{"id":24692,"date":"2025-09-08T18:58:43","date_gmt":"2025-09-08T18:58:43","guid":{"rendered":"https:\/\/www.stroople.com\/?p=24692"},"modified":"2025-09-08T19:20:32","modified_gmt":"2025-09-08T19:20:32","slug":"phishing-as-a-service-google-cloud-cloudflare","status":"publish","type":"post","link":"https:\/\/www.stroople.com\/fr\/phishing-as-a-service-google-cloud-cloudflare\/","title":{"rendered":"L'hame\u00e7onnage en tant que service : Trois ans sous le radar de Google Cloud et de Cloudflare"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"24692\" class=\"elementor elementor-24692\" wpc-filter-elementor-widget=\"1\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-75a7e495 elementor-section-full_width elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"75a7e495\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-379ca332 syd-sticky-section-no\" data-id=\"379ca332\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c67689e syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"c67689e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3b2c3dd elementor-section-full_width elementor-section-height-min-height elementor-section-items-stretch elementor-reverse-tablet elementor-section-height-default syd-sticky-section-no\" data-id=\"3b2c3dd\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-4002b263 syd-sticky-section-no\" data-id=\"4002b263\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4d0edb4 syd-sticky-section-no elementor-widget elementor-widget-ha-social-icons happy-addon ha-social-icons\" data-id=\"4d0edb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ha-social-icons.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"ha-social-icons-wrapper\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.linkedin.com\/build-relation\/newsletter-follow?entityUrn=7120442855684231170\" class=\"ha-social-icon elementor-repeater-item-f2b3d32  elementor-social-icon-linkedin ha-social-icon--network\">\n\t\t\t\t\t<i class=\"fab fa-linkedin\"><\/i>\t\t\t\t<\/a>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-7af1deef syd-sticky-section-no\" data-id=\"7af1deef\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-1e11c0f0 syd-sticky-section-no elementor-widget elementor-widget-post-info\" data-id=\"1e11c0f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-inline-items elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-5b276ce elementor-inline-item\" itemprop=\"datePublished\">\n\t\t\t\t\t\t<a href=\"https:\/\/www.stroople.com\/fr\/2025\/09\/08\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-date\">\n\t\t\t\t\t\t\t\t\t\t<time>8 septembre 2025<\/time>\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-42127c4d syd-sticky-section-no elementor-widget elementor-widget-theme-post-title elementor-page-title elementor-widget-heading\" data-id=\"42127c4d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-post-title.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">L'hame\u00e7onnage en tant que service : Trois ans sous le radar de Google Cloud et de Cloudflare<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-f87f821 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"f87f821\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0e53a75 syd-sticky-section-no\" data-id=\"0e53a75\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3deb2ab0 syd-sticky-section-no elementor-widget elementor-widget-theme-post-featured-image elementor-widget-image\" data-id=\"3deb2ab0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-post-featured-image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\" class=\"attachment-full size-full wp-image-24612\" alt=\"\" srcset=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg 640w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash-300x200.jpg 300w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash-18x12.jpg 18w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash-230x153.jpg 230w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash-350x234.jpg 350w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash-480x320.jpg 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae97c8b syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"ae97c8b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-064f662 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"064f662\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-496d655 syd-sticky-section-no\" data-id=\"496d655\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-15e5835 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"15e5835\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-02b8cb4 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"02b8cb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4 data-start=\"1295\" data-end=\"1387\"><strong>Le cas militaryfighterjet.com : faux Lockheed Martin, vrai masterclass de cloaking.<\/strong><\/h4><p data-start=\"1389\" data-end=\"1634\">Votre analyste clique un r\u00e9sultat Google vers un portail \u00ab partenaire \u00bb. Tout est nickel : logo, mentions l\u00e9gales, feuilles de style servies depuis le cloud de la marque. Il saisit un identifiant de test, le flux SSO r\u00e9pond comme attendu.<\/p><p data-start=\"1636\" data-end=\"1880\">Puis il retape la m\u00eame URL en acc\u00e8s direct : bascule s\u00e8che vers un site de loterie, banni\u00e8res criardes, redirections. Deux r\u00e9alit\u00e9s, un seul domaine. C\u2019est le cloaking : un d\u00e9guisement de contenu qui montre un visage propre aux robots des moteurs de recherche et un tout autre aux humains.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-94434b5 syd-sticky-section-no\" data-id=\"94434b5\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-04dc3a0 syd-sticky-section-no elementor-widget elementor-widget-image\" data-id=\"04dc3a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/elementor\/thumbs\/jj-ying-8bghKxNU1j0-unsplash-r7sd54d0e19mfxatlizo2qj13o8kinpqtfb4vtcf4w.jpg\" title=\"jj-ying-8bghKxNU1j0-unsplash\" alt=\"jj-ying-8bghKxNU1j0-unsplash\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8e67fb7 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"8e67fb7\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-d6117cb syd-sticky-section-no\" data-id=\"d6117cb\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-10ca4bd syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"10ca4bd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"1882\" data-end=\"2188\">C\u2019est exactement ce qui est arriv\u00e9 \u00e0 militaryfighterjet.com. \u00c0 l\u2019automne 2024, le domaine militaryfighterjet.com expire. Il est rachet\u00e9 en 48 heures. En acc\u00e8s direct, il sert un site de loterie. En passant par Google, il pr\u00e9sente un clone quasi parfait de Lockheed Martin, jusqu\u2019aux \u00e9crans \u00ab employees\/partners \u00bb (ex. <code data-start=\"2169\" data-end=\"2184\">\/index-2.html<\/code>).<\/p><p data-start=\"2190\" data-end=\"2642\">Autrement dit, la page de r\u00e9sultats d\u2019un moteur de recherche vous am\u00e8ne sur une imitation cr\u00e9dible, tandis que l\u2019acc\u00e8s direct r\u00e9v\u00e8le l\u2019activit\u00e9 r\u00e9elle et mon\u00e9tis\u00e9e. L\u2019enqu\u00eate a li\u00e9 ce cas \u00e0 une infrastructure PhaaS op\u00e9rant \u00e0 grande \u00e9chelle sur Google Cloud (Asie) et Cloudflare, capable de recycler des domaines expir\u00e9s \u00e0 forte r\u00e9putation et de r\u00e9utiliser des ressources statiques l\u00e9gitimes (images\/JS\/CSS de la marque) pour renforcer l\u2019illusion.<\/p><h4 data-start=\"2649\" data-end=\"2720\"><strong data-start=\"2652\" data-end=\"2718\">La technique d'attaque en 5 \u00e9tapes claires (MITRE ATT&amp;CK<sup>\u00ae<\/sup>)<\/strong><\/h4><p data-start=\"2722\" data-end=\"2767\"><strong data-start=\"2726\" data-end=\"2765\">1) Pr\u00e9parer le terrain (T1583\/T1584)<\/strong><\/p><p data-start=\"271\" data-end=\"509\">Avant de lancer l'attaque, les pirates <strong data-start=\"310\" data-end=\"343\">mettent en place une infrastructure solide.<\/strong>Leur objectif est de travailler avec <strong data-start=\"372\" data-end=\"390\">des actifs \u201cl\u00e9gitimes\u201d<\/strong> \u2014 domaines, serveurs et services \u2014 qui b\u00e9n\u00e9ficient d\u00e9j\u00e0 <strong data-start=\"445\" data-end=\"464\">d\u2019une bonne r\u00e9putation<\/strong> et ne d\u00e9clenchent pas les m\u00e9canismes classiques de d\u00e9tection.<\/p><ul data-start=\"511\" data-end=\"1410\"><li data-start=\"511\" data-end=\"892\"><p data-start=\"513\" data-end=\"892\"><strong data-start=\"513\" data-end=\"553\">T1583 - Acquisition de nouvelles infrastructures<\/strong><br data-start=\"553\" data-end=\"556\" \/>Les attaquants <strong data-start=\"568\" data-end=\"624\">ach\u00e8tent de nouveaux domaines, louent des serveurs ou utilisent des services cloud<\/strong> sous leur contr\u00f4le. Ces ressources sont neuves, non encore signal\u00e9es comme malveillantes, et paraissent l\u00e9gitimes pour les moteurs de recherche comme pour les solutions de s\u00e9curit\u00e9.<br data-start=\"751\" data-end=\"754\" \/><em data-start=\"756\" data-end=\"766\">Exemple :<\/em> Exemple : Enregistrer un nouveau domaine <code data-start=\"785\" data-end=\"791\">.com<\/code> ressemblant \u00e0 celui d\u2019une marque connue, ou cr\u00e9er des serveurs sur Google Cloud pour h\u00e9berger le faux contenu.<\/p><\/li><li data-start=\"894\" data-end=\"1410\"><p data-start=\"896\" data-end=\"1057\"><strong data-start=\"896\" data-end=\"952\">T1584 - Compromission ou r\u00e9utilisation d'infrastructures existantes<\/strong><br data-start=\"952\" data-end=\"955\" \/>Au lieu de partir de z\u00e9ro, les attaquants <strong data-start=\"1001\" data-end=\"1040\">r\u00e9cup\u00e8rent des ressources ayant d\u00e9j\u00e0 une bonne r\u00e9putation<\/strong> , par exemple :<\/p><ul data-start=\"1060\" data-end=\"1410\"><li data-start=\"1060\" data-end=\"1120\"><p data-start=\"1062\" data-end=\"1120\"><strong data-start=\"1062\" data-end=\"1088\">Racheter des domaines expir\u00e9s<\/strong> autrefois utilis\u00e9s par de vraies entreprises.<\/p><\/li><li data-start=\"1123\" data-end=\"1195\"><p data-start=\"1125\" data-end=\"1195\"><strong data-start=\"1125\" data-end=\"1161\">Compromettre des sites vuln\u00e9rables<\/strong> pour y h\u00e9berger leurs clones.<\/p><\/li><li data-start=\"1198\" data-end=\"1410\"><p data-start=\"1200\" data-end=\"1410\"><strong data-start=\"1200\" data-end=\"1240\">Exploiter des services cloud mal configur\u00e9s<\/strong> ou des sous-domaines abandonn\u00e9s.<br data-start=\"1265\" data-end=\"1268\" \/>Comme ces actifs ont d\u00e9j\u00e0 <strong data-start=\"1297\" data-end=\"1345\">une l\u00e9gitimit\u00e9 dans l\u2019historique DNS et dans les index des moteurs de recherche<\/strong>, les attaques passent plus facilement sous les radars.<\/p><\/li><\/ul><\/li><\/ul><p data-start=\"1412\" data-end=\"1588\">Cette \u00e9tape est essentielle pour b\u00e2tir <strong data-start=\"1448\" data-end=\"1478\">une campagne de phishing furtive<\/strong> , car elle repose sur des domaines et des serveurs cr\u00e9dibles aux yeux de Google et des solutions de surveillance.<\/p><p data-start=\"3056\" data-end=\"3099\"><strong data-start=\"3060\" data-end=\"3097\">2) Installer l'illusion (T1608.006)<\/strong><\/p><ul data-start=\"3220\" data-end=\"3392\"><li data-start=\"3332\" data-end=\"3392\"><p data-start=\"1640\" data-end=\"1858\">Une fois l'infrastructure en place, les attaquants cr\u00e9ent un <strong data-start=\"1696\" data-end=\"1719\">clone parfait au pixel pr\u00e8s<\/strong> du site web l\u00e9gitime. Ils utilisent ensuite <strong data-start=\"1764\" data-end=\"1776\">le cloaking<\/strong> , une technique consistant <strong data-start=\"1799\" data-end=\"1820\">\u00e0 pr\u00e9senter un contenu diff\u00e9rent<\/strong> selon le type de visiteur :<\/p><ul data-start=\"1860\" data-end=\"2028\"><li data-start=\"1860\" data-end=\"1959\"><p data-start=\"1862\" data-end=\"1959\"><strong data-start=\"1862\" data-end=\"1884\">Les robots des moteurs de recherche<\/strong> voient une version propre et optimis\u00e9e SEO, ce qui permet au faux site d\u2019appara\u00eetre en bonne position dans Google.<\/p><\/li><li data-start=\"1960\" data-end=\"2028\"><p data-start=\"1962\" data-end=\"2028\"><strong data-start=\"1962\" data-end=\"1976\">Les utilisateurs r\u00e9els<\/strong> , eux, sont dirig\u00e9s vers un faux portail ou vers des pages de jeux d\u2019argent.<\/p><\/li><\/ul><p data-start=\"2030\" data-end=\"2177\">Cette tactique est r\u00e9f\u00e9renc\u00e9e <strong data-start=\"2062\" data-end=\"2091\">T1608.006 - Empoisonnement \u00e0 la SEO<\/strong>: manipuler les r\u00e9sultats des moteurs de recherche pour pi\u00e9ger les internautes.<\/p><\/li><\/ul><p data-start=\"3394\" data-end=\"3434\"><strong data-start=\"3398\" data-end=\"3432\">3) Usurper l'identit\u00e9 (T1036)<\/strong><\/p><p data-start=\"3435\" data-end=\"3638\">Pour rendre la contrefa\u00e7on quasi ind\u00e9tectable, les attaquants copient l'identit\u00e9 visuelle de la marque et \u00e9tablissent des liens hypertextes avec de vraies ressources JS, CSS et images h\u00e9berg\u00e9es sur le site web d'origine. Par cons\u00e9quent, le faux site semble presque impossible \u00e0 distinguer du vrai.<\/p><p data-start=\"3640\" data-end=\"3693\"><strong data-start=\"3644\" data-end=\"3691\">4) Capturer l'acc\u00e8s (T1566 \/ parfois T1189)<\/strong><\/p><p data-start=\"3694\" data-end=\"3901\">Les utilisateurs arrivent sur le faux site par le biais d'une recherche ou de liens partag\u00e9s et saisissent leurs informations d'identification (Phishing - T1566). En outre, certains clones d\u00e9clenchent des redirections ou des t\u00e9l\u00e9chargements sans interaction (T1189).<\/p><p data-start=\"3903\" data-end=\"3943\"><strong data-start=\"3907\" data-end=\"3941\">5) Rester ind\u00e9tectable (\u00e9vasion &amp; rotation)<\/strong><\/p><p data-start=\"3944\" data-end=\"4147\">Enfin, les attaquants alternent les adresses IP et les r\u00e9gions d'h\u00e9bergement tout en mettant \u00e0 jour les r\u00e8gles de dissimulation afin de contourner les robots d'exploration de s\u00e9curit\u00e9. Gr\u00e2ce \u00e0 ces tactiques d'\u00e9vasion, la campagne est rest\u00e9e en ligne pendant des ann\u00e9es.<\/p><h4 data-start=\"4154\" data-end=\"4208\"><strong data-start=\"4157\" data-end=\"4206\">Liste de contr\u00f4le (Pr\u00e9venir, D\u00e9tecter, R\u00e9agir)<\/strong><\/h4><h5 data-start=\"4210\" data-end=\"4239\"><strong data-start=\"4214\" data-end=\"4237\">Gouvernance des domaines<\/strong><\/h5><ul data-start=\"4240\" data-end=\"4467\"><li data-start=\"4240\" data-end=\"4306\"><p data-start=\"4242\" data-end=\"4306\"><strong data-start=\"4242\" data-end=\"4250\">Pourquoi ?<\/strong> Les domaines expir\u00e9s mais cr\u00e9dibles sont des points d'entr\u00e9e courants.<\/p><\/li><li data-start=\"4307\" data-end=\"4415\"><p data-start=\"4309\" data-end=\"4415\"><strong data-start=\"4309\" data-end=\"4326\">Action rapide :<\/strong> Activez le renouvellement automatique et le verrouillage du transfert, et surveillez les expirations et les domaines similaires.<\/p><\/li><li data-start=\"4416\" data-end=\"4467\"><p data-start=\"4418\" data-end=\"4467\"><strong data-start=\"4418\" data-end=\"4428\">V\u00e9rifiez :<\/strong> D\u00e9finissez les alertes d'expiration N-60\/N-30\/N-7.<\/p><\/li><\/ul><h5 data-start=\"4469\" data-end=\"4492\"><strong data-start=\"4473\" data-end=\"4490\">DNS Hygi\u00e8ne<\/strong><\/h5><ul data-start=\"4493\" data-end=\"4728\"><li data-start=\"4493\" data-end=\"4557\"><p data-start=\"4495\" data-end=\"4557\"><strong data-start=\"4495\" data-end=\"4503\">Pourquoi ?<\/strong> Les CNAME orphelins sont souvent r\u00e9utilis\u00e9s \u00e0 des fins de dissimulation.<\/p><\/li><li data-start=\"4558\" data-end=\"4675\"><p data-start=\"4560\" data-end=\"4675\"><strong data-start=\"4560\" data-end=\"4577\">Action rapide :<\/strong> Purger <strong data-start=\"4584\" data-end=\"4604\">A\/AAAA\/NOM\/TEXTE<\/strong> pendant le d\u00e9classement et conserver une documentation DNS propre.<\/p><\/li><li data-start=\"4676\" data-end=\"4728\"><p data-start=\"4678\" data-end=\"4728\"><strong data-start=\"4678\" data-end=\"4688\">V\u00e9rifiez :<\/strong> Automatiser les v\u00e9rifications des diff\u00e9rences de DNS par version.<\/p><\/li><\/ul><h5 data-start=\"4730\" data-end=\"4763\"><strong data-start=\"4734\" data-end=\"4761\">DNS de protection (PDNS)<\/strong><\/h5><ul data-start=\"4764\" data-end=\"5030\"><li data-start=\"4764\" data-end=\"4853\"><p data-start=\"4766\" data-end=\"4853\"><strong data-start=\"4766\" data-end=\"4774\">Pourquoi ?<\/strong> Bloquer les domaines nouvellement enregistr\u00e9s (NRD) et les infrastructures de phishing\/C2.<\/p><\/li><li data-start=\"4854\" data-end=\"4968\"><p data-start=\"4856\" data-end=\"4968\"><strong data-start=\"4856\" data-end=\"4873\">Action rapide :<\/strong> Utilisez des r\u00e9solveurs de protection (dns0.eu, Quad9, DNS4EU) et transmettez les journaux \u00e0 votre SIEM.<\/p><\/li><li data-start=\"4969\" data-end=\"5030\"><p data-start=\"4971\" data-end=\"5030\"><strong data-start=\"4971\" data-end=\"4981\">V\u00e9rifiez :<\/strong> Confirmez les r\u00e8gles de blocage et validez les donn\u00e9es SIEM.<\/p><\/li><\/ul><h5 data-start=\"5032\" data-end=\"5074\"><strong data-start=\"5036\" data-end=\"5072\">D\u00e9tection de l'occultation \u00e0 double vue<\/strong><\/h5><ul data-start=\"5075\" data-end=\"5339\"><li data-start=\"5075\" data-end=\"5146\"><p data-start=\"5077\" data-end=\"5146\"><strong data-start=\"5077\" data-end=\"5085\">Pourquoi ?<\/strong> Les attaquants proposent une page aux robots d'indexation et une autre aux utilisateurs.<\/p><\/li><li data-start=\"5147\" data-end=\"5252\"><p data-start=\"5149\" data-end=\"5252\"><strong data-start=\"5149\" data-end=\"5166\">Action rapide :<\/strong> Automatisez les comparaisons de captures d'\u00e9cran entre les vues du crawler et du navigateur sur les requ\u00eates de marque.<\/p><\/li><li data-start=\"5253\" data-end=\"5339\"><p data-start=\"5255\" data-end=\"5339\"><strong data-start=\"5255\" data-end=\"5265\">V\u00e9rifiez :<\/strong> Archivez les diff\u00e9rences et d\u00e9clenchez des alertes lorsque des \u00e9carts sont d\u00e9tect\u00e9s.<\/p><\/li><\/ul><h5 data-start=\"5341\" data-end=\"5390\"><strong data-start=\"5345\" data-end=\"5388\">D\u00e9tection de r\u00e9seaux et de sites Web conforme aux normes MITRE<\/strong><\/h5><ul><li data-start=\"5391\" data-end=\"5466\"><p data-start=\"5393\" data-end=\"5466\"><strong data-start=\"5393\" data-end=\"5401\">Pourquoi ?<\/strong> reconna\u00eetre les \u00e9tapes T1583\/T1608.006\/T1036\/T1566 en logs.<\/p><\/li><li data-start=\"5467\" data-end=\"5631\"><p data-start=\"5469\" data-end=\"5515\"><strong data-start=\"5469\" data-end=\"5486\">Action rapide :<\/strong> Cr\u00e9ez des r\u00e8gles SIEM\/NDR pour :<\/p><ul data-start=\"5518\" data-end=\"5631\"><li data-start=\"5518\" data-end=\"5559\"><p data-start=\"5520\" data-end=\"5559\">Plusieurs h\u00f4tes r\u00e9solvant la m\u00eame BDNI<\/p><\/li><li data-start=\"5562\" data-end=\"5597\"><p data-start=\"5564\" data-end=\"5597\">Chemins de connexion inhabituels|sso|partenaires<\/p><\/li><li data-start=\"5600\" data-end=\"5631\"><p data-start=\"5602\" data-end=\"5631\">Cha\u00eenes de redirection anormales<\/p><\/li><\/ul><\/li><li data-start=\"5632\" data-end=\"5687\"><p data-start=\"5634\" data-end=\"5687\"><strong data-start=\"5634\" data-end=\"5644\">V\u00e9rifiez :<\/strong> Ajustez les alertes et contr\u00f4lez les faux positifs.<\/p><\/li><\/ul><h5><strong data-start=\"5693\" data-end=\"5726\">Application &amp; CDN Hardening<\/strong><\/h5><ul><li data-start=\"5729\" data-end=\"5785\"><p data-start=\"5731\" data-end=\"5785\"><strong data-start=\"5731\" data-end=\"5739\">Pourquoi ?<\/strong> R\u00e9duire l'impact de la r\u00e9utilisation des actifs par des clones.<\/p><\/li><li data-start=\"5786\" data-end=\"5924\"><p data-start=\"5788\" data-end=\"5924\"><strong data-start=\"5788\" data-end=\"5805\">Action rapide :<\/strong> Appliquez les r\u00e8gles CSP, SRI, Referrer-Policy et CORS strictes, et diffusez les ressources cl\u00e9s par le biais d'URL sign\u00e9es ou anti-liens chauds.<\/p><\/li><li data-start=\"5925\" data-end=\"5977\"><p data-start=\"5927\" data-end=\"5977\"><strong data-start=\"5927\" data-end=\"5937\">V\u00e9rifiez :<\/strong> Examinez les rapports du CSP, surveillez les journaux du CDN.<\/p><\/li><\/ul><h5 data-start=\"5979\" data-end=\"6018\"><strong data-start=\"5983\" data-end=\"6016\">Voies d'authentification forte<\/strong><\/h5><ul data-start=\"6019\" data-end=\"6286\"><li data-start=\"6019\" data-end=\"6055\"><p data-start=\"6021\" data-end=\"6055\"><strong data-start=\"6021\" data-end=\"6029\">Pourquoi ?<\/strong> Limitez le vol de donn\u00e9es d'identification.<\/p><\/li><li data-start=\"6056\" data-end=\"6216\"><p data-start=\"6058\" data-end=\"6216\"><strong data-start=\"6058\" data-end=\"6075\">Action rapide :<\/strong> D\u00e9ployez FIDO2\/Passkeys pour les employ\u00e9s et les partenaires, d\u00e9sactivez le SSO initi\u00e9 par l'IdP sur les flux sensibles et encouragez les signets g\u00e9r\u00e9s par l'entreprise.<\/p><\/li><li data-start=\"6217\" data-end=\"6286\"><p data-start=\"6219\" data-end=\"6286\"><strong data-start=\"6219\" data-end=\"6229\">V\u00e9rifiez :<\/strong> Mesurez la couverture FIDO2 et suivez les exceptions restantes.<\/p><\/li><\/ul><h5 data-start=\"6288\" data-end=\"6321\"><strong data-start=\"6292\" data-end=\"6319\">Pr\u00e9paration au d\u00e9sarmement<\/strong><\/h5><ul data-start=\"6322\" data-end=\"6569\"><li data-start=\"6322\" data-end=\"6358\"><p data-start=\"6324\" data-end=\"6358\"><strong data-start=\"6324\" data-end=\"6332\">Pourquoi ?<\/strong> R\u00e9duire la dur\u00e9e de vie des clones.<\/p><\/li><li data-start=\"6359\" data-end=\"6499\"><p data-start=\"6361\" data-end=\"6499\"><strong data-start=\"6361\" data-end=\"6378\">Action rapide :<\/strong> Mettez en place des flux de travail en cas d'abus, pr\u00e9parez des dossiers de preuves (captures d'\u00e9cran, WHOIS, DNS passif, journaux CT) et suivez l'accord de niveau de service (SLA) en cas d'abandon de la proc\u00e9dure.<\/p><\/li><li data-start=\"6500\" data-end=\"6569\"><p data-start=\"6502\" data-end=\"6569\"><strong data-start=\"6502\" data-end=\"6512\">V\u00e9rifiez :<\/strong> Surveillez la dur\u00e9e moyenne de l'enl\u00e8vement et faites remonter l'information si n\u00e9cessaire.<\/p><\/li><\/ul><h5 data-start=\"6571\" data-end=\"6621\"><strong data-start=\"6575\" data-end=\"6619\">Rem\u00e9diation cibl\u00e9e et le\u00e7ons tir\u00e9es de l'exp\u00e9rience<\/strong><\/h5><ul data-start=\"6622\" data-end=\"6900\"><li data-start=\"6622\" data-end=\"6679\"><p data-start=\"6624\" data-end=\"6679\"><strong data-start=\"6624\" data-end=\"6632\">Pourquoi ?<\/strong> Contenir l'impact et am\u00e9liorer la d\u00e9tection future.<\/p><\/li><li data-start=\"6680\" data-end=\"6828\"><p data-start=\"6682\" data-end=\"6828\"><strong data-start=\"6682\" data-end=\"6699\">Action rapide :<\/strong> Effectuez une rotation des secrets\/tokens apr\u00e8s exposition, rescopez les origines CORS, v\u00e9rifiez les d\u00e9pendances cloud et affinez les r\u00e8gles SIEM en fonction des r\u00e9sultats.<\/p><\/li><li data-start=\"6829\" data-end=\"6900\"><p data-start=\"6831\" data-end=\"6900\"><strong data-start=\"6831\" data-end=\"6841\">V\u00e9rifiez :<\/strong> Cl\u00f4turez les actions de rem\u00e9diation et confirmez les mises \u00e0 jour de la d\u00e9tection.<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0d45597 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"0d45597\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-42f879c9 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"42f879c9\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-2c8bfc12 syd-sticky-section-no\" data-id=\"2c8bfc12\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6919a471 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"6919a471\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Partager :<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-7f905bc1 syd-sticky-section-no\" data-id=\"7f905bc1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-28b6f900 elementor-share-buttons--skin-flat elementor-share-buttons--view-icon-text elementor-share-buttons--shape-square elementor-grid-0 elementor-share-buttons--color-official syd-sticky-section-no elementor-widget elementor-widget-share-buttons\" data-id=\"28b6f900\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;share_url&quot;:{&quot;url&quot;:&quot;https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare&quot;,&quot;is_external&quot;:&quot;&quot;,&quot;nofollow&quot;:&quot;&quot;,&quot;custom_attributes&quot;:&quot;&quot;}}\" data-widget_type=\"share-buttons.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-grid\" role=\"list\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_x-twitter\" role=\"button\" tabindex=\"0\" aria-label=\"Partager sur x-twitter\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-x-twitter\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-share-btn__text\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__title\">\n\t\t\t\t\t\t\t\t\t\tX\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_linkedin\" role=\"button\" tabindex=\"0\" aria-label=\"Partager sur linkedin\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-linkedin\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-share-btn__text\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__title\">\n\t\t\t\t\t\t\t\t\t\tLinkedIn\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-cf1fb15 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"cf1fb15\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12d5d76 syd-sticky-section-no\" data-id=\"12d5d76\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e19b717 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"e19b717\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-eef88fd elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"eef88fd\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-c0ccf91 syd-sticky-section-no\" data-id=\"c0ccf91\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div data-ha-element-link=\"{&quot;url&quot;:&quot;https:\\\/\\\/www.stroople.com\\\/audit\\\/&quot;,&quot;is_external&quot;:&quot;&quot;,&quot;nofollow&quot;:&quot;&quot;}\" style=\"cursor: pointer\" class=\"elementor-element elementor-element-3419c3a elementor-widget__width-initial syd-sticky-section-no elementor-widget elementor-widget-ha-image-hover-effect happy-addon ha-image-hover-effect\" data-id=\"3419c3a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ha-image-hover-effect.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"ha-ihe-wrapper grid\">\n\t\t\t<figure class=\"ha-ihe-fig ha-effect-apollo\">\n\t\t\t\t<img decoding=\"async\" class=\"ha-ihe-img\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/08\/rostislav-uzunov-3G03lBTzjA8-unsplash.jpg\" alt=\"Effet de survol de l&#039;image\" \/>\n\t\t\t\t<figcaption class=\"ha-ihe-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<h2 class=\"ha-ihe-title\">Audit et surveillance de la surface d'attaque externe<\/h2>\t\t\t\t\t\t\t\t\t\t\t\t\t<p class=\"ha-ihe-desc\">\nVotre cybers\u00e9curit\u00e9 vue par les pirates.<\/p>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/www.stroople.com\/fr\/audit\/\"  target=\"&quot;_blank&quot;\" rel=\"&quot;nofollow&quot;\"><\/a>\n\t\t\t\t\t\t\t\t\t<\/figcaption>\n\t\t\t<\/figure>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-33ef498 syd-sticky-section-no\" data-id=\"33ef498\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div data-ha-element-link=\"{&quot;url&quot;:&quot;https:\\\/\\\/www.stroople.com\\\/audit\\\/&quot;,&quot;is_external&quot;:&quot;&quot;,&quot;nofollow&quot;:&quot;&quot;}\" style=\"cursor: pointer\" class=\"elementor-element elementor-element-70e6ede syd-sticky-section-no elementor-widget elementor-widget-counter\" data-id=\"70e6ede\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"counter.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-counter\">\n\t\t\t\t\t\t<div class=\"elementor-counter-number-wrapper\">\n\t\t\t\t<span class=\"elementor-counter-number-prefix\"><\/span>\n\t\t\t\t<span class=\"elementor-counter-number\" data-duration=\"2000\" data-to-value=\"75\" data-from-value=\"0\" data-delimiter=\",\">0<\/span>\n\t\t\t\t<span class=\"elementor-counter-number-suffix\">%<\/span>\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-08910c5 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"08910c5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>des violations de donn\u00e9es r\u00e9ussies d\u00e9butent sur des actifs expos\u00e9s sur Internet.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7652aef elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"7652aef\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ed0df97 syd-sticky-section-no\" data-id=\"ed0df97\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-14be053 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"14be053\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5e63e1f elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"5e63e1f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6502000 syd-sticky-section-no\" data-id=\"6502000\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-67d7aa6 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"67d7aa6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2655d51e elementor-widget-divider--view-line_text elementor-widget-divider--element-align-right syd-sticky-section-no elementor-widget elementor-widget-divider\" data-id=\"2655d51e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t\t<span class=\"elementor-divider__text elementor-divider__element\">\n\t\t\t\tGRC\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6bb6bd8c syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"6bb6bd8c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Articles connexes<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7aa4a5bf elementor-grid-3 elementor-grid-tablet-2 elementor-grid-mobile-1 elementor-posts--thumbnail-top syd-sticky-section-no elementor-widget elementor-widget-posts\" data-id=\"7aa4a5bf\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;classic_columns&quot;:&quot;3&quot;,&quot;classic_columns_tablet&quot;:&quot;2&quot;,&quot;classic_columns_mobile&quot;:&quot;1&quot;,&quot;classic_row_gap&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:35,&quot;sizes&quot;:[]},&quot;classic_row_gap_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;classic_row_gap_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"posts.classic\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-posts-container elementor-posts elementor-posts--skin-classic elementor-grid\" role=\"list\">\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-29199 post type-post status-publish format-standard has-post-thumbnail hentry category-governance-risk-compliance-cybersecurity tag-nis2\" role=\"listitem\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/www.stroople.com\/fr\/nis2-minimum-baseline\/\" tabindex=\"-1\" >\n\t\t\t<div class=\"elementor-post__thumbnail\"><img decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition.jpg\" class=\"attachment-full size-full wp-image-29201\" alt=\"Assembl\u00e9e nationale fran\u00e7aise, transposition de la directive NIS2 en attente d&#039;examen parlementaire\" srcset=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition.jpg 640w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition-300x200.jpg 300w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition-18x12.jpg 18w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition-230x153.jpg 230w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition-350x234.jpg 350w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/french-national-assembly-nis2-transposition-480x320.jpg 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/div>\n\t\t<\/a>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/www.stroople.com\/fr\/nis2-minimum-baseline\/\" >\n\t\t\t\tEt si la directive NIS2 ne constituait d\u00e9j\u00e0 qu'un socle minimal ?\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<\/div>\n\t\t\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-25715 post type-post status-publish format-standard has-post-thumbnail hentry category-governance-risk-compliance-cybersecurity\" role=\"listitem\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/www.stroople.com\/fr\/strategic-library-for-ciso\/\" tabindex=\"-1\" >\n\t\t\t<div class=\"elementor-post__thumbnail\"><img decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash.jpg\" class=\"attachment-full size-full wp-image-25718\" alt=\"\" srcset=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash.jpg 640w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash-300x200.jpg 300w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash-18x12.jpg 18w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash-230x153.jpg 230w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash-350x234.jpg 350w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/11\/giammarco-boscaro-zeH-ljawHtg-unsplash-480x320.jpg 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/div>\n\t\t<\/a>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/www.stroople.com\/fr\/strategic-library-for-ciso\/\" >\n\t\t\t\tLa biblioth\u00e8que strat\u00e9gique du RSSI - 12 livres essentiels\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<\/div>\n\t\t\t\t<\/article>\n\t\t\t\t<article class=\"elementor-post elementor-grid-item post-24977 post type-post status-publish format-standard has-post-thumbnail hentry category-governance-risk-compliance-cybersecurity\" role=\"listitem\">\n\t\t\t\t<a class=\"elementor-post__thumbnail__link\" href=\"https:\/\/www.stroople.com\/fr\/cybersecurity-myths-cyber-pantheon\/\" tabindex=\"-1\" >\n\t\t\t<div class=\"elementor-post__thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"425\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash.jpg\" class=\"attachment-full size-full wp-image-24979\" alt=\"\" srcset=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash.jpg 640w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash-300x199.jpg 300w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash-18x12.jpg 18w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash-230x153.jpg 230w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash-350x232.jpg 350w, https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/10\/raja-v-Orec8tmEwYM-unsplash-480x319.jpg 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/div>\n\t\t<\/a>\n\t\t\t\t<div class=\"elementor-post__text\">\n\t\t\t\t<h3 class=\"elementor-post__title\">\n\t\t\t<a href=\"https:\/\/www.stroople.com\/fr\/cybersecurity-myths-cyber-pantheon\/\" >\n\t\t\t\tLes dieux du cyber-panth\u00e9on : Mythes modernes et ch\u00e2timents num\u00e9riques\t\t\t<\/a>\n\t\t<\/h3>\n\t\t\t\t<\/div>\n\t\t\t\t<\/article>\n\t\t\t\t<\/div>\n\t\t\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-014cc98 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"014cc98\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-05bcd78 syd-sticky-section-no\" data-id=\"05bcd78\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Le cas de militaryfighterjet.com : faux Lockheed Martin, vraie classe de ma\u00eetre en mati\u00e8re d'occultation Un analyste clique sur un r\u00e9sultat Google qui m\u00e8ne \u00e0 un \"partenaire\".<\/p>","protected":false},"author":1,"featured_media":24612,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[114],"tags":[],"class_list":["post-24692","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-operations-soc-detection"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar - Stroople<\/title>\n<meta name=\"description\" content=\"Discover how Phishing-as-a-Service (PhaaS) operators exploited Google Cloud and Cloudflare for three years, using expired domains, cloaking, and Lockheed Martin clones to bypass detection.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.stroople.com\/fr\/phishing-as-a-service-google-cloud-cloudflare\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar - Stroople\" \/>\n<meta property=\"og:description\" content=\"Discover how Phishing-as-a-Service (PhaaS) operators exploited Google Cloud and Cloudflare for three years, using expired domains, cloaking, and Lockheed Martin clones to bypass detection.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.stroople.com\/fr\/phishing-as-a-service-google-cloud-cloudflare\/\" \/>\n<meta property=\"og:site_name\" content=\"Stroople\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-08T18:58:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-08T19:20:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"427\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"STROOPLEADMINISTRATOR\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Stroople1\" \/>\n<meta name=\"twitter:site\" content=\"@Stroople1\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"STROOPLEADMINISTRATOR\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/\"},\"author\":{\"name\":\"STROOPLEADMINISTRATOR\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/person\\\/a1eb93cbbffe1681999993af123a6d44\"},\"headline\":\"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar\",\"datePublished\":\"2025-09-08T18:58:43+00:00\",\"dateModified\":\"2025-09-08T19:20:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/\"},\"wordCount\":919,\"publisher\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\",\"articleSection\":[\"SecOps\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/\",\"name\":\"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar - Stroople\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\",\"datePublished\":\"2025-09-08T18:58:43+00:00\",\"dateModified\":\"2025-09-08T19:20:32+00:00\",\"description\":\"Discover how Phishing-as-a-Service (PhaaS) operators exploited Google Cloud and Cloudflare for three years, using expired domains, cloaking, and Lockheed Martin clones to bypass detection.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\",\"contentUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg\",\"width\":640,\"height\":427,\"caption\":\"phishing\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/phishing-as-a-service-google-cloud-cloudflare\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.stroople.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#website\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/\",\"name\":\"Stroople\",\"description\":\"Cybersecurity Expertise\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.stroople.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#organization\",\"name\":\"Stroople Cybersecurity\",\"alternateName\":\"Stroople\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Logo-Stroople-responsive.png\",\"contentUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Logo-Stroople-responsive.png\",\"width\":1000,\"height\":1000,\"caption\":\"Stroople Cybersecurity\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Stroople1\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/stroople\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC_kTnaswN04kjIrHU0Pi_qg\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/person\\\/a1eb93cbbffe1681999993af123a6d44\",\"name\":\"STROOPLEADMINISTRATOR\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g\",\"caption\":\"STROOPLEADMINISTRATOR\"},\"sameAs\":[\"https:\\\/\\\/stroople.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"L'hame\u00e7onnage en tant que service : Trois ans sous le radar de Google Cloud et de Cloudflare - Stroople","description":"D\u00e9couvrez comment les op\u00e9rateurs de Phishing-as-a-Service (PhaaS) ont exploit\u00e9 Google Cloud et Cloudflare pendant trois ans, en utilisant des domaines expir\u00e9s, le cloaking et des clones de Lockheed Martin pour contourner la d\u00e9tection.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.stroople.com\/fr\/phishing-as-a-service-google-cloud-cloudflare\/","og_locale":"fr_FR","og_type":"article","og_title":"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar - Stroople","og_description":"Discover how Phishing-as-a-Service (PhaaS) operators exploited Google Cloud and Cloudflare for three years, using expired domains, cloaking, and Lockheed Martin clones to bypass detection.","og_url":"https:\/\/www.stroople.com\/fr\/phishing-as-a-service-google-cloud-cloudflare\/","og_site_name":"Stroople","article_published_time":"2025-09-08T18:58:43+00:00","article_modified_time":"2025-09-08T19:20:32+00:00","og_image":[{"width":640,"height":427,"url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg","type":"image\/jpeg"}],"author":"STROOPLEADMINISTRATOR","twitter_card":"summary_large_image","twitter_creator":"@Stroople1","twitter_site":"@Stroople1","twitter_misc":{"\u00c9crit par":"STROOPLEADMINISTRATOR","Dur\u00e9e de lecture estim\u00e9e":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#article","isPartOf":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/"},"author":{"name":"STROOPLEADMINISTRATOR","@id":"https:\/\/www.stroople.com\/#\/schema\/person\/a1eb93cbbffe1681999993af123a6d44"},"headline":"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar","datePublished":"2025-09-08T18:58:43+00:00","dateModified":"2025-09-08T19:20:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/"},"wordCount":919,"publisher":{"@id":"https:\/\/www.stroople.com\/#organization"},"image":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg","articleSection":["SecOps"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/","url":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/","name":"L'hame\u00e7onnage en tant que service : Trois ans sous le radar de Google Cloud et de Cloudflare - Stroople","isPartOf":{"@id":"https:\/\/www.stroople.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#primaryimage"},"image":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg","datePublished":"2025-09-08T18:58:43+00:00","dateModified":"2025-09-08T19:20:32+00:00","description":"D\u00e9couvrez comment les op\u00e9rateurs de Phishing-as-a-Service (PhaaS) ont exploit\u00e9 Google Cloud et Cloudflare pendant trois ans, en utilisant des domaines expir\u00e9s, le cloaking et des clones de Lockheed Martin pour contourner la d\u00e9tection.","breadcrumb":{"@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#primaryimage","url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg","contentUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2025\/09\/kaptured-by-kasia-Fl3Rf_t8dMs-unsplash.jpg","width":640,"height":427,"caption":"phishing"},{"@type":"BreadcrumbList","@id":"https:\/\/www.stroople.com\/phishing-as-a-service-google-cloud-cloudflare\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.stroople.com\/"},{"@type":"ListItem","position":2,"name":"Phishing-as-a-Service: Three Years Under Google Cloud and Cloudflare\u2019s Radar"}]},{"@type":"WebSite","@id":"https:\/\/www.stroople.com\/#website","url":"https:\/\/www.stroople.com\/","name":"Stroople","description":"Expertise en cybers\u00e9curit\u00e9","publisher":{"@id":"https:\/\/www.stroople.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.stroople.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.stroople.com\/#organization","name":"Stroople Cybers\u00e9curit\u00e9","alternateName":"Stroople","url":"https:\/\/www.stroople.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stroople.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/05\/Logo-Stroople-responsive.png","contentUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/05\/Logo-Stroople-responsive.png","width":1000,"height":1000,"caption":"Stroople Cybersecurity"},"image":{"@id":"https:\/\/www.stroople.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Stroople1","https:\/\/www.linkedin.com\/company\/stroople\/","https:\/\/www.youtube.com\/channel\/UC_kTnaswN04kjIrHU0Pi_qg"]},{"@type":"Person","@id":"https:\/\/www.stroople.com\/#\/schema\/person\/a1eb93cbbffe1681999993af123a6d44","name":"STROOPLEADMINISTRATEUR","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cf565399cf069755c53f17b9c363d364247d5ad1c1bc3bc3ff3b9ff928b80411?s=96&d=mm&r=g","caption":"STROOPLEADMINISTRATOR"},"sameAs":["https:\/\/stroople.com"]}]}},"_links":{"self":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/posts\/24692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/comments?post=24692"}],"version-history":[{"count":0,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/posts\/24692\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/media\/24612"}],"wp:attachment":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/media?parent=24692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/categories?post=24692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/tags?post=24692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}