Abdellah Belmili, 26, an Algerian national, has been arrested and extradited to the United States to face federal charges related to operating an online cybercrime marketplace. Belmili, also known as “Dila Belmili” and “SPOX,” has been charged by criminal complaint with conspiracy to commit bank fraud, an offense carrying a maximum penalty of 30 years in prison.
According to authorities, Belmili allegedly administered and promoted the Market0Day platform, which sold illicit goods and services, including stolen banking credentials, compromised credit card information, malware tools, and victim login data. The marketplace reportedly operated using cryptocurrency payments and catered to cybercriminals seeking to conduct fraud and phishing schemes.
The FBI's Buffalo Field Office began investigating the operation in September 2020 after identifying “SPOX” as a cyber actor linked to the development of phishing kits used to compromise major US financial institutions. Prosecutors allege Belmili promoted the marketplace and provided customer support through his Telegram channel.
After complaints surfaced from customers who claimed they had not received purchases from Market0Day, Belmili allegedly launched a second marketplace called ‘Spoxy.us,’ advertising it as a platform for “bulk SMS” services commonly associated with phishing and fraudulent text-message campaigns.
Federal authorities say Belmili and his co-conspirators defrauded numerous financial institutions, including American Express, Bank of America, JPMorgan Chase, Wells Fargo, and several banks in the United Kingdom. Police identified approximately 5,600 victims in the United States and abroad and determined that roughly $900,000 was deposited into an account controlled by Belmili between January 2020 and January 2023.
In a separate case, US authorities have seized a cloud computing account used by subsidiaries of the Cambodia-based Huione Group, which allegedly helped criminals launder proceeds from cryptocurrency investment fraud, data theft, cyber scams, human trafficking recruitment, and other illicit activities.
The platform also provided escrow services that enabled criminals to safely conduct illicit transactions. Police have repeatedly traced fraud proceeds to cryptocurrency addresses linked to the Huione Group, where funds were further laundered.