hunting-for-domain-fronting-c2-traffic

Parse proxy or secure web gateway logs for connections containing both SNI and Host header fields, then flag mismatches where the SNI points to a high-reputation CDN domain but the Host header targets a different domain. Score alerts by domain reputation differential to reduce false positives.

Use pyOpenSSL to extract the certificate Subject and SAN fields from observed TLS connections, then correlate the issuer and destination IP against known CDN provider ranges such as CloudFront, Azure CDN, and Cloudflare to identify CDN-hosted fronting.

No. Without TLS inspection on the proxy, the HTTP Host header is encrypted inside the TLS session and the SNI-Host mismatch is invisible, so the hunt silently produces zero findings. TLS inspection must be enabled for Host header visibility.

Encrypted Client Hello (ECH) encrypts the SNI entirely, removing the SNI-versus-Host mismatch signal. In that case, pivot to JA3/JARM TLS fingerprinting combined with destination CDN IP and ASN reputation analysis.

Legitimate applications and CDNs sometimes split SNI and Host headers, and health-check or monitoring probes can trigger mismatch alerts. Tune by scoring on domain reputation differential rather than alerting on mismatch alone.