Systems and methods are presented for receiving, at a server computer, a plurality of request messages to analyze potentially fraudulent electronic communications, each request message of the plurality of request messages comprising an electronic communication. For each request message of the plurality of request messages, the server computer may perform operations of associating a unique identification number with the electronic communication, analyzing the electronic communication to determine that the electronic communication contains actionable data and deactivating the actionable data, analyzing the electronic communication to determine header information associated with the electronic communication and at least one Internet Protocol (IP) address in the electronic communication, generating an analysis output document including the header information associated with the electronic communication and the at least one IP address, and storing the analysis output document in a data repository associated with the unique identification number. The server computer may further perform the operations of sending the analysis output document to at least one security information provider for analysis, receiving at least one report from the at least one security information provider, storing the at least one report in the data repository associated with the unique identifier, and causing a notification to be provided indicating that the electronic communication has been analyzed.