Domain Fronting

Adversaries may exploit routing behavior in a multi-tenant content delivery network (CDN) or similar service so the TLS Server Name Indication (SNI) and HTTP request authority identify different domains. The authority is carried in the Host header for HTTP/1 and the :authority pseudo-header for HTTP/2. A provider may route using that value after TLS termination, obscuring the requested destination from observers who can see only the TLS connection; provider behavior and controls vary. MITRE also describes a domainless variant with no SNI. Encrypted Client Hello (ECH) protects the inner ClientHello and may expose a public outer name instead, so an absent or unavailable SNI alone does not establish malicious activity.