributes from the electronic data; extract a first identifier from the electronic data; and extract first attributes from the electronic data; one or more specificity generators operable to: search a database (180a-n) for identifiers that match the first identifier to determine a number of matching identifiers; determine that the number of matching identifiers exceeds a first threshold; search the database (180a-n) for attributes associated with each of the matching identifiers to determine a subset of matching attributes, wherein the first attributes and the attributes associated with each of the matching identifiers each comprise the subset of matching attributes; and calculate, in response to determining that the number of matching identifiers exceeds the first threshold, a specificity for the subset of matching attributes; and search a database (180a-n) for identifiers that match the first identifier to determine a number of matching identifiers; determine that the number of matching identifiers exceeds a first threshold; search the database (180a-n) for attributes associated with each of the matching identifiers to determine a subset of matching attributes, wherein the first attributes and the attributes associated with each of the matching identifiers each comprise the subset of matching attributes; and calculate, in response to determining that the number of matching identifiers exceeds the first threshold, a specificity for the subset of matching attributes; and a filter generator operable to: determine that the specificity of the subset of matching attributes is less than or equal to a second threshold; and create a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold, and wherein the filtering system further comprises a threat detector operable to: apply the filter to the electronic data; detect a threat in the electronic data based at least in part on the applied filter; and reject delivery of the electronic data to the specified destination of the electronic data based at least in part on the applied filter. determine that the specificity of the subset of matching attributes is less than or equal to a second threshold; and create a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold, and wherein the filtering system further comprises a threat detector operable to: apply the filter to the electronic data; detect a threat in the electronic data based at least in part on the applied filter; and reject delivery of the electronic data to the specified destination of the electronic data based at least in part on the applied filter. apply the filter to the electronic data; detect a threat in the electronic data based at least in part on the applied filter; and reject delivery of the electronic data to the specified destination of the electronic data based at least in part on the applied filter.