A method and system to verify active content in a server system include receiving a communication (e.g., an e-mail message or an e-commerce listing) that includes active content to be made accessible by the server system. A reference (e.g., a URL) within the active content is identified, the reference pointing to further data that is not included within the communication. This further data is to be retrieved when the active content is rendered. The reference is stored at the server system, and the further data, to which the reference points, is repetitively and periodically retrieved. Subsequent to each retrieval of the further data, a determination is made as to whether the further data is malicious.