[zhfliz]

how would domain fronting help with phishing?

your standard user agent (e.g. browser) will not send different values in SNI and HTTP Host header.

this is a deliberate action by the user agent to obscure the actual traffic destination.

this can of course be used both for censorship circumvention but also misleading corporate traffic inspection when TLS is not broken, though it's debatable whether that should work in the first place.

[poisonbug]

The issue isn't with phishing. The issue is with threat actors using domain fronting as a network masquerading technique when having command and control traffic call back to Cobalt Strike servers. You can use domain fronting look like it's heading back to legitimate sources such as Microsoft, but unless the corporation is doing SSL termination on the endpoints, it's impossible to determine the exact destination.

Azure originally started on this path in 2021: https://www.microsoft.com/en-us/security/blog/2021/03/26/sec...

Working in the pentest/red team field, I've seen various providers ban consulting companies and red teams from using domain fronting -- however, this doesn't stop the threat actors.