Algerian man arrested, extradited to the United States for his role in black market fraud conspiracy that targeted thousands of victims

BUFFALO, N.Y.-U.S. Attorney Michael DiGiacomo announced today that Abdellah Belmili, a/k/a Dila Belmili, a/k/a SPOX, 26, a citizen of Algeria, was arrested and charged by criminal complaint with conspiracy to commit bank fraud, which carries a maximum penalty of 30 years in prison. 

“This defendant thought that he could get away with defrauding thousands of victims out of hundreds of thousands of dollars by using fake names and hiding behind a keyboard to steal bank account and credit card numbers,” stated U.S. Attorney DiGiacomo. “This arrest makes clear that, regardless of where you operate, our law enforcement partners will find you – and when they do, you will face the full consequences of your actions.” 

“Cybercriminals often believe they can hide behind usernames and encrypted platforms. This arrest proves otherwise,” said Brendan Dunford, Acting Special Agent-in- Charge of the FBI Buffalo Field Office. “The FBI identified the individual behind this alleged cyber fraud scheme, followed the evidence across international borders, secured his extradition, and brought him to the United States to face justice. 

According to the criminal complaint, in September 2020, FBI Buffalo became aware of a nefarious online marketplace www.market0day.com, run by an administrator using the name “SPOX,” a cyber actor known for creating “phishing kits” that have been used to compromise major U.S. financial institutions. SPOX was later identified as Belmili. Between September and November 2020, Belmili advertised the marketplace and facilitated some of the customer support for the marketplace on his personal Telegram channel @SpoxCoder. Cyber actors typically open marketplaces on the internet to facilitate the anonymous selling and purchasing of illicit goods and services, operating similarly to Amazon or eBay. However, unlike legitimate websites, these websites sell illegally acquired online banking information, stolen credit card information, victim computer login information, malware tools, and other nefarious goods and services, requiring all transactions to be paid for through the use of bitcoins.

In December 2020, investigators conducted controlled purchases from www.market0day.com:

• Investigators purchased a JP Morgan Chase phishing kit, which was successfully downloaded after purchase. 
• Investigators successfully purchased a Simple Mail Transfer Protocol (SMTP), which typically includes a mail server’s IP Address, username (email), and password, allowing the purchaser to access the user’s email messages.
• Investigators also purchased a Cpanel, which allows website owners to manage and publish on their websites. Compromised cpanel access would allow the purchaser to access and alter the compromised website. The cpanel was never sent to investigators. 

In late December 2020, after several customers complained that they had not received their purchases from www.market0day.com, Belmili replied that he was no longer the administrator, and instead had opened up a new marketplace – www.spoxy.us,  advertising the new marketplace as a “new store for bulk sms.” “Bulk sms” typically refers to sending phishing or other fraudulent messages via text message.

During the course of the conspiracy, Belmili is accused of defrauding multiple institutions, including American Express, Bank of America, JP Morgan Chase, and Wells Fargo, as well as financial institutions in the United Kingdom. Between January 2020 and January 2023, approximately $900,000 was deposited into an account controlled by Belmili. The investigation has also identified approximately 5,600 U.S. and international victims. 

Belmili made an initial appearance this afternoon before U.S. Magistrate Judge H. Kenneth Schroeder, Jr. and was detained.

The case is being prosecuted by Assistant U.S. Attorney Charles M. Kruly. The complaint is the culmination of an investigation by the Federal Bureau of Investigation, under the direction of Acting Special Agent-in-Charge Brendan Dunford. The Justice Department’s Office of International Affairs provided valuable assistance with securing the arrest and June 18 extradition from Spain of Belmili to the United States.        

The fact that a defendant has been charged with a crime is merely an accusation and the defendant is presumed innocent until and unless proven guilty.

# # # #