photonlab[.]st

PhishDestroy identifies photonlab.st as an active fake login phishing domain with an elevated risk level. This domain is designed to mimic a legitimate service, likely targeting users with deceptive login forms to harvest credentials. The threat is currently active and poses a significant risk to unsuspecting visitors. Security researchers and everyday users should treat this domain with extreme caution and avoid interacting with it.

This domain was flagged by 1 of 95 VirusTotal vendors, indicating limited but confirmed malicious activity. Registered through Gandi, photonlab.st was created on March 10, 2026, and resolves to IP 172.67.151.115. The domain holds an SSL certificate issued by Let's Encrypt, which may lend it a false sense of legitimacy. Despite its recent creation, the blocklist count and trust scores remain critically low, further corroborating its malicious nature. The combination of a fresh domain, low vendor detection, and active status underscores the urgency of proactive avoidance.

The current status of photonlab.st is active, with no signs of takedown or remediation. Users should immediately block this domain on their network and devices to prevent accidental exposure. PhishDestroy strongly recommends verifying any interactions with this domain through its threat intelligence platform before proceeding. Additionally, users who may have already entered credentials on this site should change their passwords immediately and enable multi-factor authentication where possible. Security teams should monitor this IP (172.67.151.115) and domain for further malicious activity, as the threat actor behind this campaign may attempt to expand their infrastructure.