sni certificate mismatch and domain fronting detector — free browser tool | fatcousin

drop a pcap file · scan tls connections for sni hostname mismatch against certificate common name · detect domain fronting · c2 evasion via cdn · interception indicators · flag connections where traffic claims to be somewhere it is not · runs locally

pcap

drop pcap

or click

Select file

SNI extension · server certificate · wildcard match · CDN fronting heuristics

drop pcap · TLS SNI vs certificate analysis

ready