Domain Fronting Used to Hide C2 Server

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•15

This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.