News report

# Lumma Stealer operators register replacement domains within a day of seizure

Aggregated security reporting, May 22, 2025. Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized..

**Source type:** News report

**Published:** May 22, 2025

**Research grade:** S1

**Used in entries:** 1

## Bibliographic record

**Publisher:** Aggregated security reporting

**Published:** May 22, 2025

**Source type:** News report

**Research grade:** Source grade S1

**Language:** English

**Official record:** Not an official publication

**Address:** No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

**What it supports:** Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized.

**Dataset id:** src\_doj\_lumma\_rebound\_2025

## Research notes

- Not independently re-verified in this pass.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[Lumma replacement domains (3 domains, seized same wave)](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Same operators, Lumma Stealer disruption

Supporting source

[All sources](https://takedownindex.org/sources)