A method comprising: detecting a plurality of connection requests relating to monitored network traffic passing through a network apparatus; extracting data comprising at least a host name of a host, which is configured to host resources, and a time of a respective connection request for each connection request of the plurality of connection requests; analyzing, for any connection request, the data to determine whether the host is in an active state, the active state meaning that resources hosted by the host are currently being actively accessed, whether the host matches a domain referrer of a Hypertext Transfer Protocol, HTTP, request header of the connection request, and an amount of time from an immediately preceding last connection request; in response to detecting that the host is not in the active state, the host does not match the domain referrer, and the amount of time from the immediately preceding last connection request exceeds a predetermined new session threshold, classifying a connection request as a main request and switching the host to the active state; in response to detecting that the amount of time from the immediately preceding last connection request is below a predetermined continuous session threshold, classifying any connection requests following the main request as sub-requests; in response to detecting, for a sub-request, that a domain of the host in the active state does not match a domain of a current host for the sub-request, classifying the sub-request as a third-party sub-request, or else classifying the sub-request as a first-party sub-request; and taking further action to protect one or more computer devices of a computer network system from a security threat caused by the third-party sub-request. detecting a plurality of connection requests relating to monitored network traffic passing through a network apparatus; extracting data comprising at least a host name of a host, which is configured to host resources, and a time of a respective connection request for each connection request of the plurality of connection requests; analyzing, for any connection request, the data to determine whether the host is in an active state, the active state meaning that resources hosted by the host are currently being actively accessed, whether the host matches a domain referrer of a Hypertext Transfer Protocol, HTTP, request header of the connection request, and an amount of time from an immediately preceding last connection request; in response to detecting that the host is not in the active state, the host does not match the domain referrer, and the amount of time from the immediately preceding last connection request exceeds a predetermined new session threshold, classifying a connection request as a main request and switching the host to the active state; in response to detecting that the amount of time from the immediately preceding last connection request is below a predetermined continuous session threshold, classifying any connection requests following the main request as sub-requests; in response to detecting, for a sub-request, that a domain of the host in the active state does not match a domain of a current host for the sub-request, classifying the sub-request as a third-party sub-request, or else classifying the sub-request as a first-party sub-request; and taking further action to protect one or more computer devices of a computer network system from a security threat caused by the third-party sub-request.