Underminr detection

Hi guys,

Recently, i came across a technique called underminr which is a technique involved after domain fronting have been largely mitigated by several CDN provider. Reference - ADAMnetworks’ Research Uncovers Vulnerability in Internet Infrastructure, Affecting 88 Million Domains | Morningstar

TLDR of the technique is as follows; exploiting the gap between the layers of a connection where different names live:

1. DNS lookup / TLS SNI — uses an allowlisted front domain (e.g. a legitimate domain on a big CDN). This is typically what DNS filtering, proxy allowlists, and SNI-based inspection see and approve.
2. HTTP Host header (inside the encrypted tunnel) — once TLS is established, the request is actually routed to a different backend on the same shared infrastructure — the attacker's real C2 endpoint

And the detection seems to require checking the DNS query and ensuring the thereafter TLS host header in the same session is the same as the DNS query which i believe FPX by right should have the ability to do so since they have visibility to both L7 protocols.

Can i trouble the team to check on the feasibility of detecting this?

Thanks!