The FBI has shared 42,000 phishing domains tied to the LabHost cybercrime platform, one of the largest global phishing-as-a-service (PhaaS) platforms that was dismantled in April 2024. The list can also be used by security teams to retrospectively scan logs from November 2021 to April 2024 to detect past connections to these domains and identify previously undetected breaches. Ultimately, the list can help cybersecurity professionals analyze domain patterns in PhaaS platforms, aid attribution and intelligence correlation, and provide realistic data for phishing detection model training. The published domains were registered between November 2021 and April 2024, the time of its seizure, and are being shared to increase awareness and provide indicators of compromise. Though it launched in 2021, it was in late 2023/early 2024 when LabHost turned into one of the major players in the PhaaS market, having surpassed established entities in popularity and attack volume. LabHost was a major PhaaS platform that sold access to an extensive set of phishing kits targeting U.S. and Canadian banks for between $179 and $300 per month. "FBI has not validated every domain name, and the list may contain typographical or similar errors from LabHost user input," explains the FBI. Although the LabHost operation is no longer active and the shared 42,000 domains are not likely currently used in malicious operations, there's still significant value for cybersecurity firms and defenders. In April 2024, a global law enforcement operation backed by investigations in 19 countries led to the dismantling of the platform, which at the time had 10,000 customers worldwide. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. First, the domain list can be used to create a blocklist to mitigate the risk of threat actors recycling or re-registering any of them in future attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 30 Apr 2025 16:05:16 +0000