WHERE IT STARTED
FIRST SEEN: 1990s (AOL phishing); kit industry c. 2017 · GOING FOR: About 30 years; phishing-as-a-service about 9 years
Fake login pages began with AOL phishing in the mid-1990s; the kit industry began with 16shop in Indonesia in 2017, and LabHost, created in Britain in 2021, became the largest before its 2024 takedown.
Fake login pages date to the 1990s AOL 'phishing' era, but cloning whole bank, courier and government sites became an industry with 'phishing-as-a-service' kits: 16shop (from 2017, Indonesia) sold Apple and Amazon clones for $60-150, and LabHost (2021-2024, UK) let 10,000 subscribers spin up bank clones that also captured one-time passcodes. Investment 'clone firms' copy a real regulated company's name and FCA number. Law enforcement took down 16shop in August 2023 and LabHost in April 2024, arresting 37 people across 19 countries.
HOW IT WORKS
A criminal buys or rents a kit that replicates a bank, delivery firm, tax office or brand site, hosts it on a look-alike domain and drives traffic by SMS ('your parcel is held'), email or search ads. Victims enter card details, passwords and, on the better kits, the two-factor code, which the operator relays in real time to log in to the real account. Clone investment sites take deposits directly. Kits handle hosting, templates and victim data dashboards, so the operator needs no technical skill.
Link from an SMS or email rather than typing the address yourselfDomain slightly wrong (extra letter, .co instead of .com, hyphens)Site asks for full card number, PIN and one-time passcode togetherInvestment firm's contact details differ from those on the regulator's registerPadlock present but certificate issued days ago to an unrelated name
HOW USEFUL IT IS TO CRIMINALS
A subscription of a few hundred dollars a month bought a working bank clone with passcode capture, so no coding was needed; LabHost had 10,000 users and 16shop 70,000. Victim losses are folded into phishing and card-fraud totals, and while the platforms' operators were arrested, only a small share of subscribers have been charged.
THE DAMAGE IT HAS CAUSED
500,000
Card records stolen via LabHost clone sites (largest platform; no dollar total published) — Metropolitan Police via Infosecurity Magazine, Apr 2025
No body publishes a loss total for clone sites; the scale is measured in stolen data - LabHost took 500,000 card numbers and a million passwords, and 16shop generated more than 150,000 phishing domains. The FBI's IC3 attributes billions in annual losses to phishing generally. Victims also suffer account takeovers that cascade into further fraud.
40,000+ Phishing domains linked to LabHost, used by about 10,000 subscribers (Europol / Metropolitan Police, Apr 2024)
70,000 Users of 16shop across 43 countries (Interpol, Aug 2023)
500,000 Credit card records stolen through LabHost sites (Infosecurity Magazine, Apr 2025)
WHO USES IT MOST
MOST OF ALL: 🇬🇧 United Kingdom ▸
LabHost, the largest platform yet dismantled, was built and run from Britain, and the Metropolitan Police led the 19-country takedown and secured the 8.5-year sentence (Infosecurity Magazine, Apr 2025).
United Kingdom (LabHost creator and Met-led takedown)Indonesia (16shop administrator)United States (FBI published 42,000 LabHost domains)Canada (87 LabHost users arrested)Japan (16shop arrest)
GOVERNMENTS LINKED TO IT
No government is documented as using this method.
NOTABLE PEOPLE WHO USED IT — RANKED BY PROFILE ORDER (NOT BY AMOUNT)
#1 Zak Coyne CONVICTEDREPORT PENDING
500,000 cards and 1M passwords stolen · 2021-2024
British creator of LabHost, one of the world's largest phishing-as-a-service platforms, used by about 10,000 subscribers to clone over 200 brands and harvest 500,000 card numbers and a million passwords; sentenced to 8.5 years in Manchester.
SOURCE: Infosecurity Magazine, 14 Apr 2025; Metropolitan Police
#2 16shop (phishing-as-a-service platform) DISMANTLED; ADMINISTRATOR ARRESTEDREPORT PENDING
150,000+ phishing domains created · 2017-2023
Indonesian kit operation active since 2017 that sold Apple, PayPal and Amazon clone pages to 70,000 users in 43 countries; its 21-year-old administrator and two others were arrested in an Interpol-led operation.
SOURCE: Interpol, Aug 2023; The Record; Group-IB
#3 LabHost user network (37 arrested) CHARGEDREPORT PENDING
Not published · 2024
Subscribers of LabHost arrested in simultaneous raids in 19 countries in April 2024; Canadian police later arrested 87 more, and the FBI published 42,000 of its domains.
SOURCE: Europol, Apr 2024; BleepingComputer; Infosecurity Magazine
SOURCES
Infosecurity Magazine, 'LabHost Phishing Mastermind Sentenced to 8.5 Years', 14 Apr 2025
BleepingComputer, 'LabHost phishing service with 40,000 domains disrupted, 37 arrested', Apr 2024
Europol, LabHost takedown announcement, Apr 2024
Interpol, 'Notorious phishing platform shut down, arrests in international police operation', Aug 2023
The Record, 'Interpol takes down phishing-as-a-service platform used by 70,000 people'
Group-IB, 16shop press release, 2023
Infosecurity Magazine, 'FBI Publishes 42,000 LabHost Phishing Domains'