A method of determining whether a potential relay device is a relay device, at a relay detection system implemented at least in part in hardware, the method comprising: receiving a communication from the potential relay device, the communication comprising a first information element (PRIE) and a second information element (NRIE), wherein the potential relay device is an original source of said second information element (NRIE); discovering a feature of an original source of said first information element (PRIE), the feature of the original source including a device configuration status of the original source, wherein said feature related to a device configuration status of the original source is selected from the group consisting of an operating system type, an operating system version, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting and a time zone setting; discovering a feature of the potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, wherein said feature related to a device configuration status of the potential relay device is selected from the group consisting of an operating system type, an operating system version, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting and a time zone setting; and determining that the feature of the original source of said first information element (PRIE) and the feature of the potential relay device are features unlikely to relate to a single device, a positive result of said determining being indicative that the potential relay device is a relay device. receiving a communication from the potential relay device, the communication comprising a first information element (PRIE) and a second information element (NRIE), wherein the potential relay device is an original source of said second information element (NRIE); discovering a feature of an original source of said first information element (PRIE), the feature of the original source including a device configuration status of the original source, wherein said feature related to a device configuration status of the original source is selected from the group consisting of an operating system type, an operating system version, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting and a time zone setting; discovering a feature of the potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, wherein said feature related to a device configuration status of the potential relay device is selected from the group consisting of an operating system type, an operating system version, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting and a time zone setting; and determining that the feature of the original source of said first information element (PRIE) and the feature of the potential relay device are features unlikely to relate to a single device, a positive result of said determining being indicative that the potential relay device is a relay device.