Method and system for detecting restricted content associated with retrieved content

1. A method for using a scanning facility executing on processing circuitry, the method comprising:

receiving a request for a file from a client at the scanning facility, the request including an outbound network request from the client to a network location for the file specified by a Uniform Resource Identifier (URI) including a domain for the URI;

saving contextual information from the request at the scanning facility, wherein the contextual information includes first locale information specifying a first location associated with the domain for the URI;

examining the request for compliance with a management policy at the scanning facility;

in response to the request retrieving the file from the network location and transmitting the file to the scanning facility;

at a computer presented with the file, extracting second locale information from the file, the second locale information indicating a source of the file, the source including at least one of a geographic location, a business location, a residence location, an author, and a machine;

presenting the second locale information and the file to the scanning facility; and

analyzing, with the scanning facility, the first locale information specifying the first location associated with the domain for the URI from the request comparatively with the second locale information extracted from the file and indicating the source of the file to detect whether the file includes restricted content based on one or more locale restrictions of the management policy.

2. The method of claim 1 , wherein the contextual information further includes one or more of a known alphanumeric string within the request from the client and a sequence of alphanumeric strings in a series of client requests.

3. The method of claim 1 , wherein access to the URI directs a user to another web page.

4. The method of claim 1 wherein analyzing includes analyzing header information for the file responsive to the request to detect whether the file includes restricted content from a list of restrictions in the management policy.

5. The method of claim 1 , further comprising executing the scanning facility on the client.

6. The method of claim 1 , further comprising executing the scanning facility on a remote threat management facility.

7. The method of claim 1 , further comprising, when the file includes restricted content, blocking the restricted content from the client.

8. The method of claim 1 , further comprising, when the file includes restricted content, performing a remedial action on the client in response to the restricted content.

9. The method of claim 1 , wherein contextual information includes path information in the request.

10. The method of claim 1 , wherein the contextual information includes a registered domain name for an organization.

11. The method of claim 1 , wherein the contextual information includes header information in the request.

12. The method of claim 1 , wherein the contextual information includes data indicating a source of the request.

13. The method of claim 1 , wherein the contextual information includes header information for the file retrieved in response to the request.

14. The method of claim 1 , wherein the second local information indicates a reputation of content of the file.

15. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices associated with a scanning, performs the steps of:

receiving a request for a file from a client at a scanning facility, the request including an outbound network request from the client to a network location for the file specified by a Uniform Resource Identifier (URI) including a domain for the URI;

saving contextual information from the request at the scanning facility, wherein the contextual information includes first locale information specifying a first location associated with the domain for the URI;

examining the request for compliance with a management policy at the scanning facility;

in response to the request, retrieving the file from the network location and transmitting the file to the scanning facility;

extracting second locale information from the file at a computer presented with the file, the second locale information indicating a source of the file, the source including at least one of a geographic location, a business location, a residence location, an author, and a machine;

presenting the second locale information and the file to the scanning facility; and

analyzing, with the scanning facility, the first locale information specifying the first location associated with the domain of the URI from the request comparatively with the second locale information extracted from the file and indicating the source of the file to detect whether the file includes restricted content based on one or more locale restrictions of the management policy.

16. The computer program product of claim 15 , wherein the contextual information further includes one or more of a known alphanumeric string within the request from the client and a sequence of alphanumeric strings in a series of client requests.

17. The computer program product of claim 15 , wherein the contextual information further includes a changed portion of the request relative to other requests.

18. The computer program product of claim 17 , wherein access to the URI directs a user to another web page.

19. The computer program product of claim 15 , wherein analyzing includes analyzing header information for the file responsive to the request to detect whether the file includes restricted content from a list of restrictions in a management policy.

20. A system comprising:

one or more hardware processors;

a non-transitory computer readable medium comprising instructions executable by the one or more hardware processors; and

a scanning facility configured to receive a request for a file from a client, the request including an outbound network request from the client to a network location specified by a Uniform Resource Identifier (URI) including a domain for the URI, the scanning facility further configured to save contextual information from the request including first locale information specifying the first location associated with the domain for the URI, to examine the request for compliance with a management policy at the scanning facility, to retrieve the file responsive to the request, to extract at a computer presented with the file second locale information from the file, the second locale information indicating a source of the file, the source including at least one of a geographic location, a business location, a residence location, an author, and a machine, and to analyze the first locale information specifying the first location associated with the domain of the URI from the request comparatively with the second locale information extracted from the file and indicating the source of the file to detect whether the file includes restricted content based on one or more locale restrictions of the management policy.