Domain fronting
Hiding the real destination of a connection behind a permitted one, by presenting an allowed hostname where the network can read it while the encrypted request asks for something else on the same infrastructure.
Why it matters to you
It defeats blocking that works on names, which is most blocking. What it cannot hide is the shape of the conversation: beacon intervals, payload sizes and session durations survive the disguise, and are what a network defender should be watching once name-based control is known to be insufficient.
Where we meet it
The technique depends on shared infrastructure that the defender cannot block outright, so it follows whichever large provider currently permits it. That list changes, and the operators track it more attentively than most defenders do.
Connected terms
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Fast flux
Rotating the addresses behind a domain within minutes, so blocking an address never removes the service. A resilience technique, applied to infrastructure that expects to be reported.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
Read elsewhere
Where this term stops being vocabulary
Malveine is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the infrastructure
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Crypto mixer
A service that pools cryptocurrency from many senders and pays out from the pool, so that the link between an incoming and an outgoing transaction is broken. Charged as a percentage, sometimes with a delay bought separately.