blade-govern.sbs
Classification: Suspicious
blade-govern.sbs is a suspicious hostname. Linked to Lumma Stealer malware. Reported by 2 threat sources, last seen 2025-07-04.
Current activity
- Offline — no longer resolving. Last online 2025-10-09 14:16:49.
- Command & Control server — Used by cybercriminals to control victim computers.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: LUMMA STEALER (S1213)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Lumma stealer | Maltiverse Threat Observatory | 2024-11-26 15:10:05 | 2025-07-04 14:10:07 | country_code:br industry:education-and-nonprofits | S1213 Lumma Stealer |
| Lumma Stealer | ThreatFox Abuse.ch | 2024-11-26 14:17:11 | 2025-01-08 21:20:29 | malicious-activity | S1213 Lumma Stealer |
Tags
lumma lummac2 stealer c2 domain virustotalIP addresses resolved by this hostname
- 172.64.80.1 (2024-11-26 14:17:13)
Whois information
- AS name
- AS13335 Cloudflare, Inc.
- Domain
- blade-govern.sbs
- TLD
- sbs
- City
- San Francisco
- State
- CA
- Country
- US — United States 🇺🇸
- First indexed
- 2024-11-26 14:17:11
- Last updated
- 2025-12-02 16:12:15