A device implementing the subject system may include at least one processor configured to receive, by a first system process, a first network address that corresponds to a domain name that was resolved by a second system process, the resolving having been responsive to a resolution request therefor by an application process. The at least one processor may be further configured to receive, by the first system process, a second network address for which a network connection was opened by the application process. The at least one processor may be further configured to, responsive to determining that the application process opened a network connection for a network address for which the application process did not provide, to the second system process, a resolution request for the corresponding domain name, provide, by the first system process, an indication of the network address in conjunction with an indication of the application process.