lev-tolstoi.com
Classification: Malicious
lev-tolstoi.com is a malicious hostname. Linked to Lumma Stealer malware. 998 sightings from ThreatFox Abuse.ch and Threat Observatory, last seen 2025-07-08.
Current activity
- Online — resolving/reachable. Last checked 2026-11-07 04:37:04.
- Command & Control server — Used by cybercriminals to control victim computers.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: LUMMA STEALER (S1213)
Where it has been seen
Observed by Maltiverse Threat Observatory sensors in GT and US, across education, financial services and government networks.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Lumma stealer | Maltiverse Threat Observatory | 2024-12-19 19:30:03 | 2025-07-08 21:40:06 | country_code:gt country_code:us industry:education-and-nonprofits industry:financial-services industry:government-and-public-sector | S1213 Lumma Stealer |
| Lumma Stealer | ThreatFox Abuse.ch | 2024-12-22 22:59:33 | 2025-01-20 10:22:06 | malicious-activity | S1213 Lumma Stealer |
Tags
c2 domain lumma stealer lummac2 stealer lummastealerIP addresses resolved by this hostname
- 172.64.80.1 (2025-01-04 00:42:25)
- 3.213.253.185 (2026-11-07 04:37:04)
Whois information
- Domain
- lev-tolstoi.com
- TLD
- com
- DNSSEC
- ['unsigned']
- Nameservers
- CANDY.NS.CLOUDFLARE.COM, ROBERT.NS.CLOUDFLARE.COM
- Registrant
- WEBCC
- Address
- L4-E-2, Level 4, Enterprise 4, Technology Park Malaysia, Bukit Jalil
- City
- Kuala Lumpur
- State
- Wilayah Persekutuan
- Contact email
- [email protected], [email protected], [email protected], [email protected]
- Domain created
- 2024-12-11 14:47:34
- Domain expires
- 2025-12-11 14:47:34
- First indexed
- 2024-12-22 23:17:03
- Last updated
- 2026-11-07 04:37:04