Skip to main content

News report

Lumma Stealer operators register replacement domains within a day of seizure

Aggregated security reporting, May 22, 2025. Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized..

Source type
News report
Published
May 22, 2025
Research grade
S1
Used in entries
1

Bibliographic record

Publisher
Aggregated security reporting
Published
May 22, 2025
Source type
News report
Research grade
Source grade S1
Language
English
Official record
Not an official publication
Address
No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.
What it supports
Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized.
Dataset id
src_doj_lumma_rebound_2025

Research notes

  • Not independently re-verified in this pass.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

1 citation

Cited for activity recorded after the takedown.

All sources