Techniques are described for detecting restricted content associated with retrieved content. A method and system includes receiving a client request for content, where the request includes an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name, saving contextual information from the request, examining the request for compliance with a management policy, retrieving a content item responsive to the request, and analyzing the contextual information from the request and the content item to detect whether the content item includes restricted content from a list of restrictions in the management policy. A scanning facility may thus utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.