1. A database system for detecting and preventing phishing attacks, the database system comprising: a hardware processor; and one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: detecting a request to open an electronic mail message (email) after the email has arrived in a user mailbox; sending a link contained in the email to a threat detection server in response to detecting the request to open the email; receiving a threat level for the link back from the threat detection server; modifying a document object model (DOM) for the email to include a message indicating the threat level of the link; and opening the email and using the modified DOM to display the message.