Methods and systems for determining domain names and organization names associated with participants involved in secured sessions

A computer-implemented method for determining at least one of a domain name and an organization name associated with a server, the method being performed by one or more processors, the method comprising:

• acquiring one or more handshake messages associated with establishing or resuming a secure session with the server;
• determining whether the one or more handshake messages include one or more site textual identifiers;
• and
• if the one or more handshake messages does not include one or more site textual identifiers:
• acquiring the at least one of a domain name and an organization name based on querying a historical identification database using at least one of a session identifier and an IP address associated with the server.

A non-transitory computer readable storage medium storing instruction that are executable by one or more processors to cause the one or more processors to perform a method for determining at least one of a domain name and an organization name associated with a server, the method comprising:

• acquiring one or more handshake messages associated with establishing or resuming a secure session with the server;
• determining whether the one or more handshake messages include one or more site textual identifiers;
• and
• if the one or more handshake messages does not include one or more site textual identifiers:
• acquiring the at least one of a domain name and an organization name based on querying a historical identification database using at least one of a session identifier and an IP address associated with the server.