Indicators of Compromise

URL

TLP:CLEAR

https://ntds.shop/jsrepo

ThreatFox: Lumma Stealer

85% confidence

Added

2026-08-11

Domain

TLP:CLEAR

ntds.shop

ThreatFox: Lumma Stealer

85% confidence

Added

2026-08-11

Domain

TLP:CLEAR

idealvs.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

answebi.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

clamsal.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

pholith.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

mistjlep.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

maenade.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

cudbweeo.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

hustjonr.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

wifflvy.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

diplokb.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

consuus.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

wilheah.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-28

URL

TLP:CLEAR

https://tangmwp.club/blank

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-28

URL

TLP:CLEAR

https://diplokb.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://pantofr.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-21

SHA-1 Hash

TLP:CLEAR

7e6d9dac619c04ae1b3c8c0906123e752ed66d63

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

Domain

TLP:CLEAR

signspace.cloud

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1cc

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

SHA-1 Hash

TLP:CLEAR

dc0acb01e3086ea8a9cb144a5f97810d291020ce

Exposing Fox Tempest: A malware-signing service operation

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

https://brownhc.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-20

URL

TLP:CLEAR

https://diospfj.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-14

URL

TLP:CLEAR

https://milnleny.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

straigxo.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-10

Domain

TLP:CLEAR

honceybl.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

bahaisda.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-10

Domain

TLP:CLEAR

mexzicaj.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

privahtc.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-10

Domain

TLP:CLEAR

brakyfaw.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-10

Domain

TLP:CLEAR

fourdigs.cyou

ThreatFox: Lumma Stealer

85% confidence

Added

2026-05-10

Domain

TLP:CLEAR

carytui.vu

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

genxetia.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

heavywbp.cyou

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

Domain

TLP:CLEAR

pomflgf.vu

ThreatFox: Lumma Stealer

65% confidence

Added

2026-05-10

IPv4 Address

TLP:CLEAR

45.151.106.110

Malware Bypasses Browser Application-Bound Encryption Protections

75% confidence

Added

2026-05-10

IPv4 Address

TLP:CLEAR

217.156.122.12

Malware Bypasses Browser Application-Bound Encryption Protections

75% confidence

Added

2026-05-10

IPv4 Address

TLP:CLEAR

217.156.122.75

Malware Bypasses Browser Application-Bound Encryption Protections

75% confidence

Added

2026-05-10

IPv4 Address

TLP:CLEAR

217.156.122.57

Malware Bypasses Browser Application-Bound Encryption Protections

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

zadno.run

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

siltsoh.biz

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

woodena.biz

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

texakgi.cloud

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

buccstanor.pics

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

backbou.biz

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

URL

TLP:CLEAR

http://zadno.run:4219

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

cheekiez.biz

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

adveryx.biz

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

75% confidence

Added

2026-05-10