Domain name resolution

A computerized method for inferring a domain for an IP address, the method performed using at least one processor, the method comprising:

• receiving, by the at least one processor, a computerized flow record from a communication service provider including the IP address, wherein the IP address corresponds to a request from a subscriber for an Internet resource;
• performing, by the at least one processor, an in-stream lookup comprising:
• determining, by the at least one processor, whether any secure socket layer (“SSL”) exchanges result from the request for the Internet resource;
• when the SSL exchanges exist, attempting to retrieve domain information corresponding to the IP address from the SSL exchanges;
• determining, by the at least one processor, whether any domain name system (“DNS”) records exist that include the IP address;
• and
• when the DNS records exist that include the IP address, attempting to retrieve the domain information corresponding to the IP address from the DNS records;
• performing, by the at least one processor, contextual mapping comprising:
• performing a whois query using the IP address in an attempt to identify the domain information corresponding to the IP address;
• performing a reverse DNS lookup in an attempt to identify the domain information corresponding to the IP address;
• attempting to establish an SSL connection to the IP address to identify the domain information;
• and
• querying clickstream information from the content service provider in an attempt to identify the domain information;
• and
• performing, by the at least one processor, a learning process to populate a database used while performing contextual mapping, the learning process comprising at least one of:
• performing deep packet inspection to obtain DNS queries and response logs;
• capturing network traffic within a network to trace domain resolutions within the network;
• attempting to access a webpage associated with the IP address;
• and
• analyzing clickstream data.