A method for authenticated control of content delivery, comprising: receiving, by a server device, a request for an item of content from a computing device, the request comprising a security token associated with the computing device and an identifier of a group of domains with which the security token is associated; identifying, by the server device, the group of domains from the identifier; retrieving, by the server device from a domain of the group of domains or a database of the server device, a security key associated with the group of domains; decrypting, by the server device, a signature of the security token using the security key; identifying, by the server device, an authentication string from the decrypted signature in the security token, the authentication string associated with the security token; retrieving, from the security token or the database of the server device, a server authentication string; determining, by the server device, that the authentication string matches the server authentication string; responsive to the determination that the authentication string matches the server authentication string, identifying, by the server device, characteristics of the security token, wherein the characteristics of the security token comprise a confidence score indicating a likelihood that the computing device is not associated with a malicious entity; comparing, by the server device, the confidence score of the security token to a threshold; determining, by the server device, that the confidence score does not exceed the threshold; and responsive to the determination that the confidence score does not exceed the threshold, preventing, by the server device, transmission of content to the computing device. receiving, by a server device, a request for an item of content from a computing device, the request comprising a security token associated with the computing device and an identifier of a group of domains with which the security token is associated; identifying, by the server device, the group of domains from the identifier; retrieving, by the server device from a domain of the group of domains or a database of the server device, a security key associated with the group of domains; decrypting, by the server device, a signature of the security token using the security key; identifying, by the server device, an authentication string from the decrypted signature in the security token, the authentication string associated with the security token; retrieving, from the security token or the database of the server device, a server authentication string; determining, by the server device, that the authentication string matches the server authentication string; responsive to the determination that the authentication string matches the server authentication string, identifying, by the server device, characteristics of the security token, wherein the characteristics of the security token comprise a confidence score indicating a likelihood that the computing device is not associated with a malicious entity; comparing, by the server device, the confidence score of the security token to a threshold; determining, by the server device, that the confidence score does not exceed the threshold; and responsive to the determination that the confidence score does not exceed the threshold, preventing, by the server device, transmission of content to the computing device.