C2 Traffic Flow
/ Cloudflare-fronted
Beacon request
Beacon response
direct / noisy
TARGET
Victim
172.17.182.17
VPS1
Nginx Redirector
domainfronting.ml
VPS2
Cobalt Strike C2
157.245.165.2
CDN
Cloudflare Worker
microsoftupdate.workers.dev
Beacon traffic is fronted through Cloudflare's edge — the target only ever talks to
*.workers.dev
.