International Operation Shuts Down 16shop Phishing Platform and Leads to Three Arrests
Summary
An INTERPOL-coordinated operation with Group-IB and national agencies shut down 16shop, a phishing-as-a-service platform linked to more than 150,000 phishing domains, and led to three suspect arrests.
Key points
- 16shop sold phishing kits targeting users of services including Apple, PayPal, Amazon, and American Express.
- Group-IB found more than 150,000 phishing domains associated with kits obtained from the platform.
- The phishing pages could be localized into as many as eight languages and tailored by victims’ geolocation.
- Group-IB analyzed platform infrastructure and digital traces, then shared findings with INTERPOL and law-enforcement partners.
- The operation led to the platform’s shutdown and arrests of three suspected administrators or facilitators in Indonesia and Japan.
- Authorities seized multiple electronic items and luxury vehicles during the investigation.
Article Details
- Event Type
- International law-enforcement operation that shut down the 16shop phishing-as-a-service platform and led to three arrests.
- Impact
- The platform was shut down, and three suspects were arrested: a suspected administrator in Indonesia and two suspected facilitators, one in Indonesia and one in Japan. Group-IB reported that more than 150,000 phishing domains had been created using kits procured from 16shop, potentially exposing users to credential and payment-detail theft.
People
Vendors
Products
Countries
Francethan 150,000 phishing domains, leveraged as part of phishing attacks against users in Germany, Japan, France, the US, and the UK, among others, were created using kits procured from 16shop.GermanyThis complicated scam operation piqued our interest due to its global scale, reaching the United States, Japan, Germany, and Indonesia, among others.Indonesiaan international crime fighting operation involving INTERPOL and national law enforcement agencies from Indonesia, Japan and the United States that targeted the notorious ‘phishing-as-a-service’ (PaaS) platform 16shop.Japancrime fighting operation involving INTERPOL and national law enforcement agencies from Indonesia, Japan and the United States that targeted the notorious ‘phishing-as-a-service’ (PaaS) platform 16shop.United KingdomUnited Statesoperation involving INTERPOL and national law enforcement agencies from Indonesia, Japan and the United States that targeted the notorious ‘phishing-as-a-service’ (PaaS) platform 16shop.