{"id":118,"date":"2026-01-13T00:00:00","date_gmt":"2026-01-12T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/fr\/cloaking-wordpress-malware-googlebot-ip-verifiee\/"},"modified":"2026-01-20T06:32:40","modified_gmt":"2026-01-20T05:32:40","slug":"cloaking-wordpress-malware-googlebot-ip-verifiee","status":"publish","type":"post","link":"https:\/\/helloblog.io\/fr\/cloaking-wordpress-malware-googlebot-ip-verifiee\/","title":{"rendered":"Cloaking WordPress nouvelle g\u00e9n\u00e9ration : quand un malware ne montre son vrai visage qu\u2019\u00e0 Googlebot (IP v\u00e9rifi\u00e9e)"},"content":{"rendered":"\n<p>On a tous d\u00e9j\u00e0 crois\u00e9 du cloaking SEO (contenu diff\u00e9rent selon l\u2019audience) sur WordPress : du spam visible dans Google, mais invisible quand on visite le site \u00ab normalement \u00bb. Ce qui change dans les campagnes r\u00e9centes, c\u2019est le niveau de pr\u00e9cision. L\u00e0 o\u00f9 beaucoup d\u2019attaquants se contentent d\u2019un filtre sur le <em>User-Agent<\/em>, certains scripts vont jusqu\u2019\u00e0 v\u00e9rifier que le visiteur est bien Googlebot\u2026 en validant son adresse IP contre des plages officielles de Google.<\/p>\n\n\n\n<p>Dans un cas analys\u00e9 par Sucuri, l\u2019infection se trouvait directement dans <code>index.php<\/code> \u00e0 la racine WordPress. Le fichier jouait le r\u00f4le de <em>gatekeeper<\/em> : selon l\u2019identit\u00e9 du visiteur, il chargeait WordPress de fa\u00e7on normale ou injectait un contenu distant destin\u00e9 aux robots d\u2019indexation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Le sc\u00e9nario : WordPress \u00ab propre \u00bb pour toi, contenu inject\u00e9 pour Google<\/h2>\n\n\n\n<p>Le principe est simple sur le papier : masquer l\u2019infection \u00e0 l\u2019admin du site et aux visiteurs humains, tout en exposant un contenu diff\u00e9rent aux crawlers. Dans l\u2019exemple \u00e9tudi\u00e9, Google se retrouvait \u00e0 indexer une page qui n\u2019\u00e9tait pas r\u00e9ellement servie par le site, mais r\u00e9cup\u00e9r\u00e9e \u00e0 la vol\u00e9e depuis une URL externe, puis renvoy\u00e9e comme si elle provenait du domaine compromis.<\/p>\n\n\n\n<p>Ce type d\u2019attaque vise principalement la r\u00e9putation SEO : pages parasites dans l\u2019index, d\u00e9gradation des r\u00e9sultats, risque de blacklist, et d\u00e9tection retard\u00e9e (puisque le propri\u00e9taire ne voit rien d\u2019anormal lors de ses visites).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce qui rend ce malware int\u00e9ressant : la v\u00e9rification IP via ASN + CIDR<\/h2>\n\n\n\n<p>Beaucoup de scripts de cloaking font un test fragile du type \u00ab si <code>HTTP_USER_AGENT<\/code> contient Googlebot \u00bb. Probl\u00e8me : un User-Agent se falsifie en une seconde. Dans le cas pr\u00e9sent\u00e9, l\u2019attaquant a ajout\u00e9 une seconde barri\u00e8re : une biblioth\u00e8que en dur de plages IP appartenant \u00e0 Google, associ\u00e9es \u00e0 l\u2019ASN (Autonomous System Number) de Google, au format CIDR.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ASN (Autonomous System Number) : l\u2019\u00ab identit\u00e9 r\u00e9seau \u00bb de Google<\/h3>\n\n\n\n<p>Un ASN repr\u00e9sente un ensemble de blocs IP contr\u00f4l\u00e9s par une entit\u00e9 (ici Google) et utilis\u00e9s par ses services et son infrastructure. V\u00e9rifier que la requ\u00eate provient d\u2019une plage IP associ\u00e9e \u00e0 l\u2019ASN de Google permet de distinguer un vrai crawler issu de l\u2019infra Google d\u2019un bot qui imite simplement un User-Agent.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CIDR : d\u00e9crire un bloc d\u2019IP sans tout lister<\/h3>\n\n\n\n<p>Le CIDR est une notation compacte pour repr\u00e9senter une plage d\u2019adresses. Exemple classique : <code>192.168.1.0\/24<\/code>. Le suffixe (<code>\/24<\/code>) indique la taille du bloc et les adresses incluses. C\u2019est le format standard qu\u2019on retrouve partout : ACL r\u00e9seau, firewall, routage, allowlists, etc.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Le d\u00e9tail qui fait mal : calculs bitwise (et support IPv6) \u0628\u062f\u0644 du simple \u00ab match \u00bb<\/h2>\n\n\n\n<p>Autre point marquant : la validation de plage IP ne se faisait pas via un test de cha\u00eene ou une comparaison na\u00efve, mais via des op\u00e9rations bitwise (ET binaire) sur l\u2019IP et un masque r\u00e9seau. C\u2019est une approche plus \u00ab bas niveau \u00bb : le script calcule math\u00e9matiquement si l\u2019adresse du visiteur appartient au bloc CIDR attendu.<\/p>\n\n\n\n<p>Sucuri note aussi la pr\u00e9sence d\u2019une prise en charge robuste d\u2019IPv6, souvent ignor\u00e9e par des scripts plus anciens. En pratique, \u00e7a r\u00e9duit encore la surface de d\u00e9tection via des tests manuels classiques.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Logique rapport\u00e9e : appartenance \u00e0 un r\u00e9seau via masque\n\/\/ ($ip_decimal &amp; $netmask_decimal) == ($range_decimal &amp; $netmask_decimal)\n\/\/ L'id\u00e9e : apr\u00e8s conversion en entier, on applique le masque et on compare.\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Logique rapport\u00e9e : appartenance \u00e0 un r\u00e9seau via masque<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ ($ip_decimal &#x26; $netmask_decimal) == ($range_decimal &#x26; $netmask_decimal)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ L'id\u00e9e : apr\u00e8s conversion en entier, on applique le masque et on compare.<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Anatomie du flux d\u2019infection (vu c\u00f4t\u00e9 serveur)<\/h2>\n\n\n\n<p>Dans le <code>index.php<\/code> compromis, la d\u00e9cision se fait en plusieurs \u00e9tapes, de fa\u00e7on assez d\u00e9fensive (du point de vue de l\u2019attaquant) :<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Filtrage initial via <code>HTTP_USER_AGENT<\/code> : recherche de cha\u00eenes li\u00e9es \u00e0 Googlebot, mais aussi \u00e0 des outils de v\u00e9rification\/inspection et \u00e0 certains crawlers\/API Google.<\/li>\n\n\n<li>V\u00e9rification IP \u00ab r\u00e9elle \u00bb : test d\u2019appartenance \u00e0 des plages ASN Google en CIDR via des op\u00e9rations bitwise, avec support IPv4 et IPv6.<\/li>\n\n\n<li>Si (User-Agent + IP) = OK : r\u00e9cup\u00e9ration d\u2019un payload distant et injection directe dans la r\u00e9ponse HTTP (le crawler pense que le site h\u00e9berge ce contenu).<\/li>\n\n\n<li>Si l\u2019appel distant \u00e9choue : redirection vers <code>\/home\/<\/code> pour \u00e9viter que Google indexe une page cass\u00e9e.<\/li>\n\n\n<li>Si User-Agent Google mais IP non valide : le script logge un \u00e9v\u00e9nement de type \u00ab fake bot \u00bb puis renvoie vers la home l\u00e9gitime.<\/li>\n\n\n<li>Sinon (utilisateurs normaux) : redirection imm\u00e9diate vers la home, sans exposition du contenu malveillant.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">R\u00e9cup\u00e9ration de contenu distant via cURL<\/h3>\n\n\n\n<p>Une fois le visiteur \u00ab certifi\u00e9 \u00bb comme Google, le script va chercher du contenu externe via cURL, puis l\u2019affiche tel quel. L\u2019URL observ\u00e9e dans ce cas \u00e9tait : <code>hxxps:\/\/amp-samaresmanor[.]pages[.]dev<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Exemple de comportement d\u00e9crit : fetch distant + echo\n\/\/ (l'URL est volontairement neutralis\u00e9e)\n$url = 'hxxps:\/\/amp-samaresmanor[.]pages[.]dev';\n\n\/\/ cURL r\u00e9cup\u00e8re le contenu distant\u2026\n\/\/ \u2026 puis il est renvoy\u00e9 dans la r\u00e9ponse pour le crawler.\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Exemple de comportement d\u00e9crit : fetch distant + echo<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ (l'URL est volontairement neutralis\u00e9e)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$url <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> 'hxxps:\/\/amp-samaresmanor[.]pages[.]dev'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ cURL r\u00e9cup\u00e8re le contenu distant\u2026<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ \u2026 puis il est renvoy\u00e9 dans la r\u00e9ponse pour le crawler.<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Pourquoi modifier <code>index.php<\/code> est particuli\u00e8rement strat\u00e9gique<\/h2>\n\n\n\n<p>Toucher \u00e0 <code>index.php<\/code> (entr\u00e9e principale) permet de contr\u00f4ler une grande partie du trafic avant m\u00eame que WordPress ne rende la page. Dans ce cas, le code malveillant s\u2019appuyait aussi sur des fichiers c\u0153ur pour garder une apparence de normalit\u00e9 :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><code>wp-load.php<\/code> : inclus pour \u00ab bootstrapper \u00bb l\u2019environnement WordPress (acc\u00e8s config + base), via un <code>require_once<\/code> depuis le script.<\/li>\n\n\n<li><code>wp-blog-header.php<\/code> : fichier normalement requis \u00e0 la fin de l\u2019<code>index.php<\/code> standard, ce qui aide \u00e0 pr\u00e9server le rendu attendu pour les visiteurs non cibl\u00e9s.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Signaux d\u2019alerte : ce qui doit te mettre la puce \u00e0 l\u2019oreille<\/h2>\n\n\n\n<p>Le pi\u00e8ge de ce cloaking, c\u2019est que la navigation normale peut sembler parfaitement saine. Les indicateurs les plus utiles sont souvent indirects :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>R\u00e9sultats Google incoh\u00e9rents (snippets \u00e9tranges, pages inconnues, spam, langues inattendues).<\/li>\n\n\n<li>Fichiers r\u00e9cemment modifi\u00e9s, en particulier \u00e0 la racine (<code>index.php<\/code>) et dans <code>wp-includes<\/code>\/<code>wp-admin<\/code>.<\/li>\n\n\n<li>URLs suspectes (dans le code, dans les logs, ou visibles via des outils d\u2019analyse).<\/li>\n\n\n<li>Logs serveur \u00ab bizarres \u00bb : redirections conditionnelles, acc\u00e8s r\u00e9p\u00e9t\u00e9s par bots, erreurs applicatives corr\u00e9l\u00e9es.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Point notable sur l\u2019infrastructure observ\u00e9e<\/h4>\n\n\n<p>Selon l\u2019analyse cit\u00e9e, le domaine <code>amp-samaresmanor[.]pages[.]dev<\/code> \u00e9tait d\u00e9tect\u00e9 par des vendors sur VirusTotal et plusieurs sites auraient \u00e9t\u00e9 trouv\u00e9s infect\u00e9s au moment de l\u2019\u00e9criture. \u00c7a souligne l\u2019int\u00e9r\u00eat de surveiller les connexions sortantes et les domaines externes appel\u00e9s depuis le front.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Nettoyage et pr\u00e9vention : les mesures qui comptent vraiment<\/h2>\n\n\n\n<p>Sur ce type d\u2019infection, il faut traiter \u00e0 la fois le sympt\u00f4me (le fichier modifi\u00e9) et la cause (le point d\u2019entr\u00e9e). Les actions recommand\u00e9es dans la source couvrent l\u2019essentiel :<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Supprimer les fichiers\/dossiers non reconnus (et pas seulement \u00ab commenter \u00bb le code suspect).<\/li>\n\n\n<li>Auditer les comptes WordPress : retirer tout admin inattendu (y compris les comptes \u00ab support \u00bb ajout\u00e9s discr\u00e8tement).<\/li>\n\n\n<li>R\u00e9initialiser les identifiants : WordPress, FTP\/SFTP, panel d\u2019h\u00e9bergement, base de donn\u00e9es.<\/li>\n\n\n<li>Scanner la machine locale (poste du dev\/admin) : un vol d\u2019identifiants peut r\u00e9infecter le site imm\u00e9diatement.<\/li>\n\n\n<li>Mettre \u00e0 jour WordPress, th\u00e8mes et plugins (et \u00e9liminer les extensions abandonn\u00e9es).<\/li>\n\n\n<li>Ajouter un WAF (<em>Web Application Firewall<\/em>) pour r\u00e9duire les uploads malveillants et bloquer des communications vers des serveurs de commande (C2).<\/li>\n\n\n<li>Mettre en place une surveillance d\u2019int\u00e9grit\u00e9 des fichiers (<em>File Integrity Monitoring<\/em>) pour d\u00e9tecter toute modification non autoris\u00e9e de fichiers c\u0153ur comme <code>index.php<\/code>.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">\u00c0 retenir<\/h2>\n\n\n\n<p>On n\u2019est plus face \u00e0 des redirections grossi\u00e8res ou \u00e0 des injections visibles \u00e0 l\u2019\u0153il nu. Ici, l\u2019attaquant exploite la confiance des moteurs en ne montrant son contenu qu\u2019\u00e0 une infrastructure Google r\u00e9ellement v\u00e9rifi\u00e9e (User-Agent + IP ASN, IPv4\/IPv6, bitwise matching), tout en laissant une exp\u00e9rience parfaitement normale aux visiteurs humains.<\/p>\n\n\n\n<p>Dans ce contexte, les r\u00e9flexes \u00ab dev \u00bb redeviennent des r\u00e9flexes s\u00e9curit\u00e9 : contr\u00f4le d\u2019int\u00e9grit\u00e9, revue des modifications de fichiers sensibles, surveillance de l\u2019indexation via Google Search Console et analyse des sorties r\u00e9seau c\u00f4t\u00e9 serveur.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1360\" height=\"636\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic.png\" alt=\"Sch\u00e9ma illustrant une logique conditionnelle bas\u00e9e sur la v\u00e9rification IP\" class=\"wp-image-110\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic.png 1360w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic-1024x479.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic-768x359.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/IP-Verified-Conditional-Logic-400x187.png 400w\" sizes=\"auto, (max-width: 1360px) 100vw, 1360px\" \/><figcaption class=\"wp-element-caption\">Le contenu malveillant n\u2019est servi qu\u2019aux visiteurs dont l\u2019identit\u00e9 est valid\u00e9e (crawler + IP). \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1270\" height=\"936\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees.png\" alt=\"Capture montrant une diff\u00e9rence entre ce que Google voit et ce que les visiteurs voient\" class=\"wp-image-111\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees.png 1270w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees-300x221.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees-1024x755.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees-768x566.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/What-Google-sees-400x295.png 400w\" sizes=\"auto, (max-width: 1270px) 100vw, 1270px\" \/><figcaption class=\"wp-element-caption\">Exemple de cloaking : Google indexe un contenu diff\u00e9rent de celui affich\u00e9 aux visiteurs humains. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1332\" height=\"620\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format.png\" alt=\"Illustration du format CIDR pour repr\u00e9senter des plages IP\" class=\"wp-image-112\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format.png 1332w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format-1024x477.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format-768x357.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/CIDR-format-400x186.png 400w\" sizes=\"auto, (max-width: 1332px) 100vw, 1332px\" \/><figcaption class=\"wp-element-caption\">Le CIDR sert \u00e0 d\u00e9crire des blocs d\u2019adresses IP de fa\u00e7on compacte. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"498\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification.png\" alt=\"Diagramme montrant une v\u00e9rification multi-couches User-Agent puis IP\" class=\"wp-image-113\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification.png 1880w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification-300x79.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification-1024x271.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification-768x203.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification-1536x407.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Multi-Layer-Identity-Verification-400x106.png 400w\" sizes=\"auto, (max-width: 1880px) 100vw, 1880px\" \/><figcaption class=\"wp-element-caption\">User-Agent + validation IP : une strat\u00e9gie plus difficile \u00e0 contourner. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1420\" height=\"734\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation.png\" alt=\"Sch\u00e9ma illustrant la validation d\u2019adresse IP via op\u00e9rations bitwise\" class=\"wp-image-114\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation.png 1420w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation-300x155.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation-1024x529.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation-768x397.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Bitwise-IP-Range-Validation-400x207.png 400w\" sizes=\"auto, (max-width: 1420px) 100vw, 1420px\" \/><figcaption class=\"wp-element-caption\">Les op\u00e9rations bitwise permettent de tester l\u2019appartenance \u00e0 un bloc r\u00e9seau (CIDR). \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1444\" height=\"836\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL.png\" alt=\"Sch\u00e9ma montrant la r\u00e9cup\u00e9ration d\u2019un payload distant via cURL\" class=\"wp-image-115\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL.png 1444w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL-300x174.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL-1024x593.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL-768x445.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Remote-Payload-Execution-via-cURL-400x232.png 400w\" sizes=\"auto, (max-width: 1444px) 100vw, 1444px\" \/><figcaption class=\"wp-element-caption\">Le payload est r\u00e9cup\u00e9r\u00e9 \u00e0 distance puis renvoy\u00e9 comme si le site l\u2019h\u00e9bergeait. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1682\" height=\"554\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering.png\" alt=\"Exemple de filtrage User-Agent pour diff\u00e9rents services Google\" class=\"wp-image-116\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering.png 1682w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering-300x99.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering-1024x337.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering-768x253.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering-1536x506.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/User-Agent-Filtering-400x132.png 400w\" sizes=\"auto, (max-width: 1682px) 100vw, 1682px\" \/><figcaption class=\"wp-element-caption\">Le script cible plusieurs User-Agents li\u00e9s \u00e0 l\u2019\u00e9cosyst\u00e8me Google, pas uniquement Googlebot. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1694\" height=\"680\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging.png\" alt=\"Diagramme illustrant la logique conditionnelle et le logging d\u2019erreurs\" class=\"wp-image-117\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging.png 1694w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging-300x120.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging-1024x411.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging-768x308.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging-1536x617.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/4\/2026\/01\/Conditional-Logic-and-Error-Logging-400x161.png 400w\" sizes=\"auto, (max-width: 1694px) 100vw, 1694px\" \/><figcaption class=\"wp-element-caption\">Logique : bot l\u00e9gitime \u2192 payload, bot fake \u2192 redirection + log, humain \u2192 site normal. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n<div class=\"references-section\">\n                <h2>R\u00e9f\u00e9rences \/ Sources<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/malware-intercepts-googlebot-via-ip-verified-conditional-logic.html\" target=\"_blank\" rel=\"noopener noreferrer\">Malware Intercepts Googlebot via IP-Verified Conditional Logic<\/a><\/li><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/google-sees-spam-you-see-your-site-a-cloaked-seo-spam-attack.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack<\/a><\/li><li><a href=\"https:\/\/www.virustotal.com\/gui\/url\/5a006beedf563c6215a31746d011d13fd4f2561a1bf3b557484c4532b13e1ec6?nocache=1\" target=\"_blank\" rel=\"noopener noreferrer\">VirusTotal URL report<\/a><\/li><li><a href=\"https:\/\/publicwww.com\/websites\/amp-samaresmanor.pages\/\" target=\"_blank\" rel=\"noopener noreferrer\">PublicWWW &#8211; amp-samaresmanor.pages<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/website-firewall\/\" target=\"_blank\" rel=\"noopener noreferrer\">Sucuri Website Firewall<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/malware-detection-scanning\/\" target=\"_blank\" rel=\"noopener noreferrer\">Sucuri Malware Detection &amp; Scanning (File Integrity Monitoring)<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Certains malwares WordPress ne se contentent plus d\u2019une redirection grossi\u00e8re : ils servent un contenu externe uniquement aux crawlers Google, en v\u00e9rifiant l\u2019IP via des plages ASN en CIDR. R\u00e9sultat : toi tu vois ton site, Google indexe autre chose.<\/p>\n","protected":false},"author":14,"featured_media":109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[53,54,51,52,10],"class_list":["post-118","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securite","tag-cloaking","tag-googlebot","tag-malware","tag-seo","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts\/118","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/comments?post=118"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts\/118\/revisions"}],"predecessor-version":[{"id":163,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts\/118\/revisions\/163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/media\/109"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/media?parent=118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/categories?post=118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/tags?post=118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}