A method and system for correlating web content with content providers to determine the origin of the content such that it is not necessary to look inside the information exchange. The method and system maintains sequences of reference points, which are ordered lists of content providers accessed by subscribers over time, and correlates the internet content applications, such as video, found in network traffic to the sequence of reference points accessed by subscribers to determine the origins of the content even when the content being delivered by third-party content delivery networks.