Automated tracking of interaction with a resource of a message

A system, comprising:

• a communication interface configured to receive information of an electronic message to be delivered to an intended recipient, wherein the electronic message has been sent via a network by a message sender prior to being received at the communication interface of the system;
• and
• a processor coupled with the communication interface and configured to:
• determine for an original resource identifier included in the electronic message, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
• after receiving the electronic message at the recipient system and regardless of whether the original resource identifier is determined to be associated with a suspected malicious resource, replace the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
• allow the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein an interaction associated with the original resource identifier is tracked using the alternative resource identifier including by being configured to store for the original resource identifier in a data structure, an entry that includes interaction information and associated context information for a request made using the alternative resource identifier;
• obtain from the data structure storing the interaction information and the associated context information, entries for the original resource identifier to determine a scoring associated with the original resource identifier;
• and
• perform an action based on a determination that the scoring meets a threshold criteria, wherein performing the action includes performing one or more of the following:
• blocking access to the content referenced by the original resource identifier, providing a security warning, providing a modified version of the content referenced by the original resource identifier with modified functionality, logging an event associated with the request made using the alternative resource identifier, or performing an auditing operation.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving at a recipient system, information of an electronic message to be delivered to an intended recipient, wherein the electronic message has been sent via a network by a message sender prior to being received at the recipient system associated with the intended recipient;
• determining for an original resource identifier included in the electronic message, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
• after receiving the electronic message at the recipient system and regardless of whether the original resource identifier is determined to be associated with a suspected malicious resource, replacing the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
• allowing the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein an interaction associated with the original resource identifier is tracked using the alternative resource identifier including by storing for the original resource identifier in a data structure, an entry that includes interaction information and associated context information for a request made using the alternative resource identifier;
• obtaining from the data structure storing the interaction information and the associated context information, entries for the original resource identifier to determine a scoring associated with the original resource identifier;
• and
• performing an action based on a determination that the scoring meets a threshold criteria, wherein performing the action includes performing one or more of the following:
• blocking access to the content referenced by the original resource identifier, providing a security warning, providing a modified version of the content referenced by the original resource identifier with modified functionality, logging an event associated with the request made using the alternative resource identifier, or performing an auditing operation.