They say you never know what’s baked inside a croissant — and in this case, it’s not just spinach, but a full-fledged phishing campaign.
At Link-Shield, we recently uncovered a rare and creative phishing attempt: a fake French website targeting French-speaking Israelis. Not something you see every day — kind of like a spinach croissant!
A French Company... But Only in Israel?
The phishing campaign revolves around a French company called VD2E (official website: vd2e.fr) — a real company specializing in green energy solutions.
Their official site is pretty straightforward — it contains basic company info and a way to schedule meetings.
🚫 No login, no user input, and definitely no place to enter personal details.
🚩 Enter the Fake: vdee[.]fr
Then comes the imposter website — vdee.fr (notice the sneaky swap from "2" to "e").
Unlike the real site, this fake page had one goal: steal personal information.
🔍 What did we find on the fake site?
- A single input field asking for an ID number ("Teoudat Zeout" in Hebrew, but written in French letters).
- No other content — just a form waiting for victims.
- Running over HTTP (not HTTPS), meaning no encryption — a clear sign of danger.
📊 Strange Traffic: Only Popular in Israel?
According to SimilarWeb, although VD2E is a French company, the only place this domain was popular is Israel — a huge red flag.
📈 The Phishing Pattern: Spikes of Activity
When we analyzed the site's traffic over time, we noticed something very familiar to us in the cybersecurity world: two sharp spikes in traffic, then total silence.
🎯 This pattern is typical for phishing campaigns:
- Campaign launch → Sudden spike in traffic as attackers lure in victims.
- Campaign ends (or gets blocked) → Traffic drops to zero.
🚨 What We Did
As soon as Link-Shield identified this malicious imposter site, we:
- Blocked the site for all Link-Shield users — preventing anyone from falling victim.
- Notified Israel’s national CERT — and they are now investigating the case further.
✅ Stay Safe with Link-Shield
Thanks to Link-Shield’s real-time phishing protection, users were shielded from this previously unknown phishing site — before any damage was done.