A DNS Deep Dive into the LabHost PhaaS Infrastructure

The Federal Bureau of Investigation (FBI) warned the public about the LabHost phishing-as-a-service (PhaaS) campaign that threatened the security of users worldwide.¹ They published a massive list of related indicators of compromise (IoCs) that WhoisXML API analyzed in depth through a DNS deep dive.

The FBI identified 42,515 LabHost PhaaS campaign IoCs.² We analyzed 42,401 domains after excluding duplicates and non-domain entries. To these, we added 1,661 net new typosquatting domains akin to the IoCs on the FBI list. Our investigation of the joint list of 44,062 domains led to these findings and enrichments:

• 18 well-known brands appearing in the net new typosquatting domains, all of which were also found on the FBI list
• 11,009 unique client IP addresses querying 163 domains through a total of 74,617 DNS requests based on Internet Abuse Signal Collective (IASC) DNS traffic data
• 3,319 domains in First Watch Malicious Domains Data Feed with creation dates averaging 419 days prior to the FBI warning date
• 61,727 subdomains with common strings including www, mail, webmail, cpanel, webdisk, and smtp
• 1,346 unique IP resolutions of the 44,062 domains, 1,055 of which were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.ic3.gov/CSA/2025/250429.pdf
• [2] https://www.bleepingcomputer.com/news/security/fbi-shares-massive-list-of-42-000-labhost-phishing-domains/