embodiments of the invention are concerned with filtering emails having data therein identifying a link to a remote processing system , which , when activated , causes the recipient to retrieve data from the remote processing system . embodiments of the invention provide a method of modifying an electronic message during transmission through a communications network , said electronic message having a source address and a recipient address , the method comprising : interrupting transmission of the electronic message ; identifying a link specified within the electronic message ; analyzing the electronic message on the basis of at least an attribute intrinsic to the received electronic message so as to classify the received message as either a first type of message or a second , different , type of message ; if the received message is classified as the first type of message , modifying the received electronic message so as to replace the link with an alternative network location , said alternative network location corresponding to a remote processing system different to that corresponding to the link ; and transmitting the modified electronic message . in comparison to known methods , which either modify the links blindly or which perform analysis of the data to which the link is connected , embodiments of the invention selectively modify the link on the basis of various tests relating to attributes intrinsic to the email . this means that only those emails that present some sort of risk to the recipient are modified , and , because the criteria for performing the modification relate to attributes intrinsic to the emails instead of the content associated with the link , the delivery of emails is not significantly delayed by processes involved in retrieval and analysis of data from third party sites .