A technique for web filtering includes monitoring and recording completed DNS (domain name service) transactions involving a user computer. The user computer may thereafter issue an HTTP (hypertext transport protocol) request to a remote server computer, with the HTTP request including an IP address of the server computer instead of its domain name. The HTTP request may be correlated with the recorded completed DNS transactions to obtain the domain name of the server computer. The domain name of the server computer may be employed to determine the reputation of the domain name for web filtering purposes.