Embodiments provide a method for validating a network host listed in a body of an email. The method includes: receiving, by the processer, the email; checking, by the processer, whether a threat analytics option is enabled. If the threat analytics option is enabled, the method further includes: copying, by the processer, an original body field of the email into a new body field; converting, by the processor, a text representation of the network host into a link in the new body field; modifying, by the processer, a text style of the link in the new body field according to a threat analytics result from a threat analytics service; and displaying, by the processer, the email with the new body field, wherein the email includes the link having a modified text style.