# US 12,001,504 B2 · Internet-based proxy service to modify internet responses

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,504 B2
- Document ID: US12001504B2
- Status: Granted
- Kind: B2
- Application number: 17/234,517
- Filed: 2021-04-19
- Published: 2021-08-05
- Granted: 2024-06-04
- Earliest claimed: 2010-04-01
- Assignees: Cloudflare, Inc.
- Applicants: CloudFlare, Inc.
- Inventors: Lee Hahn Holloway; Matthew Browning Prince; Matthieu Philippe François Tourne
- Web page: https://patentgrep.com/patent/US12001504B2

## CPC

- H04L 63/0281: {Proxies}
- G06F 15/16: Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs {(coordinating program control therefor G06F9/52; in regulating and control system G05B)}
- G06F 16/95: Retrieval from the web
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 40/14: Tree-structured documents (parsing G06F40/205; validation G06F40/226)
- G06F 40/143: Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
- G06Q 10/107: Computer-aided management of electronic mailing [e-mailing]
- G06Q 30/0241: Advertisements
- G06Q 30/0251: Targeted advertisements
- G06Q 30/0277: {Online advertisement}
- H04L 47/745: {Reaction in network}
- H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes
- H04L 61/4511: using domain name system [DNS]
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0254: {Stateful filtering}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/102: {Entity profiles}
- H04L 63/126: {the source of the received data}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54)
- H04L 67/561: Adding application-functional data or data for application control, e.g. adding metadata
- H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching
- H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06)
- H04L 61/59: using proxies for addressing
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A proxy server receives from a client device a request for a network resource that is hosted at an origin server for a domain. The request is received at the proxy server as a result of DNS request for the domain returning an IP address of the proxy server instead of an IP address of the origin server. The proxy server retrieves the requested network resource. The proxy server determines that the retrieved network resource includes at least one modification token that is of a type that indicates a threat to the client device. For at least this modification token, the proxy server automatically modifies at least a portion of the retrieved network resource that corresponds to that modification token. The proxy server transmits the modified network resource to the client device.

## Claims

### Claim 1

A method in a first proxy server to modify Internet responses, comprising:
receiving, from a first client device at the first proxy server of a plurality of proxy servers that provide an internet-based proxy service, a first request for a first network resource that is hosted at a first origin server for a first domain, wherein the first request is received at the first proxy server as a result of a first Domain Name System (DNS) request for the first domain returning a first IP address that is a same anycast IP address among the plurality of proxy servers instead of a second IP address of the first origin server;
retrieving the requested first network resource including transmitting the first request to the first origin server and receiving the requested first network resource from the first origin server in response;
determining that the retrieved first network resource includes at least one modification token that is of a type that indicates a threat to the first client device;
for the at least one modification token that is of a type that indicates a threat to the first client device, automatically modifying, by the first proxy server, at least a portion of the retrieved first network resource that corresponds to that modification token;
transmitting, by the first proxy server, the modified first network resource to the first client device;
receiving, from a second client device at the first proxy server, a second request for a second network resource that is hosted at a second origin server for a second domain, wherein the second request is received at the first proxy server as a result of a second DNS request for the second domain returning a third IP address that is a same anycast IP address among the plurality of proxy servers instead of a fourth IP address of the second origin server;
retrieving the requested second network resource including transmitting the second request to the second origin server and receiving the requested second network resource from the second origin server in response;
determining that the retrieved second network resource includes at least one modification token that that indicates an element to be obfuscated; and
automatically modifying the portion of the retrieved second network resource that corresponds to the obfuscation modification token including automatically replacing at least the element to be obfuscated that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the second client device, generates the element such that it will be displayed when rendered while not being directly readable by bots.

### Claim 2 (depends on 1)

The method of claim 1, wherein the retrieved first network resource is a HyperText Markup Language (HTML) page.

### Claim 3 (depends on 1)

The method of claim 1, wherein the threat to the first client device is malware included in the retrieved first network resource.

### Claim 4 (depends on 1)

The method of claim 1, wherein the element to be obfuscated is one of: a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
receiving, from a third client device at the first proxy server, a third request for a third network resource that is hosted at a third origin server for a third domain, wherein the third request is received at the first proxy server as a result of a third DNS request for the third domain returning a fifth IP address that is a same anycast IP address among the plurality of proxy servers instead of a sixth IP address of the third origin server;
retrieving the requested third network resource including transmitting the third request to the third origin server and receiving the requested third network resource from the third origin server in response;
determining that the retrieved third network resource includes at least one server side defined modification (SSDM) token that is defined by an administrator of the third domain and indicates that content is subject to being one of excluded and obfuscated; and
automatically modifying at least a portion of the content of the retrieved third network resource that corresponds to the SSDM token.

### Claim 6 (depends on 1)

The method of claim 1, wherein the element to be obfuscated is an email address, and wherein the obfuscation script, when executed by the client network application of the second client device, hides that email address from automated bots and generates the email address to be displayed when rendered.

### Claim 7 (depends on 6)

The method of claim 6, wherein the obfuscation script further, when executed by the client network application of the second client device, encodes the email address as displayed with a mailto attribute.

### Claim 8

A first proxy server to modify Internet responses, comprising:
a memory to store instructions; and
a processor coupled with the memory to process the stored instructions to:
receive, from a first client device at the first proxy server of a plurality of proxy servers that provide an internet-based proxy service, a first request for a first network resource that is hosted at a first origin server for a first domain, wherein the first request is to be received at the first proxy server as a result of a first Domain Name System (DNS) request for the first domain returning a first IP address that is a same anycast IP address among the plurality of proxy servers of the proxy server instead of a second IP address of the first origin server;
retrieve the requested first network resource including transmission of the first request to the first origin server and receipt of the requested first network resource from the first origin server in response;
determine that the retrieved first network resource includes at least one modification token that is of a type that indicates a threat to the first client device;
for the at least one modification token that is of a type that indicates a threat to the first client device, automatically modify, by the first proxy server, at least a portion of the retrieved first network resource that corresponds to that modification token;
transmit, by the first proxy server, the modified first network resource to the first client device;
receive, from a second client device at the first proxy server, a second request for a second network resource that is hosted at a second origin server for a second domain, wherein the second request is to be received at the first proxy server as a result of a second DNS request for the second domain returning a third IP address that is a same anycast IP address among the plurality of proxy servers instead of a fourth IP address of the second origin server;
retrieve the requested second network resource including transmission of the second request to the second origin server and receipt of the requested second network resource from the second origin server in response;
determine that the retrieved second network resource includes at least one modification token that that indicates an element to be obfuscated; and
automatically modify the portion of the retrieved second network resource that corresponds to the obfuscation modification token including automatically replacing at least the element to be obfuscated that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the second client device, generates the element such that it will be displayed when rendered while not being directly readable by bots.

### Claim 9 (depends on 8)

The first proxy server of claim 8, wherein the retrieved first network resource is a HyperText Markup Language (HTML) page.

### Claim 10 (depends on 8)

The first proxy server of claim 8, wherein the threat to the first client device is malware included in the retrieved first network resource.

### Claim 11 (depends on 8)

The first proxy server of claim 8, wherein the element to be obfuscated is one of: a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

### Claim 12 (depends on 8)

The first proxy server of claim 8, the processor is to process the stored instructions to:
receive, from a third client device at the first proxy server, a third request for a third network resource that is hosted at a third origin server for a third domain, wherein the third request is to be received at the first proxy server as a result of a third DNS request for the third domain returning a fifth IP address that is a same anycast IP address among the plurality of proxy servers instead of a sixth IP address of the third origin server;
retrieve the requested third network resource including transmission of the third request to the third origin server and receipt of the requested third network resource from the third origin server in response;
determine that the retrieved third network resource includes at least one server side defined modification (SSDM) token that is defined by an administrator of the third domain and indicates that content is subject to being one of excluded and obfuscated; and
automatically modify at least a portion of the content of the retrieved third network resource that corresponds to the SSDM token.

### Claim 13 (depends on 8)

The first proxy server of claim 8, wherein the element to be obfuscated is an email address, and wherein the obfuscation script, when executed by the client network application of the second client device, hides that email address from automated bots and generates the email address to be displayed when rendered.

### Claim 14 (depends on 13)

The first proxy server of claim 13, wherein the obfuscation script further, when executed by the client network application of the second client device, encodes the email address as displayed with a mailto attribute.

### Claim 15

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a first proxy server, cause said processor to perform operations comprising:
receiving, from a first client device at the first proxy server of a plurality of proxy servers that provide an internet-based proxy service, a first request for a first network resource that is hosted at a first origin server for a first domain, wherein the first request is received at the first proxy server as a result of a first Domain Name System (DNS) request for the first domain returning a first IP address that is a same anycast IP address among the plurality of proxy servers instead of a second IP address of the first origin server;
retrieving the requested first network resource including transmitting the first request to the first origin server and receiving the requested first network resource from the first origin server in response;
determining that the retrieved first network resource includes at least one modification token that is of a type that indicates a threat to the first client device;
for the at least one modification token that is of a type that indicates a threat to the first client device, automatically modifying, by the first proxy server, at least a portion of the retrieved first network resource that corresponds to that modification token;
transmitting, by the first proxy server, the modified first network resource to the first client device;
receiving, from a second client device at the first proxy server, a second request for a second network resource that is hosted at a second origin server for a second domain, wherein the second request is received at the first proxy server as a result of a second DNS request for the second domain returning a third IP address that is a same anycast IP address among the plurality of proxy servers instead of a fourth IP address of the second origin server;
retrieving the requested second network resource including transmitting the second request to the second origin server and receiving the requested second network resource from the second origin server in response;
determining that the retrieved second network resource includes at least one modification token that that indicates an element to be obfuscated; and
automatically modifying the portion of the retrieved second network resource that corresponds to the obfuscation modification token including automatically replacing at least the element to be obfuscated that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the second client device, generates the element such that it will be displayed when rendered while not being directly readable by bots.

### Claim 16 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the retrieved first network resource is a HyperText Markup Language (HTML) page.

### Claim 17 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the threat to the first client device is malware included in the retrieved first network resource.

### Claim 18 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the element to be obfuscated is one of: a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

### Claim 19 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the operations further comprise:
receiving, from a third client device at the first proxy server, a third request for a third network resource that is hosted at a third origin server for a third domain, wherein the third request is received at the first proxy server as a result of a third DNS request for the third domain returning a fifth IP address that is a same anycast IP address among the plurality of proxy servers instead of a sixth IP address of the third origin server;
retrieving the requested third network resource including transmitting the third request to the third origin server and receiving the requested third network resource from the third origin server in response;
determining that the retrieved third network resource includes at least one server side defined modification (SSDM) token that is defined by an administrator of the third domain and indicates that content is subject to being one of excluded and obfuscated; and
automatically modifying at least a portion of the content of the retrieved third network resource that corresponds to the SSDM token.

### Claim 20 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the element to be obfuscated is an email address, and wherein the obfuscation script, when executed by the client network application of the second client device, hides that email address from automated bots and generates the email address to be displayed when rendered.

### Claim 21 (depends on 20)

The non-transitory machine-readable storage medium of claim 20, wherein the obfuscation script further, when executed by the client network application of the second client device, encodes the email address as displayed with a mailto attribute.