co-labs[.]space

This domain, co-labs.space, is identified as a generic phishing infrastructure designed to serve malicious payloads under the guise of legitimate web content. The page title 'Just a moment...' suggests the use of an interstitial or redirect mechanism, commonly employed to evade automated detection systems while delivering credential harvesters, crypto drainers, or other malicious scripts to unsuspecting visitors. The domain’s infrastructure leverages Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obscure its true origin and complicate forensic analysis. Such tactics are frequently observed in phishing campaigns targeting financial institutions, cryptocurrency platforms, or corporate login portals, where rapid takedowns necessitate the use of resilient hosting and CDN services. Analysis of co-labs.space reveals multiple indicators of malicious activity. The domain is flagged by 6 out of 95 security vendors on VirusTotal, with detections spanning categories such as phishing, malicious URL, and suspicious behavior. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-volume domain registrations used in phishing and malware distribution. The domain was created on March 30, 2026, indicating a likely short lifespan typical of disposable phishing infrastructure. Additionally, it appears on one security blocklist and is currently blocked by PhishDestroy. The domain resolves to the IP address 188.114.96.3, a Cloudflare-operated endpoint, further corroborating the use of CDN services to mask its true hosting environment. Gridinsoft assigns the domain a trust score of 0/100, reflecting its high-risk classification. Users who have visited co-labs.space should take immediate action to mitigate potential compromise. If any credentials, financial information, or cryptocurrency wallet details were entered on the site, affected accounts should be secured by changing passwords, enabling multi-factor authentication, and monitoring for unauthorized transactions. Browser sessions should be cleared, including cookies and cached data, to remove any residual tracking or session hijacking risks. System scans using updated security tools are recommended to detect and remove any malware downloaded from the domain. Network-level protections, such as DNS filtering or endpoint detection and response (EDR) solutions, should be implemented to block future connections to this domain or related infrastructure. Given the domain’s use of Cloudflare and its offline status, further monitoring of associated IPs or certificate fingerprints may be necessary to identify related threats.