A Melbourne man has been ordered to pay $34,990 in compensation for his involvement in a phishing scam that affected multiple victims.

The 21-year-old, who had used the now-defunct LabHost platform, pleaded guilty to seven charges earlier this week, including the unlawful acquisition of personal information.

At his sentencing on March 7, 2025, in the Melbourne Magistrates’ Court, he was also given an 18-month community corrections order, which includes 200 hours of community service.

In addition, he received a three-month prison sentence, to be served under a Recognisance Release Order on good behavior.

LabHost, described by investigators as a platform used by cybercriminals, was marketed as a tool for setting up phishing schemes. These scams involve tricking individuals into providing sensitive data, such as banking credentials and personal information, through fraudulent emails or websites.

The platform enabled the creation of over 170 fake websites, impersonating well-known institutions, including banks and government services. This led to numerous victims unknowingly sharing their personal details.

The global operation, led by the Australian Federal Police (AFP) and the Joint Policing Cyber Crime Coordination Centre (JPC3), resulted in the seizure of over 200 criminal servers and multiple arrests across five states.

The Melbourne man used information obtained from 11 victims to steal $34,990 from two individuals. Authorities also found additional personal data, including Medicare and credit card information, on an encrypted messaging platform during the investigation.

The man pleaded guilty to:

• One count of possessing identification information, contrary to section 192C of the Crimes Act 1958 (Vic);
  
  
• One count of using identification information to commit indictable offence, contrary to section 192B of the Crimes Act 1958 (Vic);
  
  
• One count of dishonestly obtain or deal with personal financial information belonging to another without their consent, contrary to section 480.4 of the Criminal Code (Cth);
  
  
• One count of attempting to obtain a financial advantage by deception, contrary to sections 82 and 321M of the Crimes Act 1958 (Vic);
  
  
• One count of obtaining a financial advantage by deception, contrary to section 82 of the Crimes Act 1958 (Vic);
  
  
• One count of refusing to comply with a 3LA order, contrary to section 3LA(6) of the Criminal Code (Cth).

According to AFP Detective Acting Inspector Kris Wilson the takedown of LabHost was a reminder of the impact a united, global law enforcement front could achieve.

“The AFP has proven experience in working side-by-side with our international and domestic law enforcement partners to take the fight to any type of criminal, or cybercriminal, who targets Australians,” Det a/Insp Wilson said.

“Cybercriminals will use any tools and tricks to exploit people for their own profit – in this case, it is mimicking trusted websites to swindle a significant sum of money.

“We urge Australians to be wary of phishing scams and ‘think before they click’ – take your time when reading text messages and emails, look out for strange letters or symbols in hyperlinks and avoid any deal that seems too good to be true.”

The court ordered compensation is paid to the Victorian State Government victims of crime fund.