Targeted Attack Protection from Malicious Links in Messages Using Predictive Sandboxing

A system for protecting users from malicious content, the system comprising:

• at least one hardware processor;
• and
• a memory for storing logic, the logic being executed by the at least one hardware processor to execute operations comprising:
• retrieving, by a hardware processor, a URL link in an electronic message sent to a user in a user computer environment, the URL link pointing at linked content;
• tracking electronic messages that include the URL link, the tracking including determining a number of electronic messages that include the URL link;
• determining the number of electronic messages that include the URL link exceeds a predetermined threshold;
• and
• selectively queuing the URL link for sandboxing, the sandboxing including analyzing behavior of the URL link actuated in another computer environment separate from the user computer environment.

A non-transitory computer-readable storage medium having embodied thereon instructions, which, when executed by at least one processor, perform steps of a method, the method for protecting a user from malicious content, the method comprising:

• retrieving, by a hardware processor, a URL link in an electronic message sent to the user for accessing by the user using a user computer environment, the URL link pointing at linked content;
• tracking electronic messages that include the URL link, the tracking including determining a number of electronic messages that include the URL link;
• determining the number of electronic messages that include the URL link exceeds a predetermined threshold;
• and
• selectively queuing the URL link for sandboxing, the sandboxing including analyzing behavior of the URL link actuated in another computer environment separate from the user computer environment.