One or more non-transitory computer-readable storage media storing instructions that, when executed by a protection computing platform comprising at least one hardware processor, a communication interface, and memory, cause the protection computing platform to:
- receive, via the communication interface, from a first user computing device based on receiving user input, a first request for a first uniform resource locator associated with a first email message delivered to the first user computing device, wherein the first request corresponds to an embedded link that was rewritten into the first email message prior to receiving the user input that resulted in the first request, the embedded link directing requests to the protection computing platform instead of to a first resource corresponding to the first uniform resource locator;
- process the first request using one or more evaluation rules to determine whether to provide limited access to the first resource;
- determine to provide limited access to the first resource based on processing the first request;
- and
- initiate a browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first resource.