Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz

Unit 42 investigates Sniper Dz, a free phishing-as-a-service (PhaaS) platform that has produced over 140,000 phishing pages in the past year; the platform offers hosted phishing pages and downloadable templates, hides backend servers behind a public proxy to evade detection, obfuscates code, centrally exfiltrates credentials to domains it controls, tracks victims with embedded scripts, abuses legitimate SaaS hosting (e.g., Blogspot), and redirects victims to malicious ads and PUPs — the report includes IOCs, screenshots of the admin panel and examples of affected URLs.