Reverse proxying is the practice of sending traffic through an intermediary server that relays requests between the operator and the target. In cyber security, attackers use it to hide the true source of their connections, to make command-and-control traffic look like normal web activity, and to reach internal services through a victim machine without connecting directly from their own infrastructure.
This matters because the intermediary can break simple attribution and complicate filtering. A compromised host may appear to be the origin of logins, API calls, or browser sessions even when a remote operator is controlling it. Defenders look for unusual proxy-like connections, unexpected tunneling from endpoints, repeated connections to the same relay, and session patterns that do not match normal user behavior. Reverse proxying is common in post-compromise access, credential abuse, and criminal tooling that aims to stay hidden while moving through networks.