Embodiments of the invention are concerned with filtering emails having data therein identifying a link to a remote
processing system, which, when activated, causes the recipient to retrieve data from the remote
processing system.Embodiments of the invention provide a method of modifying an electronic message during transmission through a communications network, said electronic message having a
source address and a recipient address, the method comprising:interrupting transmission of the electronic message;identifying a link specified within the electronic message;analyzing the electronic message on the basis of at least an attribute intrinsic to the received electronic message so as to classify the received message as either a first type of message or a second, different, type of message;if the received message is classified as the first type of message, modifying the received electronic message so as to replace the link with an alternative network location, said alternative network location corresponding to a remote
processing system different to that corresponding to the link; andtransmitting the modified electronic message.In comparison to known methods, which either modify the links blindly or which perform analysis of the data to which the link is connected, embodiments of the invention selectively modify the link on the basis of various tests relating to attributes intrinsic to the email. This means that only those emails that present some sort of risk to the recipient are modified, and, because the criteria for performing the modification relate to attributes intrinsic to the emails instead of the content associated with the link, the delivery of emails is not significantly delayed by processes involved in retrieval and analysis of data from
third party sites.