Shining the DNS Spotlight on Lumma Stealer

On 19 May 2025, the U.S. Department of Justice seized 114 domains connected to a major information-stealing campaign utilizing Lumma Stealer.¹ The Cybersecurity and Infrastructure Security Agency (CISA) published the list of indicators of compromise (IoCs) on the same date.²

WhoisXML API analyzed the IoCs in great depth to uncover more artifacts and other information. Take a look at a summary of our findings below.

• 28 domain IoCs found on First Watch on an average of 97 days prior to the disclosure date—19 May 2025
• 1–16 VirusTotal engines that classified the eight additional .digital look-alike domains found on First Watch as malicious
• 265 unique domain-to-IP resolutions
• 68 unique IP addresses resolving the domain IoCs before 19 May 2025, 62 were malicious
• Five unique IP addresses actively resolving the domain IoCs, four were malicious
• 187 IP-connected domains
• 346 string-connected domains, one was malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation
• [2] https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b