Domain fronting is a network evasion technique where an attacker conceals the true destination of HTTPS traffic by using a trusted domain in the TLS SNI field while specifying a different malicious destination in the HTTP Host header, both served by the same CDN. The article details real-world abuse of Azure, Cloudflare, and Discord CDNs for C2 traffic and phishing, and describes domain hiding via ESNI as a related emerging threat. Effective defense requires full TLS inspection with SNI-Host header mismatch detection and ESNI stripping at the proxy layer.
CDN Abuse
1 post
Domain Fronting Attack: CDN Abuse & C2 Evasion Explained