In fall 2024, the domain militaryfighterjet.com expired and was purchased within 48 hours. When accessed directly, it redirected to a gambling site. Through Google, though, it delivered a perfect clone of Lockheed Martin, even including employee and partner login screens (e.g., /index-2.html).

As a result, the search engine results page presented a trustworthy version, while direct access exposed the real, monetized activity. Investigations later linked this case to a Phishing-as-a-Service (PhaaS) network operating at scale on Google Cloud (Asia) and Cloudflare. This network reused high-reputation expired domains and legitimate static resources (brand-hosted JS, CSS, images) to strengthen its credibility.

The Attack Technique in 5 Clear Steps (MITRE ATT&CK^®)

1) Prepare the ground (T1583/T1584)

Before launching the attack, operators secure a solid infrastructure. Their goal is to work with “clean” assets — domains, servers, and services that already enjoy a good reputation and are unlikely to raise security alerts.

• T1583 – Acquiring new infrastructure
  Attackers buy new domains, rent servers, or use cloud services under their control. These assets are fresh, not yet blacklisted, and appear trustworthy to search engines and security tools.
  Example: Registering a new .com domain that resembles a trusted brand or spinning up servers on Google Cloud to host fake content.

• T1584 – Hijacking or reusing existing infrastructure
  Instead of starting from scratch, attackers take over high-reputation resources — for example:

  • Buying expired domains once owned by real companies.

  • Compromising vulnerable websites and hosting fake content there.

  • Reusing misconfigured cloud services or abandoned subdomains.
    These assets already carry legitimacy in DNS history and search engines, which helps attackers bypass basic reputation-based defenses.

This step lays the foundation for a stealthy phishing campaign by ensuring that the domains and servers used appear credible to both Google and security monitoring tools.

2) Build the illusion (T1608.006)

• Once the infrastructure is in place, attackers create a pixel-perfect clone of the legitimate website. They then deploy cloaking — a technique serving different content depending on the visitor’s profile:

  • Search engine bots see a clean, compliant, SEO-optimized version that ranks high in Google.

  • Real users are redirected to fake portals or gambling pages.

  This tactic is documented under T1608.006 – SEO poisoning: attackers manipulate search results to lure users into clicking compromised links.

3) Assume the identity (T1036)

Attackers copy the brand’s visual identity and hotlink real JS, CSS, and image resources hosted by the original website. Consequently, the fake looks almost indistinguishable from the real one.

4) Capture access (T1566 / sometimes T1189)

Users land on the fake site via search or shared links and enter credentials (Phishing – T1566). In addition, some clones trigger drive-by redirections or downloads without interaction (T1189).

5) Evade detection and persist

Finally, the attackers rotate IP addresses and hosting regions while updating cloaking rules to bypass security crawlers. Because of these evasive tactics, the campaign stayed online for years.

Actionable Checklist (Prevent, Detect, React)

Domain Governance

• Why: Expired but credible domains are common entry points.

• Quick Action: Enable auto-renewal and transfer-lock, and monitor expirations and look-alike domains.

• Check: Set N-60/N-30/N-7 expiration alerts.

DNS Hygiene

• Why: Orphaned CNAMEs are frequently reused for cloaking.

• Quick Action: Purge A/AAAA/CNAME/TXT records during decommissioning and maintain clean DNS documentation.

• Check: Automate DNS diff checks per release.

Protective DNS (PDNS)

• Why: Block newly registered domains (NRD) and phishing/C2 infrastructure.

• Quick Action: Use protective resolvers (dns0.eu, Quad9, DNS4EU) and forward logs to your SIEM.

• Check: Confirm blocking rules and validate SIEM data.

Double-View Cloaking Detection

• Why: Attackers serve one page to crawlers and another to users.

• Quick Action: Automate screenshot comparisons between crawler and browser views on brand queries.

• Check: Archive differences and trigger alerts when discrepancies are detected.

MITRE-Aligned Network & Web Detection

• Why: Recognize T1583, T1608.006, T1036, T1566 patterns in logs.

• Quick Action: Create SIEM/NDR rules for:

  • Multiple hosts resolving the same NRD

  • Unusual login|sso|partner paths

  • Abnormal redirection chains

• Check: Tune alerts and control false positives.

Application & CDN Hardening

• Why: Reduce the impact of asset reuse by clones.

• Quick Action: Enforce CSP, SRI, Referrer-Policy, and strict CORS, and serve key resources via signed or anti-hotlink URLs.

• Check: Review CSP reports, monitor CDN logs.

Strong Authentication Paths

• Why: Limit credential theft.

• Quick Action: Deploy FIDO2/Passkeys for employees and partners, disable IdP-initiated SSO on sensitive flows, and promote company-managed bookmarks.

• Check: Measure FIDO2 coverage and track remaining exceptions.

Takedown Preparedness

• Why: Reduce clone lifetimes.

• Quick Action: Set up abuse workflows, prepare evidence packs (screenshots, WHOIS, passive DNS, CT logs), and track takedown SLA.

• Check: Monitor average removal time and escalate when needed.

Targeted Remediation & Lessons Learned

• Why: Contain impact and improve future detection.

• Quick Action: Rotate secrets/tokens after exposure, rescope CORS origins, audit cloud dependencies, and refine SIEM rules based on findings.

• Check: Close remediation actions and confirm detection updates.