Threat actors exploit a domain-fronting technique called Underminr to hijack content delivery networks and redirect web traffic to malicious destinations. The attack manipulates how browsers resolve and fetch web content, allowing adversaries to disguise their traffic as coming from legitimate, high-trust websites.
Domain fronting works by sending encrypted requests to a trusted domain while hiding the actual destination inside the encrypted payload. Content delivery networks and caching systems process the visible domain name, never inspecting the hidden target. Attackers abuse this mechanism to redirect users to phishing pages, malware distribution sites, or credential harvesting infrastructure while the traffic appears legitimate to security tools and network monitors.
Underminr targets websites that rely on shared content delivery infrastructure, particularly those using popular CDN providers. When successful, the attack enables brand hijacking, where attackers impersonate the legitimate site to users while maintaining the appearance of a trusted connection. Users see the correct URL in their browser bar but receive content from attacker-controlled servers.
The threat extends beyond simple misdirection. Attackers can inject malicious scripts, capture login credentials, distribute malware payloads, and conduct watering hole attacks against employees visiting corporate websites. The technique bypasses many security controls that rely on visible domain inspection, since the actual malicious domain remains hidden in encrypted traffic.
Organizations running web properties face exposure when their CDN configurations allow domain fronting. Website operators should review CDN security policies to restrict which domains can front requests. Security teams should implement additional verification layers beyond DNS resolution and implement certificate pinning where possible.
Users can reduce risk by verifying HTTPS certificate details before entering credentials on login pages, though most users lack the technical knowledge to perform this check reliably. Network administrators should monitor for unusual traffic patterns and implement additional authentication on sensitive applications rather than relying solely on domain validation.
The Underminr attack demonstrates that traditional security assumptions about