Snowflake
Snowflake uses domain fronting[1] for rendezvous. It is the digital equivalent of a spy having their secret meetings inside an unsuspecting friends house, and it always eventually it goes bad for that friend.The technique is heavily used by bad actors and is being blocked by default[2] by some cloud providers. AWS went as far as sending a nastygram to Signal[3] when they tried to roll it out on a wide basis for fear that countries like Iran and China would just block all of AWS.1. https://en.wikipedia.org/wiki/Domain_fronting
2. https://azure.microsoft.com/en-us/updates/generally-availabl...
3. https://signal.org/blog/looking-back-on-the-front/