declaredczxi.shop
Classification: Suspicious
declaredczxi.shop is a suspicious hostname. Linked to Lumma Stealer malware. Reported by 2 threat sources, last seen 2026-05-11.
Current activity
- Online — resolving/reachable. Last checked 2026-07-14 02:50:56.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: LUMMA STEALER (S1213)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Malicious behavior | Maltiverse Threat Observatory | 2026-05-11 00:00:20 | 2026-05-11 00:00:20 | country_code:ec industry:financial-services | |
| Lumma Stealer | ThreatFox Abuse.ch | 2024-07-12 06:18:39 | 2024-11-10 19:19:28 | malicious-activity | S1213 Lumma Stealer |
Tags
lumma lummac2 stealer lummastealer phishingIP addresses resolved by this hostname
- 172.64.80.1 (2024-08-01 08:45:28)
- 2600:1900:4001:96e:8000:1:6a83:c881 (2026-07-14 02:50:56)
- 34.41.139.193 (2026-07-14 02:50:56)
Whois information
- Domain
- declaredczxi.shop
- TLD
- shop
- First indexed
- 2024-07-12 06:18:39
- Last updated
- 2026-07-14 02:50:57