FBI shares massive list of 42,000 LabHost phishing domains

The FBI published a historical list of 42,000 domains associated with LabHost, a major phishing-as-a-service platform dismantled in April 2024; LabHost provided sophisticated, customizable phishing kits (including 2FA bypass and automated SMS interactions), is estimated to have stolen ~1,000,000 credentials and ~500,000 payment card records, and had roughly 10,000 customers before takedown. The domain list is shared to enable blocklisting, retrospective detection, and threat analysis, but the FBI warns the list has not been fully validated and is historical in nature.