1. A method for processing messages using an intermediary node, the method comprising: analyzing, via a cloud-based intermediary node, before a message is delivered to a client email server, a link included in the message to determine if the link is associated with a potentially malicious resource, the message received from a sender email server; replacing the link with an alternate link to a trusted resource if the link is associated with a potentially malicious resource; and providing, via the intermediary node, the message comprising the alternate link to a client email server.