Using message context to evaluate security of requested data

A system, comprising:

• a communication interface;
• and
• a processor coupled with the communication interface and configured to:
• determine for an original resource identifier included in an electronic message to be delivered to an intended recipient, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
• perform domain-based authentication on the electronic message to determine that a sending domain of the electronic message fails the domain-based authentication;
• in response to determining that the sending domain of the electronic message fails the domain-based authentication, after receiving the electronic message, prior to performing a content-based security analysis associated with the original resource identifier that is delayed until a user requests content using the corresponding alternative resource identifier on the electronic message and the original resource identifier within the electronic message, and prior to delivering the electronic message to the intended recipient, replace the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
• allow the modified electronic message with the corresponding alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier;
• and
• upon receiving a request using the corresponding alternative resource identifier, perform the content-based security analysis.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• determining for an original resource identifier included in an electronic message to be delivered to an intended recipient, a corresponding alternative resource identifier that is based on both the specific intended recipient and the original resource identifier and at least in part used to obtain the original resource identifier;
• performing domain-based authentication on the electronic message to determine that a sending domain of the electronic message fails the domain-based authentication;
• in response to determining that the sending domain of the electronic message fails the domain-based authentication, after receiving the electronic message, prior to performing a content-based security analysis associated with the original resource identifier that is delayed until a user requests content using the corresponding alternative resource identifier on the electronic message and the original resource identifier within the electronic message, and prior to delivering the electronic message to the intended recipient, replacing the original resource identifier included in the electronic message with the corresponding alternative resource identifier to generate a modified electronic message;
• allowing the modified electronic message with the corresponding alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier;
• and
• upon receiving a request using the corresponding alternative resource identifier, performing the content-based security analysis.