Detecting network attacks based on network requests

One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by one or more computing systems, configure the one or more computing systems to perform operations comprising:

• generating a network-based document configured for direct access from client devices, the direct access being independent of a redirection to the network-based document via a proxy computing device;
• updating a network-based resource to cause a client device to access the network-based document, the network-based resource comprising the network-based document;
• providing, to the client device, access to the network-based resource based at least in part on a domain name system record of a domain associated with the network-based document, the domain name system record stored at a computing resource of an Internet service provider;
• recording information associated with the access of the client device to the network-based document-based at least in part on the client device accessing the network-based resource, the information comprising a request from the client device to access the network-based document,
• analyzing at least the request from the information to determine whether a condition associated with the direct access is violated;
• detecting an issue with the client device access based at least in part on determining that the condition is violated, the issue comprising an unauthorized redirection to the network-based document via the proxy computing device;
• updating a number of detected unauthorized redirections of the client devices to the network-based document based at least in part on the unauthorized redirection of the client device;
• detecting an unauthorized change to the domain name system record at the computing resource of the Internet service provider based at least in part on the number of detected unauthorized redirections;
• and
• initiating a corrective action based at least in part on the unauthorized change to the domain name system record, the corrective action comprising a notification of the unauthorized change, an analysis of accesses of the client devices to the network-based document and of the access of the client device to the network-based document, and an identification that the domain name system record has been altered based at least in part on the analysis.

A system, comprising:

• a memory configured to store computer-executable instructions;
• and
• a processor configured to access the memory and execute the computer-executable instructions to collectively at least:
• generate a network-based document generated based at least in part on a parameter configured to limit redirection via a proxy computing device, of client devices to the network-based document from other network-based documents of a network-based resource;
• update the network-based resource to cause a client device to access the network-based document, the network-based resource comprising the network-based document;
• provide, to the client device, access to the network-based resource based at least in part on a domain name system record of a domain associated with the network-based document, the domain name system record stored at a computing resource of an Internet service provider;
• store information associated with the access of the client device to the network-based document based at least in part on the client device accessing the network-based resource, the information comprising a request from the client device to access the network-based document,
• determine that the access comprises an unauthorized redirection of the client device to the network-based document via the proxy computing device based at least in part on the request from the information;
• update a number of determined unauthorized redirections of the client devices to the network-based document based at least in part on the unauthorized redirection of the client device;
• and
• detect an unauthorized change to the domain name system record at the computing resource of the Internet service provider based at least in part on the number of determined unauthorized redirections;
• and
• initiate a corrective action based at least in part on the unauthorized change, the corrective actions comprising a notification associated with the unauthorized change, an analysis of accesses of the client devices to the network-based document and of the access of the client device to the network-based document, and an identification that the domain name system record has been altered based at least in part on the analysis.