# Finding Target-relevant Domain Fronts

My last blog post on finding high-value target domains that could be used for domain fronting was quite popular — found here.

Although there are a few popular domains that everyone uses, I’ve also published quite a large list on GitHub for public consumption and defenders to watch for. This can be found [here](https://github.com/vysec/DomainFrontingLists).

As time went on, I found that there was a need for target relevant domains, which may not be necessarily readily available in my previously discovered list. I came up with a quick way to find such domains with example traffic which could then be used to camouflage our traffic. Additionally, I’ve had a lot of people in the community contact me asking how I find the domain names. And yes, previously it was by scanning [Alexa Top 1 million](http://s3.amazonaws.com/alexa-static/top-1m.csv.zip) for CNAME records to Cloudfront.

![](/files/-LQ3UIeQDAk6n2O19qlD)

PortSwigger’s Burp Suite is a popular, widely known and used [tool](https://portswigger.net/burp). In this post I will make use of this tool to easily extract a list of CloudFront domains.

Configure a web browser as you normally would and begin browsing the internet. The first idea would be to browse your target organisation or affiliate’s websites— this generates a lot of traffic. Next I would go onto Google and begin searching for terms that may be related to the industry that particular target is in. In order to filter the large number of domains accessed quickly to possible domains, set a filter in the Target tab for “(CloudFront)”.

For example, if it was a company in the automotive manufacturing industry I could search for terms like “sports car”, I find links to websites such as Masersati.com which uses scripts.sophus3.com which is a CloudFront domain to serve scripts. See following.

![](/files/-LQ3UKAxM9JnFFEMZFn0)

Changing up the Host to another known CloudFront domain such as beacon.uber.com, we retrieve a different set of content and know that the domain front was successful. Following screenshot shows the content retrieval through the scripts.sophus3.com domain.

![](/files/-LQ3ULfeszEOUenGKYRv)

At this point, we have found a domain, related to cars, used by Maserati in it’s content delivery. The domain is on CloudFront, and we can use this to craft traffic for command and control channels based around this data.

Reviewing the original data, we can see that it fetches a script, c2 content can be sent through as a GET parameter or Referer and responses can easily be modified within the script body as a comment.

More examples such as domains that would blend in a lot better in a large organisation are displayed below:

![](/files/-LQ3UNHX2CKrPBXCmdeq)

![](/files/-LQ3UOI5IlabX46vfwX1)

![](/files/-LQ3UPaJio42NN7T0FeR)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.vincentyiu.com/red-team/domain-fronting/finding-target-relevant-domain-fronts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.