Technique
№ 040 · class: C2
Domain Fronting
Technique of hiding C2 traffic behind legitimate CDN domains.
Term
description · examples · notesTechnique of hiding C2 traffic behind legitimate CDN domains.
Description
HTTP Host header contains the real C2 domain while SNI shows a legitimate domain.
The CDN forwards requests to the real C2 server based on the Host header.
Network monitoring only sees traffic to the legitimate CDN domain.
Major CDN providers started blocking this technique since 2018.
Examples
- APT29 used domain fronting via Google and Amazon CDNs
- Signal used domain fronting to bypass censorship
Notes
- Increasingly less effective as CDN providers actively block it.
Threats
used by 3Threats that use it. Select one to open its page.
Defenses
countered by 3How it is countered. Select one to open its page.