1. A computer system comprising: a processor configured to execute an anti-malware engine, the anti-malware engine operable to receive an outbound request from at least one client computer, the at least one client computer communicatively coupled to the anti-malware engine via a first computer network, the outbound request comprising a transmission of an outbound data message from the first computer network and directed toward a second computer network, the transmission occurring after a received inbound data message addressed to the at least one client computer has been processed by the anti-malware engine, the anti-malware engine further operable to provide anti-malware protection for the at least one client computer, wherein the anti-malware engine is further operable to determine if the outbound request is classified as malware by determining whether the outbound request includes one or more valid tags embedded within links inside the outbound data message associated with the outbound request, the one or more valid tags previously embedded within each of one or more links by the anti-malware engine via processing and modifying the received inbound message addressed to the at least one client computer on the first computer network, the processing and modifying performed prior to the inbound message reaching the at least one client computer, each of the one or more links comprising a uniform resource identifier.