Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS certificate to let the client encrypts the traffic for him/her, i.e. the MitM can not access the HTTPS encrypted traffic and does not have valid nor forged certificates.
For example, DNS spoofing is something related, where the attacks can trick the user into requesting/opening b.com while the client actually want a.com
My Question: Can the MitM changes the client's HTTP request headers at leasure to order b.com instead of a.com without having to use faked TLS certificate with the client?