No it doesn't look at links in email.   At the time you click on the link, and if it is an http request, then AMP will analyse the content being downloaded.   Often Content Filtering is a better way to deal with these.  I use Content Filtering to block these categories (purely for security reasons): Bot Nets Illegal Malware Sites Proxy Avoidance and Anonymizers   ... View more