Attackers often include links in emails that lead to fake websites or install malware. Advanced Threat Protection rewrites and scans every link in real time when someone clicks it. Unsafe links are blocked and replaced with a warning page to prevent users from reaching harmful sites.