In certain embodiments, a method for tagging communications from a user system, such that a source of a malicious computer element in a computer network may be determined, includes determining tag information for a user system in the computer network, the tag information physically identifying the user system. The method further includes detecting an attempt to send a communication from the user system and, in response to detecting the attempt to send a communication from the user system, attaching the tag information to the communication prior to sending the communication from the user system. The attachment of the tag information to the communication allows the source of the communication to be determined in response to determining that the communication is associated with a malicious computer element, the source comprising the user system.