A computer-implemented method executed by one or more processors, the method comprising: receiving a Domain Name Service request to resolve a domain name from a client; determining that the domain name corresponds to a real Internet Protocol address that also corresponds to at least one other domain name, wherein the real IP address corresponds to a first network location hosting a particular resource; in response to determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name, associating a spoofed IP address with the domain name, wherein the spoofed IP address is different than the real IP address corresponding to the domain name and corresponds to a second network location different than the first network location corresponding to the real IP address, and wherein the associated spoofed IP address uniquely identifies the domain name; sending a DNS response to the DNS request to resolve the domain name, the DNS response including the spoofed IP address associated with the domain name; receiving, at the second network location corresponding to the spoofed IP address, a secure request for the particular resource hosted at the first network location, the secure request directed to the spoofed IP address associated with the domain name; determining that the secure request is directed to the domain name based on the association between the spoofed IP address and the domain name, wherein the determination is performed without decrypting the secure request; and characterized by selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name. receiving a Domain Name Service request to resolve a domain name from a client; determining that the domain name corresponds to a real Internet Protocol address that also corresponds to at least one other domain name, wherein the real IP address corresponds to a first network location hosting a particular resource; in response to determining that the domain name corresponds to the real IP address that also corresponds to at least one other domain name, associating a spoofed IP address with the domain name, wherein the spoofed IP address is different than the real IP address corresponding to the domain name and corresponds to a second network location different than the first network location corresponding to the real IP address, and wherein the associated spoofed IP address uniquely identifies the domain name; sending a DNS response to the DNS request to resolve the domain name, the DNS response including the spoofed IP address associated with the domain name; receiving, at the second network location corresponding to the spoofed IP address, a secure request for the particular resource hosted at the first network location, the secure request directed to the spoofed IP address associated with the domain name; determining that the secure request is directed to the domain name based on the association between the spoofed IP address and the domain name, wherein the determination is performed without decrypting the secure request; and characterized by selectively decrypting the secure request based at least in part on determining that the secure request is directed to the domain name.