1. A database system for detecting and preventing phishing attacks, the database system comprising: a processor; and one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: detecting a request to open an email; sending a link contained in the email to an threat detection server in response to detecting the request to open the email; receiving a threat level identifier from the threat detection server associated with the link; and opening the email and displaying a message with the email based on the threat level identifier associated with the link.