Typosquatting by the Thousands: What LabHost Taught Us About DNS Blind Spots

When the FBI issued its FLASH alert on April 29, 2025, it revealed a massive phishing-as-a-service (PhaaS) campaign known as LabHost. Before being dismantled by law enforcement in April 2024, LabHost had quietly enabled cybercriminals to spoof over 200 trusted organizations, including major banks, retailers, and government entities. But perhaps the most alarming detail was this: LabHost users created over 1,600 typosquatting domains designed to mimic trusted brands like Amazon, Netflix, Chase, and Apple.

These were not just a few careless lookalike URLs. The campaign had global reach, long dwell time, and deep technical support for adversaries. According to research, out of 44,062 phishing-related domains linked to LabHost, 342 were tied to major brand impersonation, many of them relying on subtle typos to deceive unsuspecting users.

This isn’t just a cautionary tale. It’s a wake-up call for organizations who overlook their DNS security posture, because what you can’t see can hurt you.

Typosquatting: Low Effort, High Reward Phishing

Typosquatting is the registration of domains that appear visually or phonetically similar to legitimate brands. Think netfIix-support.com (with an uppercase “i” replacing “l”) or amazon-prime-login.net.

These deceptive domains are often:

• Used in phishing emails or smishing attacks
• Embedded in adversary-in-the-middle (AiTM) kits
• Parked to quietly harvest credentials or serve malware

What makes them effective is that they often bypass casual user scrutiny and even basic security filters, especially when newly registered.

Inside the LabHost Domain Infrastructure

The FBI identified 42,515 indicators of compromise (IoCs) from the LabHost takedown. A forensic DNS analysis by WhoisXML filtered this to 42,401 unique domains, then augmented it with 1,661 additional typosquatting domains from a proprietary data feed.

The findings were sobering:

• 342 typosquatting domains contained strings mimicking 18 major brands, including Canada Post, Royal Mail, Shopify, DHL, and Westpac.
• These domains were registered across 27 countries, with the U.S., Iceland, Hungary, and Canada leading.
• Creation dates spanned over a decade—with many registered long before any takedown, and some sitting unnoticed for 813 days prior to the FBI’s warning.
• A total of 1,346 unique IP resolutions were recorded for these domains, many hosted on infrastructure known for abuse.

The pattern was clear: these domains were not one-offs. They were weaponized assets sitting quietly within the DNS ecosystem, poised to exploit trust and familiarity.

The DNS Visibility Gap

While most cybersecurity programs focus on endpoint protection, email security, or firewall configurations, DNS often remains a blind spot. Organizations tend to monitor their own domains, but fail to track:

• Similar-looking external domains
• Malicious subdomain patterns (e.g., mail-login.amazonverify.com)
• Active resolutions to known phishing infrastructure

This is what made LabHost so effective. It leveraged the inertia of traditional detection methods, operating under the radar by abusing DNS blind spots. By the time a domain hit a blocklist, the damage was often already done.

Why Brand Typosquatting Should Concern Every Organization

It’s easy to assume only tech giants or banks are targets of typosquatting. But LabHost’s reach proves otherwise. The impersonated brands weren’t just financial institutions—they included logistics companies, e-commerce platforms, and public service providers.

Even mid-sized companies are at risk:

• Your employees might get tricked by internal lookalikes (intranet-yourbrand.com)
• Your customers might click on phishing links mimicking your support portal
• Your partners might receive spoofed invoices from fake supplier subdomains

The reputational and financial impact of such impersonation can be devastating—especially if it leads to credential theft, invoice fraud, or data exfiltration.

DNS Posture Management (DNSPM) from CheckRed: A Proactive Defense

This is where CheckRed’s DNSPM becomes critical. Rather than reacting to known bad domains, DNSPM offers real-time DNS threat intelligence, helping organizations surface potential abuse early in the kill chain.

Key capabilities include:

• Typosquatting detection: Actively monitors for lookalike domains based on brand-specific string patterns.
• Subdomain surveillance: Tracks suspicious subdomain registrations (e.g., ftp-login.yourcompany.net).
• DNS traffic correlation: Maps domain resolution history to uncover dormant or staged threats.
• DNS risk scoring: Assigns a contextual threat level based on WHOIS anomalies, passive DNS, hosting patterns, and geolocation.
• Response orchestration: Offers remediation to block, isolate, or escalate suspicious DNS assets.

In the case of a campaign like LabHost, DNSPM would not only highlight known indicators but also surface related infrastructure, giving defenders a head start instead of a post-mortem.

From Reactive to Preventive: What You Can Do Now

If your security team isn’t already monitoring for typosquatting, now is the time to act. Start by asking:

• Do we have visibility into domains that mimic our brand or services?
• Are we monitoring DNS queries that reach suspicious or recently registered domains?
• Do we have a system that can correlate DNS records with threat feeds, subdomain activity, and IP resolutions?

If the answer is no, your organization may be just as vulnerable as the thousands of entities LabHost impersonated. Only, you won’t know until it’s too late.

Final Thoughts

The LabHost takedown revealed more than a criminal network—it exposed how underprotected DNS still is for most enterprises. Typosquatting might seem minor, but at scale, it’s a gateway for phishing, fraud, and full-blown breaches.

With CheckRed DNSPM, your team can stop chasing threats and start preventing them. Get real-time visibility. Respond with confidence. Protect your brand before attackers can weaponize your DNS.

Learn more about DNSPM and secure your DNS infrastructure today.