An international law enforcement investigation has dismantled the iSpoof spoofing service, which led to the arrest of 146 people, including its alleged ringleader. Based on reports, most of the arrested individuals, including its head, were executed by London’s Metropolitan Police agency.
Its operators offered the online spoofing service to cybercriminal groups that allowed them to hide their phone numbers and replace them with a spoofed number owned by a trusted organisation.
This ability has enabled a cybercriminal campaign to impersonate a bank and calls a potential victim. Moreover, this number spoofing feature allowed miscreants to run phishing campaigns, social engineering tactics, and banking scams. Hence, the attackers could steal money, MFA codes, and bank account credentials.
According to the initial report from the police, the iSpoof entity has made approximately 10 million fraudulent calls for hackers globally. In addition, the service has caused an estimated $120,000,000 in losses and profited from nearly $4 million in the last one and a half years of operation.
The iSpoof spoofing service was found by authorities in a small town.
A Dutch police report explained that their forces found the servers that hosted the iSpoof spoofing service in a small town near Amsterdam. The authorities have identified the location during their ongoing investigation of a bank helpdesk fraud issue.
This enabled law enforcement to execute a new investigation focusing on the spoofing service, which resulted in the discovery of the iSpoof operator’s whereabouts in London.
Subsequently, the partnered police force in the Netherlands placed a tap on the servers of iSpoof located in the small town and collected information about how the service operated and who managed it.
Therefore, the owner of the spoofing service was arrested earlier this month in East London, and the authorities have taken down the iSpoof websites called ispoof[.]me and ispoof[.]cc.
In addition, the authorities also arrested two administrators in a small town near Amsterdam. The two men were of legal age, as one was 19 and the other was 22.
Lastly, the service’s users from dark web hacking forums have been advised by the authorities to wrap things up after the iSpoof’s dismantling since they might follow the owner of the spoofing service in jail.
