URL rewriting

1. A system, comprising:

a processor configured to:

receive an indication that a message has arrived at a user message box;

determine that the message includes a first link to a first resource;

analyze the first link to determine whether the first link is classified as a non-rewrite link;

in response to determining that the first link is not classified as a non-rewrite link, generate a first replacement link for the first link, wherein generating the first replacement link includes generating a particular link based at least in part on a message recipient and also based at least in part on a message identifier;

track whether a particular user associated with the user message box clicks on the first replacement link; and

provide an interstitial page to the user in response to determining that the user has clicked on the first replacement link; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the processor is further configured to replace the first link in the message with the first replacement link.

3. The system of claim 2 , wherein the processor is configured to replace the first link by using an application programming interface (API) provided by a service hosting the user message box.

4. The system of claim 1 , wherein the processor is further configured to determine that the message includes a second link to a second resource, and wherein the processor is further configured to determine that the second link is classified as a non-rewrite link.

5. The system of claim 4 , wherein the second link is classified as a non-rewrite link after being determined to be a benign link.

6. The system of claim 4 , wherein the second link is classified as a non-rewrite link after being determined to be a malicious link.

7. The system of claim 6 , wherein the processor is further configured to classify the message as malicious in response to determining that the second link is a malicious link.

8. The system of claim 1 , wherein the processor is configured to determine that the first link is not classified as a non-rewrite link in response to determining that the first link is a suspicious link.

9. The system of claim 1 , wherein the processor is configured to determine that the first link is not classified as a non-rewrite link based at least in part on an analysis of a user profile.

10. The system of claim 1 , wherein generating the first replacement link includes generating a link that includes one or more recognizable elements of the first link.

11. The system of claim 1 , wherein the interstitial page provides one or more reasons that the first link was not classified as a non-rewrite link.

12. The system of claim 1 , wherein the interstitial page includes a representation of the first link.

13. The system of claim 1 , wherein the processor is further configured to perform a time-of-click analysis on the first resource in connection with providing the interstitial page.

14. The system of claim 1 , wherein the processor is further configured to classify all links within a signed message as non-rewrite links.

15. A method, comprising:

receiving an indication that a message has arrived at a user message box;

determining that the message includes a first link to a first resource;

analyzing the first link to determine whether the first link is classified as a non-rewrite link;

in response to determining that the first link is not classified as a non-rewrite link, generating a first replacement link for the first link, wherein generating the first replacement link includes generating a particular link based at least in part on a message recipient and also based at least in part on a message identifier;

tracking whether a particular user associated with the user message box clicks on the first replacement link; and

providing an interstitial page to the user in response to determining that the user has clicked on the first replacement link.

16. The method of claim 15 , further comprising replacing the first link in the message with the first replacement link.

17. The method of claim 16 , wherein replacing the first link includes using an application programming interface (API) provided by a service hosting the user message box.

18. The method of claim 15 , further comprising determining that the message includes a second link to a second resource, and determining that the second link is classified as a non-rewrite link.

19. The method of claim 18 , wherein the second link is classified as a non-rewrite link after being determined to be a benign link.

20. The method of claim 18 , wherein the second link is classified as a non-rewrite link after being determined to be a malicious link.

21. The method of claim 20 , further comprising classifying the message as malicious in response to determining that the second link is a malicious link.

22. The method of claim 15 , further comprising determining that the first link is not classified as a non-rewrite link in response to determining that the first link is a suspicious link.

23. The method of claim 15 , further comprising determining that the first link is not classified as a non-rewrite link based at least in part on an analysis of a user profile.

24. The method of claim 15 , wherein generating the first replacement link includes generating a link that includes one or more recognizable elements of the first link.

25. The method of claim 15 , wherein the interstitial page provides one or more reasons that the first link was not classified as a non-rewrite link.

26. The method of claim 15 , wherein the interstitial page includes a representation of the first link.

27. The method of claim 15 , further comprising performing a time-of-click analysis on the first resource in connection with providing the interstitial page.

28. The method of claim 15 , further comprising classifying all links within a signed message as non-rewrite links.