1. A method of finding abnormalities in otherwise legitimate emails containing Uniform Resource Locators (URLs), the method comprising: training, using one or more processors based on dynamically aggregated historical email data received from a service provider directed to a group of clients, one or more machine learning algorithms to determine normal patterns in addressees, URLs, and a number of sending Top-Level Domains of emails received via the Internet by the group of clients; generating a network of trusted addressees based on the determined normal patterns, the generating including determining a first client is a trusted addressee of a second client based on: determining, based on the determined normal patterns, the first client is a trusted addressee of a third client, and determining, based on the determined normal patterns, the third client is a trusted addressee of the second client; determining, using the one or more processors, whether a received email addressed to the group of clients matches the normal patterns in the addressees, the URLs, and the number of sending Top-Level Domains determined by the one or more machine learning algorithms, the determining based on an addressee, at least one URL, and a sending Top-Level Domain of the received email; based on the generated network of trusted addressees and the determining whether the received email addressed to the group of clients matches the normal patterns, replacing the at least one URL with a predetermined safe URL; and retraining, based on whether the received email matches the normal patterns in the addressees, the URLs, and the number of sending Top-Level Domains, the one or more machine learning algorithms to dynamically update the normal patterns in the addressees, the URLs, and the number of sending Top-Level Domains and to dynamically update the network of trusted addressees.