Method and system for detecting restricted content associated with retrieved content

A method for operating a scanning facility executing on processing circuitry, the method comprising:

• receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI;
• saving contextual information from the request at the scanning facility, wherein the contextual information includes, in at least a portion of the URI, an alphanumeric pattern associated with malware;
• examining the request for compliance with a management policy at the scanning facility;
• retrieving a content item responsive to the request at the scanning facility;
• and
• analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content based on the management policy.

A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a scanning facility, performs the steps of:

• receiving a request for content from a client at the scanning facility, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI;
• saving contextual information from the request at the scanning facility, wherein the contextual information includes, in at least a portion of the URI, an alphanumeric pattern associated with malware;
• examining the request for compliance with a management policy at the scanning facility;
• retrieving a content item responsive to the request at the scanning facility;
• and
• analyzing, with the scanning facility, the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content based on the management policy.

A system comprising:

• one or more hardware processors;
• a non-transitory computer readable medium comprising instructions executable by the one or more hardware processors;
• and
• a scanning facility configured to receive a request for content from a client, the request including an outbound network request from the client with a Uniform Resource Identifier (URI) including a domain for the URI, the scanning facility further configured to save contextual information from the request including, in at least a portion of the URI, an alphanumeric pattern associated with malware, to examine the request for compliance with a management policy at the scanning facility, to retrieve a content item responsive to the request, and to analyze the contextual information from the request and the content item responsive to the request to detect whether the content item includes restricted content based on the management policy.