{ "Event": { "analysis": "1", "date": "2026-06-11", "extends_uuid": "", "info": "[Threat Intel] Sniper's Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud", "protected": false, "publish_timestamp": "1782058547", "published": true, "threat_level_id": "3", "timestamp": "1782058547", "uuid": "7a3ded92-0934-49f2-956c-0623538fbdb6", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Group-IB\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0f0428", "local": false, "name": "misp-galaxy:target-information=\"Algeria\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003f", "local": false, "name": "rectifyq:sub-category=\"tool-profile\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Cybercrime\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781233215", "to_ids": false, "type": "link", "uuid": "cf304967-c47c-452b-b3f0-9a8d8a9c7f5a", "value": "https://www.group-ib.com/blog/inside-sniperdz-phaas-ecosystem/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781233215", "to_ids": false, "type": "text", "uuid": "2175aaf9-6462-42ef-a1c8-d440132980e6", "value": "An investigation into phishing activity targeting users across the Middle East and North Africa uncovered SniperDz, a centralized Push-Notification-as-a-Service and Phishing-as-a-Service platform. The operation uses fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations to promote fake offers including free mobile internet packages and financial compensation. Victims are redirected through trusted link-aggregation services like Linktree and Linkbio to evade detection. SniperDz provides 80 phishing templates mimicking over 30 global brands across financial services, social media, streaming, and gaming platforms. The infrastructure employs browser notification abuse, history manipulation creating a back-button prison, premium SMS subscriptions, premium-rate calls, investment scams, and affiliate marketing for monetization. Analysis revealed over 900 suspicious domains linked to shared hosting infrastructure and a recurring VAPID public key connecting multiple campai..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781233215", "to_ids": false, "type": "text", "uuid": "a046d7d2-d9d8-452c-ad1b-7ede2bedd106", "value": "Name: Sniper's Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud\nAuthor: AlienVault\nAdversary: SniperDz\nTags: [\"sniperdz\", \"phishing-as-a-service\", \"browser hijacking\"]\nTgtd countries: [\"Algeria\"]\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Finance\", \"Telecommunications\", \"Media\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781233215", "to_ids": false, "type": "threat-actor", "uuid": "2e91cf90-093e-4b66-a319-bacdb028ad28", "value": "SniperDz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782038267", "to_ids": true, "type": "hostname", "uuid": "44a89786-55e3-4025-9050-ef0d372228ac", "value": "aff.bnaosf1he.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782038288", "to_ids": true, "type": "hostname", "uuid": "4c9b1b27-d897-43bb-b669-e0e887a15eec", "value": "win.anababayala.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782038309", "to_ids": true, "type": "hostname", "uuid": "6b4147cf-c7a1-405f-a3b4-9811bd76805a", "value": "win.feezossl.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS32475 singlehop llc", "deleted": false, "disable_correlation": false, "timestamp": "1782038330", "to_ids": true, "type": "ip-dst", "uuid": "57fc83c5-3cb4-44f7-84b7-51d235015f47", "value": "184.154.10.254", "Tag": [ { "colour": "#ca404c", "local": false, "name": "asn:asn=\"32475\"", "relationship_type": "" }, { "colour": "#1c06de", "local": false, "name": "asn:as-owner=\"SINGLEHOP-LLC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS32475 singlehop llc", "deleted": false, "disable_correlation": false, "timestamp": "1782038351", "to_ids": true, "type": "ip-dst", "uuid": "861a5da2-42ec-4746-bd56-55d81e06c41f", "value": "65.60.9.236", "Tag": [ { "colour": "#ca404c", "local": false, "name": "asn:asn=\"32475\"", "relationship_type": "" }, { "colour": "#1c06de", "local": false, "name": "asn:as-owner=\"SINGLEHOP-LLC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782038372", "to_ids": true, "type": "ip-dst", "uuid": "54800f3f-e14e-4842-90bc-8c02c6fd73df", "value": "108.178.23.118", "Tag": [ { "colour": "#ca404c", "local": false, "name": "asn:asn=\"32475\"", "relationship_type": "" }, { "colour": "#1c06de", "local": false, "name": "asn:as-owner=\"SINGLEHOP-LLC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }