1. A database system for detecting and preventing phishing attacks, the database system comprising: a hardware processor; and one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: detecting a request to open an electronic mail message (email) after the email has arrived in a user mailbox; prior to opening the email in the user mailbox, sending a link contained in the email to a threat detection server in response to detecting the request to open the email; receiving a threat level identifier from the threat detection server associated with the link after being compared with blacklisted links; and opening the email and displaying a message with the email and the threat level identifier associated with the link.