Web redirection for content scanning

1. A computer-implemented method executed by one or more processors, the method comprising:

receiving from a client a first request for a network resource, the first request including an original location of the network resource;

determining that the requested network resource is to be analyzed for suitability before making the requested network resource available to the client;

in response to determining that the requested network resource is to be analyzed, sending a redirect response to the client including a modified location for the network resource different than the original location;

receiving from the client a second request for the network resource, the second request including the modified location;

in response to receiving from the client the second request for the network resource, performing a suitability analysis by:

retrieving the network resource from the original location;

applying one or more objective criteria to determine whether the retrieved network resource is suitable to send to the client; and

in response to determining that the retrieved network resource is suitable, sending the retrieved network resource to the client.

2. The method of claim 1 , wherein determining that the retrieved network resource is suitable to send to the client includes:

scanning the retrieved network resource for malicious content, wherein the determination is based at least in part on a result of the scanning.

3. The method of claim 2 , wherein scanning the retrieved network resource for malicious content includes scanning the retrieved network resource for viruses.

4. The method of claim 1 , wherein the retrieved network resource is an executable program, and wherein determining that the retrieved network resource is suitable to send to the client includes executing the retrieved network resource in a virtual environment, and wherein the determination is based at least in part on an observed behavior of the retrieved network resource during execution.

5. The method of claim 1 , wherein the network resource is a first network resource, the method further comprising:

receiving a first request for a second network resource different than the first network resource from the client, the request including an original location for the second network resource;

sending a redirect response to the client including a modified location for the second network resource;

receiving a second request for the second network resource from the client, the second request including the modified location;

in response to receiving the second request for the second network resource from the client:

determining that the retrieved network resource is not suitable to send to the client; and

sending an indication to the client that the network resource is not suitable.

6. The method of claim 1 , wherein receiving the first request for the network resource includes receiving an Hypertext Transfer Protocol (HTTP) GET request, and the original location for the network resource includes a Uniform Resource Locator (URL) for the network resource.

7. The method of claim 6 , wherein sending the redirect response to the client includes sending an HTTP redirect message to the client, and the modified location includes a URL associated with an analysis server and the URL for the network resource.

8. The method of claim 1 , wherein determining that the response to the first request is to be analyzed includes determining that a domain name associated with the network resource is included in a list of domain names to be analyzed.

9. The method of claim 1 , wherein determining that the response to the first request is to be analyzed is based at least in part on a domain name included in the original location for the network resource.

10. The method of claim 1 , wherein determining that the response to the first request is to be analyzed is based at least in part on a resource type associated with the network resource.

11. The method of claim 10 , wherein the resource type is one of a video file, an archive file, an executable file, or an image file.

12. The method of claim 10 , wherein the resource type associated with the network resource is determined based on a file extension included in the original location.

13. The method of claim 1 , wherein determining that the response to the first request is to be analyzed is based at least in part on a category associated with the network resource.

14. The method of claim 1 , wherein the client is a first client, the method further comprising:

receiving a third request for the network resource from a second client, the third request including the original location for the network resource;

sending a redirect response to the second client including the modified location for the network resource;

receiving a fourth request for the network resource from the second client, the fourth request including the modified location;

in response to receiving the fourth request for the network resource from the second client:

determining that the network resource has been previously determined to be suitable; and

sending a stored version of the network resource to the second client.

15. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

receiving from a client a first request for a network resource, the first request including an original location of the network resource;

determining that the requested network resource is to be analyzed for suitability before making the requested network resource available to the client;

in response to determining that the requested network resource is to be analyzed, sending a redirect response to the client including a modified location for the network resource different than the original location;

receiving from the client a second request for the network resource, the second request including the modified location;

in response to receiving from the client the second request for the network resource, performing a suitability analysis by:

retrieving the network resource from the original location;

applying one or more objective criteria to determine whether the retrieved network resource is suitable to send to the client; and

in response to determining that the retrieved network resource is suitable, sending the retrieved network resource to the client.

16. The computer-readable medium of claim 15 , wherein determining that the retrieved network resource is suitable to send to the client includes:

scanning the retrieved network resource for malicious content, wherein the determination is based at least in part on a result of the scanning.

17. The computer-readable medium of claim 16 , wherein scanning the retrieved network resource for malicious content includes scanning the retrieved network resource for viruses.

18. The computer-readable medium of claim 15 , wherein the retrieved network resource is an executable program, and wherein determining that the retrieved network resource is suitable to send to the client includes executing the retrieved network resource in a virtual environment, and wherein the determination is based at least in part on an observed behavior of the retrieved network resource during execution.

19. The computer-readable medium of claim 15 , wherein the network resource is a first network resource, the operations further comprising:

receiving a first request for a second network resource different than the first network resource from the client, the request including an original location for the second network resource;

sending a redirect response to the client including a modified location for the second network resource;

receiving a second request for the second network resource from the client, the second request including the modified location;

in response to receiving the second request for the second network resource from the client:

determining that the retrieved network resource is not suitable to send to the client; and

sending an indication to the client that the network resource is not suitable.

20. A system comprising:

memory for storing data; and

one or more processors operable to perform operations comprising:

receiving from a client a first request for a network resource, the first request including an original location of the network resource;

determining that the requested network resource is to be analyzed for suitability before making the requested network resource available to the client;

in response to determining that the requested network resource is to be analyzed, sending a redirect response to the client including a modified location for the network resource different than the original location;

receiving from the client a second request for the network resource, the second request including the modified location;

in response to receiving from the client the second request for the network resource, performing a suitability analysis by:

retrieving the network resource from the original location;

applying one or more objective criteria to determine whether the retrieved network resource is suitable to send to the client; and

in response to determining that the retrieved network resource is suitable, sending the retrieved network resource to the client.