Phishing Empire Runs Undetected on Google, Cloudflare

Researchers say a global phishing-as-a-service operation, cloaked on Google Cloud and Cloudflare, has run for more than three years. The Deep Specter Research team describes it as multi-year, industrial-scale phishing that hijacks abandoned or expired domains and pairs them with cloned, brand-impersonating sites.

The operation reportedly included 48,000 hosts and more than 80 clusters, with 86 physical IP addresses on Google Cloud in Hong Kong and Taiwan and an infrastructure of 44,000 virtual IPs on Google Cloud plus 4,000 from other providers, with new cloned sites appearing on Cloudflare. The cloaked sites reportedly received traffic from Google, Meta, and Android apps, and the researchers detected 265 public incidences of the malicious activity.

According to Deep Specter, the campaign impersonated major brands such as Lockheed Martin and delivered malware and gambling content from “brand-trusted resources,” highlighting the risk of credential theft and regulatory liability for the brands involved.