The colocation would be trivial to fake. Just buy a second benign domain name, register it privately, and point a few A records at your servers. You're back t

The colocation would be trivial to fake. Just buy a second benign domain name, register it privately, and point a few A records at your servers. You're back to seeing SNI requests for cdn12345.catpics.com which happens to be the same as command-and-control.suspicious-site.kp