INTERPOL and Algerian Authorities Dismantle SniperDz Phishing Platform
Summary
A Group-IB investigation helped INTERPOL and Algerian authorities disrupt SniperDz, a phishing-as-a-service platform active since at least 2015. Its alleged developer was arrested, and hardware containing phishing software and scripts was seized.
Key points
- SniperDz offered about 80 phishing templates targeting more than 30 brands and operated under several names, including JokerDz, StormDz, and SpamDz.
- The free platform supported credential theft and redirected some victims to carrier-billing, premium-SMS, and other scams.
- Group-IB linked more than 20,000 associated domains using archived WHOIS records, infrastructure analysis, and evidence in the developer’s tutorial videos.
- The platform collected credentials, timestamps, IP addresses, and victims’ locations; its 2016 statistics reported more than 45,000 victim records.
- Under INTERPOL’s Operation Ramz, the platform’s website was taken down and an individual identified as its developer and administrator was arrested in Algeria.
- Group-IB shared intelligence on more than 5,000 compromised accounts, including accounts associated with government infrastructure.
Article Details
- Event Type
- Law-enforcement disruption of a phishing-as-a-service platform and arrest of its alleged administrator
- Impact
- Group-IB identified more than 20,000 domains associated with SniperDz. The platform's published statistics claimed more than 45,000 victim records by 2016, and Group-IB later provided intelligence on more than 5,000 compromised accounts. A SniperDz website was taken down and phishing-related hardware was seized. The broader Operation Ramz reported 201 arrests, 3,867 recorded victims, and 53 servers seized across 13 countries; those totals are not attributed solely to SniperDz.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hero-egy[.]com | Domain linked by investigators to the SniperDz phishing-as-a-service operation. |
| DOMAIN | jokerdz[.]com | Domain linked by investigators to the SniperDz phishing-as-a-service operation. |
| DOMAIN | stormdz[.]com | Domain linked by investigators to the SniperDz phishing-as-a-service operation. |
MITRE ATT&CK
Threat Actors
Vendors
Products
BloggerThe phishing-as-a-service platform offered an automated conversion tool that transformed standard HTML phishing pages into Blogger-compatible formats.SniperDzThe trail led investigators to SniperDz, a phishing-as-a-service platform that had been quietly serving cybercriminals since at least 2015.