The ongoing efforts to combat Lumma malware reveal a consistent use of clustered infrastructure by its operators, making the analysis of command and control (C2) activities and domain distribution essential for understanding this threat. Recent investigations indicate that a significant number of Lumma-related domains are hosted at a specific IP address, 46.28.71.142, which is registered to ROUTE95 GREEN FLOID LLC (ASN 8254). Through tools such as Validin, researchers identified that this host supports around 320 domains, most of which have been previously flagged for distributing Lumma malware and remain active.