The LabHost cybercrime platform, one of the biggest worldwide phishing-as-a-service (PhaaS) platforms, was shut down in April 2024, but the FBI has disclosed 42,000 phishing domains associated with it.
In order to raise awareness and offer signs of compromise, the published domains—which were registered between November 2021 and April 2024, when they were seized—are being shared.
Operations and removal of LabHost
LabHost is a significant PhaaS platform that sells access to a large number of phishing kits aimed at US and Canadian banks for $179 to $300 per month.
It featured numerous customisation options, innovative 2FA bypass mechanisms, automatic SMS-based interactions with victims, and a real-time campaign management panel. Despite its launch in 2021, LabHost became a major player in the PhaaS market in late 2023/early 2024, surpassing established competitors in popularity and attack volume.
It is estimated that LabHost stole over 1,000,000 user credentials and over 500,000 credit card details. In April 2024, a global law enforcement campaign supported by investigations in 19 nations resulted in the shutdown of the platform, which had 10,000 customers at the time.
During the simultaneous searches of 70 residences, 37 people suspected of having links to LabHost were arrested. Although the LabHost operation is no longer active, and the shared 42,000 domains are unlikely to be used in malicious operations, the information remains valuable to cybersecurity firms and defenders. First, the domain list can be used to generate a blocklist, reducing the likelihood of attackers recycling or re-registering any of them in future attacks.
The list can also be used by security teams to search logs from November 2021 to April 2024 in order to detect earlier connections to these domains and find previously unknown breaches. Finally, the list can assist cybersecurity experts in analysing domain patterns in PhaaS systems, improving attribution and intelligence correlation, and providing realistic data for phishing detection model training. The list is shared with the warning that it has not been vetted and may contain errors.
"FBI has not validated every domain name, and the list may contain typographical or similar errors from LabHost user input," notes the FBI ."The information is historical in nature, and the domains may not currently be malicious. The FBI also noted that investigation of this list may show additional domains tied to the same infrastructure, therefore the list may not be exhaustive."
