> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IOC Alert: Lumma Stealer C2 Domain Identified – larpfxs[.]top
- URL: https://darkwebinformer.com/ioc-alert-lumma-stealer-c2-domain-identified-larpfxs-top/
- Published: 2025-08-31T22:33:52.000Z
- Updated: 2025-09-04T22:19:41.000Z
- Author: Dark Web Informer
- Tags: IOC

📖 **Overview**  
A domain-based indicator has been identified linked to command-and-control infrastructure for **Lumma Stealer**. The domain, presenting a Russian-language login portal, is confirmed with high confidence as part of active Lumma C2 operations.

---

📌 **Key Details**

| Field           | Information                |
| --------------- | -------------------------- |
| **Type**        | Domain                     |
| **Indicator**   | larpfxs\[.\]top            |
| **Threat Type** | Botnet C2                  |
| **Malware**     | win.lumma                  |
| **Confidence**  | 100%                       |
| **Date**        | 31 Aug 2025 – 20:26:53 UTC |
| **Tags**        | c2, domain, Lumma, stealer |
| **Reporter**    | DonPasci                   |

---

🔎 **URLScan Result**  
Page Title: Вход  
Screenshot: <https://urlscan.io/screenshots/0198fd5b-0763-7058-8bf4-5a8a755b9cfe.png>  
Result: <https://urlscan.io/result/0198fd5b-0763-7058-8bf4-5a8a755b9cfe/>

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/08/23985762398576198764252.jpg)

---

📡 **Related Intelligence**  
WHOIS Record: <https://who.is/whois/larpfxs.top>  
VirusTotal Report: <https://www.virustotal.com/gui/domain/larpfxs.top>

---

🛡️ **Defensive Guidance**

- Block `larpfxs[.]top` at DNS, proxy, and endpoint layers.
- Monitor for Lumma Stealer callbacks and credential exfiltration attempts.
- Hunt for stealer payloads and persistence mechanisms in endpoint telemetry.
- Review DNS and proxy logs for suspicious outbound requests to this domain.