{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T01:46:36Z","timestamp":1780969596900,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":36,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,5,13]]},"DOI":"10.1145\/3589334.3645656","type":"proceedings-article","created":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T07:08:13Z","timestamp":1715152093000},"page":"1859-1867","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Discovering and Measuring CDNs Prone to Domain Fronting"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-8955-4049","authenticated-orcid":false,"given":"Karthika","family":"Subramani","sequence":"first","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, Georgia, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7339-0041","authenticated-orcid":false,"given":"Roberto","family":"Perdisci","sequence":"additional","affiliation":[{"name":"University of Georgia & Georgia Institute of Technology, Athens, Georgia, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-3005-8690","authenticated-orcid":false,"given":"Pierros-Christos","family":"Skafidas","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, Georgia, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1578-8307","authenticated-orcid":false,"given":"Manos","family":"Antonakakis","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, Georgia, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"2018. Amazon Joins Google in Shutting Down Domain Fronting. https:\/\/duo.com\/ decipher\/amazon-joins-google-in-shutting-down-domain-fronting"},{"key":"e_1_3_2_2_2_1","unstructured":"2018. How Telegram and Signal used domain fronting to beat censors. https:\/\/mybroadband.co.za\/news\/security\/259019-how-telegram-andsignal-used-domain-fronting-to-beat-censors.html"},{"key":"e_1_3_2_2_3_1","unstructured":"2019. Privacy in 2019: Tor Meek and the Rise and Fall of Domain Fronting. https:\/\/ www.sentinelone.com\/blog\/privacy-2019-tor-meek-rise-fall-domain-fronting\/"},{"key":"e_1_3_2_2_4_1","volume-title":"Domain Borrowing: Catch My C2 Traffic If You Can. BlackHat","year":"2021","unstructured":"2021. Domain Borrowing: Catch My C2 Traffic If You Can. BlackHat 2021. https:\/\/i.blackhat.com\/asia-21\/Thursday-Handouts\/as-21-Ding-Domain-Borrowing-Catch-My-C2-Traffic-If-You-Can.pdf"},{"key":"e_1_3_2_2_5_1","unstructured":"2021. Finding Beacons in the Dark. Blackberry. https:\/\/i.crn.com\/sites\/default\/ files\/ckfinderimages\/userfiles\/images\/crn\/custom\/2022\/Blackberry\/bb-ebookfinding-beacons-in-the-dark.pdf"},{"key":"e_1_3_2_2_6_1","unstructured":"2022. Generally available: Block domain fronting behavior on newly created customer resources. https:\/\/azure.microsoft.com\/en-us\/updates\/generally-availableblock-domain-fronting-behavior-on-newly-created-customer-resources\/"},{"key":"e_1_3_2_2_7_1","unstructured":"2023. 10 Tips for Getting the Most Out of Next-Gen WAF. Fastly. https:\/\/www.fastly.com\/blog\/10-pro-tips-for-getting-the-most-out-ofyour-next-gen-waf#: :text=6.- Block -Requests%20with%20Invalid"},{"key":"e_1_3_2_2_8_1","unstructured":"2023. CDNFinder. CDN Planet. https:\/\/www.cdnplanet.com\/tools\/cdnfinder\/"},{"key":"e_1_3_2_2_9_1","unstructured":"2023. Domain Fronting Detection. https:\/\/docs.paloaltonetworks.com\/panos\/ 10--2\/pan-os-new-features\/content-inspection-features\/domain-frontingdetection"},{"key":"e_1_3_2_2_10_1","unstructured":"2023. HTTP\/2 Rapid Reset: deconstructing the record-breaking attack. Cloud-Flare. https:\/\/blog.cloudflare.com\/technical-breakdown-http2-rapid-reset-ddosattack\/"},{"key":"e_1_3_2_2_11_1","unstructured":"2023. List of CDNs. Github. https:\/\/gist.github.com\/fffaraz\/a12e74093fd19f773dd7"},{"key":"e_1_3_2_2_12_1","unstructured":"2023. New Exfiltrator-22 post-exploitation kit linked to LockBit ransomware. Bleeping Computer. https:\/\/www.bleepingcomputer.com\/news\/security\/newexfiltrator-22-post-exploitation-kit-linked-to-lockbit-ransomware\/"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","unstructured":"2024. Discovering Domain Fronting in CDNs. https:\/\/doi.org\/10.5281\/zenodo. 10681736","DOI":"10.5281\/zenodo"},{"key":"e_1_3_2_2_14_1","unstructured":"Accessed: 2023. Overview of Puppeteer. https:\/\/developer.chrome.com\/docs\/ puppeteer\/"},{"key":"e_1_3_2_2_15_1","unstructured":"Accessed: 2023. VirusTotal. Virus Total. https:\/\/www.virustotal.com\/"},{"key":"e_1_3_2_2_16_1","unstructured":"Accessed: 2023. \"Signal\" Uses Domain Fronting to Bypass Censorship. https: \/\/www.securityweek.com\/signal-uses-domain-fronting-bypass-censorship\/"},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW59978.2023"},{"key":"e_1_3_2_2_18_1","unstructured":"Zimo Chai Amirhossein Ghafari and Amir Houmansadr. 2019. On the Importance of Encrypted-SNI (ESNI) to Censorship Circumvention.. In FOCI@ USENIX Security Symposium."},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2833110"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2015-0009"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"crossref","unstructured":"Sergey Frolov and Eric Wustrow. 2019. The use of TLS in Censorship Circumvention.. In NDSS.","DOI":"10.14722\/ndss.2019.23511"},{"key":"e_1_3_2_2_22_1","unstructured":"Sean Gallagher. 2018. In effort to shut down Telegram Russia blocks Amazon Google network addresses. https:\/\/arstechnica.com\/information-technology\/2018\/04\/ineffort-to-shut-down-telegram-russia-blocks-amazon-google-networkaddresses\/"},{"key":"e_1_3_2_2_23_1","unstructured":"GitHub. Accessed: 2023. Issue 197 - net4people\/bbs. https:\/\/github.com\/net4people\/bbs\/issues\/197."},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2018.00011"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813696"},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978--3--319--45719--2_9"},{"key":"e_1_3_2_2_27_1","unstructured":"Tyler McleTllan Robert Dean Justin Moore Nick Harbour Mike Hunhoff Jared Wilson and Jordan Nuce. 2021. Smoking Out a DARKSIDE Affiliate's Supply Chain Software Compromise. https:\/\/www.mandiant.com\/resources\/blog\/ darkside-affiliate-supply-chain-software-compromise"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1177\/1461444814548994"},{"key":"e_1_3_2_2_29_1","volume-title":"Samaneh Tajalizadehkhoob, Maciej Korczy'ski, and Wouter Joosen.","author":"Pochat Victor Le","year":"2018","unstructured":"Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczy'ski, and Wouter Joosen. 2018. Tranco: A research-oriented top sites ranking hardened against manipulation. arXiv preprint arXiv:1806.01156 (2018)."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3499428"},{"key":"e_1_3_2_2_31_1","unstructured":"The Intercept. Accessed: 2023. GOOGLE IS DEEPENING ITS INVOLVEMENT WITH EGYPT REPRESSIVE GOVERNMENT. https:\/\/theintercept.com\/2019\/08\/18\/google-egypt-office-sisi\/."},{"key":"e_1_3_2_2_32_1","unstructured":"Tor Project. Accessed: 2023. Technical Overview - Snowflake. https:\/\/gitlab.torproject.org\/tpo\/anti-censorship\/pluggabletransports\/ snowflake\/-\/wikis\/Technical%20Overview."},{"key":"e_1_3_2_2_33_1","volume-title":"Threats and Security Issues in Cloud Storage and Content Delivery Networks: Analysis. In 2021 28th Conference of Open Innovations Association (FRUCT). IEEE, 194--199","author":"Kouam Waguia Jean Daniel","year":"2021","unstructured":"Jean Daniel Kouam Waguia and Alexander Menshchikov. 2021. Threats and Security Issues in Cloud Storage and Content Delivery Networks: Analysis. In 2021 28th Conference of Open Innovations Association (FRUCT). IEEE, 194--199."},{"key":"e_1_3_2_2_34_1","volume-title":"USENIX Security Symposium. 3327--3343","author":"Wei Mingkui","year":"2021","unstructured":"Mingkui Wei. 2021. Domain Shadowing: Leveraging Content Delivery Networks for Robust Blocking-Resistant Communications.. In USENIX Security Symposium. 3327--3343."},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603165.3607455"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978365"}],"event":{"name":"WWW '24: The ACM Web Conference 2024","location":"Singapore Singapore","acronym":"WWW '24","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2024"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645656","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3589334.3645656","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:25:16Z","timestamp":1755822316000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645656"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":36,"alternative-id":["10.1145\/3589334.3645656","10.1145\/3589334"],"URL":"https:\/\/doi.org\/10.1145\/3589334.3645656","relation":{},"subject":[],"published":{"date-parts":[[2024,5,13]]},"assertion":[{"value":"2024-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}