Manage encrypted network traffic using spoofed addresses

1. A computer-implemented method executed by one or more processors, the method comprising:

receiving a Domain Name Service (DNS) request to resolve a domain name from a client;

determining that the domain name corresponds to a real Internet Protocol (IP) address that also corresponds to at least one other domain name, wherein the real IP address corresponds to a first network location hosting a particular resource;

in response to determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name, associating a spoofed IP address with the domain name, wherein the spoofed IP address is different than the real IP address corresponding to the domain name and corresponds to a second network location different than the first network location corresponding to the real IP address, and wherein the associated spoofed IP address uniquely identifies the domain name;

sending a DNS response to the DNS request to resolve the domain name, the DNS response including the spoofed IP address associated with the domain name;

receiving, at the second network location corresponding to the spoofed IP address, a secure request for the particular resource hosted at the first network location, the secure request directed to the spoofed IP address associated with the domain name;

determining that the secure request is directed to the domain name based on the association between the spoofed IP address and the domain name, wherein the determination is performed without decrypting the secure request; and

selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name.

2. The method of claim 1 , wherein selectively decrypting the secure request comprises:

determining that the secure request should be decrypted based at least in part on one or more rules; and

decrypting the secure request to generate decrypted information.

3. The method of claim 2 , further comprising:

inspecting the decrypted information;

determining that the secure request should be forwarded based at least in part on inspecting the decrypted information and at least in part on the one or more rules; and

forwarding the secure request to the real IP address associated with the domain name.

4. The method of claim 3 , wherein forwarding the secure request comprises:

re-encrypting the secure request; and

sending the secure request to the real IP address associated with the domain name.

5. The method of claim 2 , further comprising:

inspecting the decrypted information;

determining that the secure request should be forwarded based at least in part on inspecting the decrypted information and at least in part on the one or more rules;

modifying the decrypted information based at least in part on the one or more rules;

encrypting the decrypted information to produce a second secure request; and

forwarding the secure request to the real IP address associated with the domain name.

6. The method of claim 2 , further comprising:

inspecting the decrypted information;

determining that the secure request should be blocked based at least in part on inspecting the decrypted information and at least in part on the one or more rules; and

blocking the secure request.

7. The method of claim 6 , wherein blocking the secure request includes sending a redirect response to the secure request, the redirect response including an address associated with a block notification page.

8. The method of claim 1 , wherein receiving the secure request for the particular resource comprises:

establishing a first secure connection with a sender of the secure request; and

establishing a second secure connection with the first network location hosting the particular resource identified by the secure request after establishing the first secure connection with the sender.

9. The method of claim 1 , wherein receiving the secure request for the particular resource comprises:

establishing a first secure connection with the first network location hosting the particular resource identified by the secure request; and

establishing a second secure connection with a sender of the secure request after establishing the first secure connection with the first network location.

10. The method of claim 1 , wherein selectively decrypting the secure request comprises:

determining that the secure request should not be decrypted based at least in part on one or more rules; and

forwarding the secure request to the real IP address associated with the domain name.

11. The method of claim 1 , wherein the domain name is a first domain name, the method further comprising:

receiving a request to resolve a second domain name different than the first domain name;

determining that the second domain name corresponds to a real Internet Protocol (IP) address that does not also correspond to another domain name; and

sending a response to the request to resolve the second domain name, the response including the real IP address corresponding to the second domain name.

12. The method of claim 1 , further comprising:

receiving a second DNS request to resolve the domain name;

determining that the domain name is associated with the spoofed IP address; and

sending a response to the second request to resolve the domain name, the response including the spoofed IP address.

13. The method of claim 1 , wherein the spoofed IP address includes an IP port.

14. The method of claim 1 , wherein receiving the secure request for the particular resource includes receiving a request according to Hypertext Transfer Protocol Secure (HTTPS).

15. A system comprising:

memory for storing data; and

one or more processors operable to perform operations comprising:

receiving a Domain Name Service (DNS) request to resolve a domain name from a client;

determining that the domain name corresponds to a real Internet Protocol (IP) address that also corresponds to at least one other domain name, wherein the real IP address corresponds to a first network location hosting a particular resource;

in response to determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name, associating a spoofed IP address with the domain name, wherein the spoofed IP address is different than the real IP address corresponding to the domain name and corresponds to a second network location different than the first network location corresponding to the real IP address, and wherein the associated spoofed IP address uniquely identifies the domain name;

sending a DNS response to the DNS request to resolve the domain name, the DNS response including the spoofed IP address associated with the domain name;

receiving, at the second network location corresponding to the spoofed IP address, a secure request for the particular resource hosted at the first network location, the secure request directed to the spoofed IP address associated with the domain name;

determining that the secure request is directed to the domain name based on the association between the spoofed IP address and the domain name, wherein the determination is performed without decrypting the secure request; and

selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name.

16. The system of claim 15 , wherein selectively decrypting the secure request comprises:

determining that the secure request should be decrypted based at least in part on one or more rules; and

decrypting the secure request to generate decrypted information.

17. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

receiving a Domain Name Service (DNS) request to resolve a domain name from a client;

determining that the domain name corresponds to a real Internet Protocol (IP) address that also corresponds to at least one other domain name, wherein the real IP address corresponds to a first network location hosting a particular resource;

in response to determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name, associating a spoofed IP address with the domain name, wherein the spoofed IP address is different than the real IP address corresponding to the domain name and corresponds to a second network location different than the first network location corresponding to the real IP address, and wherein the associated spoofed IP address uniquely identifies the domain name;

sending a DNS response to the DNS request to resolve the domain name, the DNS response including the spoofed IP address associated with the domain name;

receiving, at the second network location corresponding to the spoofed IP address, a secure request for the particular resource hosted at the first network location, the secure request directed to the spoofed IP address associated with the domain name;

determining that the secure request is directed to the domain name based on the association between the spoofed IP address and the domain name, wherein the determination is performed without decrypting the secure request; and

selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name.

18. The computer-readable medium of claim 17 , wherein the domain name is a first domain name, the operations further comprising:

receiving a request to resolve a second domain name different than the first domain name;

determining that the second domain name corresponds to a real IP address that does not also correspond to another domain name; and

sending a response to the request to resolve the second domain name, the response including the real IP address corresponding to the second domain name.

19. The method of claim 1 , wherein determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name includes determining that the domain name is included in a pre-determined list of domain names that correspond to real IP addresses that also correspond to at least one other domain name.