A multi-hop proxy is a chain of intermediate servers that forwards traffic from one relay to the next before it reaches the final destination. Each hop hides part of the connection path, so investigators and network filters may only see the last relay instead of the true source. In cyber security, this technique is used by both privacy tools and malicious operators.
Attackers use multi-hop proxies to obscure command-and-control channels, distribute traffic across leased or disposable servers, and make takedowns harder. It can also help malicious HTTPS traffic blend into ordinary web activity, especially when the relays are designed to resemble legitimate redirectors. Defenders look for signs such as repeated redirects, unusual certificate or DNS patterns, rapid server rotation, and outbound connections that appear after suspicious process activity. Correlating proxy logs, endpoint telemetry, and network flow data helps reveal the full chain and identify the infrastructure behind it.