1. A database system for detecting and preventing phishing attacks, the database system comprising: a hardware processor; and one or more stored sequences of instructions which, when executed by the hardware processor, cause the hardware processor to perform operations comprising: detecting a request from a user to open an electronic mail message (email) after the email has arrived and received in a user mailbox; sending a link contained in the received email to a threat detection server in response to detecting the user request to open the received email from the user mailbox; receiving a threat level indication for the link back from the threat detection server; modifying a document object model (DOM) for the received email to include a message indicating the threat level of the link; and opening the received email and using the modified DOM to display the included message based on a type of the threat level indication received from the threat detection server.