The SniperDz phishing platform has been dismantled following a coordinated investigation by INTERPOL, the Algerian National Police, and cybersecurity firm Group-IB.
The operation resulted in the arrest of the primary developer and administrator of the service in Algeria. Consequently, this action ended a cybercrime operation that remained active for nearly a decade.
Scale of the SniperDz phishing platform
Active since at least 2015, the platform offered ready-made phishing kits, hosting infrastructure, and operational support to cybercriminals. Over a nine-year period, investigators identified more than 20,000 unique domains associated with the SniperDz phishing platform.
The service targeted more than 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix, and Steam. Specifically, Group-IB identified 80 phishing templates deployed in five languages, including Arabic, English, French, Spanish, and Hebrew.
These templates targeted users of consumer, technology, and payment platforms across multiple geographies. Furthermore, the threat actors used social engineering techniques on social media to impersonate well-known political personalities in the Middle East and North Africa.
Operational Security Failures and Investigation
Group-IB first identified the activity while tracking large-scale phishing targeting globally recognized brands. Meanwhile, the investigations team conducted a multi-month analysis combining infrastructure tracking and open-source intelligence.
Notably, the suspect made a significant operational security failure. Publicly available video tutorials created to recruit affiliates inadvertently exposed administrative information and account credentials. In addition, researchers uncovered years of social media activity documenting the platform’s evolution.
Investigators also tracked a Telegram channel used to coordinate operations, which had more than 7,300 subscribers. Meanwhile, a Facebook account followed by more than 19,000 users provided additional evidence linking the suspect to the activities.
International Collaboration and Arrest
Group-IB shared its findings with INTERPOL, which coordinated with the Algerian National Police under Operation Ramz. As a result, authorities disrupted the infrastructure and took down the main website used to offer these services.
“Disrupting cybercrime requires more than taking down phishing pages. It requires understanding the people, infrastructure, and criminal networks behind them.”
Dmitry Volkov, CEO of Group-IB
The arrest highlights the growing importance of intelligence-driven collaboration between law enforcement and private-sector partners. Furthermore, INTERPOL stated that such partnerships drive the most effective response to global cyberthreats.
“INTERPOL, working with private sector partner Group-IB, was able to provide actionable intelligence and operational support to Algerian law enforcement.”
Neal Jetton, Director Cybercrime, INTERPOL
Future Outlook on Phishing Services
The operation ended the long-running SniperDz phishing platform, which had lowered the barrier to entry for cybercriminals. However, the rise of phishing-as-a-service platforms continues to present challenges for global brands and digital economy stability.
To date, Group-IB has contributed to more than 1,600 high-tech crime investigations across more than 60 countries. Consequently, the company plans to continue supporting international law enforcement efforts to proactively disrupt digital crime.
