Method and system for detecting restricted content associated with retrieved content

1. A method for operating a scanning facility executing on processing circuitry, the method comprising:

receiving a plurality of client requests for content from a client at the scanning facility, each one of the requests including an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name;

saving contextual information from the requests at the scanning facility, wherein the contextual information includes a changing character string from a first one of the plurality of requests to a second one of the plurality of requests and wherein the changing character string further includes at least one change to header information for the requests;

examining the requests for compliance with a management policy at the scanning facility;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information and a corresponding plurality of content items responsive to the plurality of requests to detect whether the plurality of content item includes restricted content from a list of restrictions in the management policy.

2. The method of claim 1 wherein the contextual information includes a changed portion of a received address.

3. The method of claim 1 wherein the contextual information further includes an unchanged portion of a character string from the first one of the plurality of requests to the second one of the plurality of requests.

4. The method of claim 1 wherein the contextual information further includes a unique sequence of addresses from the client.

5. The method of claim 1 wherein the contextual information includes a detected pattern in a sequence of the plurality of requests.

6. The method of claim 1 wherein analyzing includes analyzing a second header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

7. The method of claim 1 wherein the scanning facility is local to the client.

8. The method of claim 1 wherein the scanning facility is a server-based scanning facility.

9. The method of claim 1 further comprising blocking the restricted content from the client.

10. The method of claim 1 further comprising performing a remedial action on the client in response to the restricted content.

11. A computer program product comprising non-transitory computer executable code embodied on a non-transitory computer-readable medium that, when executing on a scanning facility, performs the steps of:

receiving a plurality of client requests for content from a client at the scanning facility, each one of the requests including an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name;

saving contextual information from the requests at the scanning facility, wherein the contextual information includes a changing character string from a first one of the plurality of requests to a second one of the plurality of requests and wherein the changing character string further includes at least one change to header information for the requests;

examining the requests for compliance with a management policy at the scanning facility;

retrieving a content item responsive to the request at the scanning facility; and

analyzing, with the scanning facility, the contextual information and a corresponding plurality of content items responsive to the plurality of requests to detect whether the plurality of content item includes restricted content from a list of restrictions in the management policy.

12. The computer program product of claim 11 wherein the contextual information includes a changed portion of a received address.

13. The computer program product of claim 11 wherein the contextual information further includes an unchanged portion of a character string from the first one of the plurality of requests to the second one of the plurality of requests.

14. The computer program product of claim 11 wherein the contextual information further includes a unique sequence of addresses from the client.

15. The computer program product of claim 11 wherein the contextual information includes a detected pattern in a sequence of the plurality of requests.

16. The computer program product of claim 11 wherein analyzing includes analyzing a second header information for the content item responsive to the request to detect whether the content item includes restricted content from a list of restrictions in the management policy.

17. The computer program product of claim 11 wherein the scanning facility executes locally on the client.

18. A system comprising:

a client; and

a scanning facility coupled in a communicating relationship with the client through a data network, the scanning facility storing computer code configured to perform the steps of receiving a plurality of requests for content from a client at the scanning facility, each one of the requests including an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name, saving contextual information from the request at the scanning facility wherein the contextual information includes a changing character string from a first one of the plurality of requests to a second one of the plurality of requests and wherein the changing character string further includes at least one change to header information for the requests, retrieving a content item responsive to the request at the scanning facility, and analyzing the contextual information and the corresponding plurality of content items responsive to the plurality of requests to detect whether the plurality of content item includes restricted content from a list of restrictions in the management policy.