Systems and methods are described, and one method includes storing a database that includes a plurality of stored attachments, each of the stored attachments including a corresponding stored attachment identification data (ID), storing a blocked attachment indicator that indicates a stored attachment among the plurality of stored attachments as a blocked attachment and its corresponding stored attachment ID as a blocked attachment ID, and blocking a distribution of a file, based at least in part on the file including a metadata that matches at least a portion of the blocked attachment ID.