178.com Domain Breach Exposure Report

The domain 178.com has experienced a significant exposure event, with 15,582 historical data breaches and 3,349 active infostealer logs recorded between July 2025 and June 2026. The majority of these events, 82.3%, are attributed to historical data breaches, while 17.7% are active infostealer logs. The timeline indicates a surge in employee-related events in September 2025 and February 2026, and client-related events peaking in March 2026. Malware families such as Rhadamanthys (32.1%), Redline (17.4%), and Acreed (12.5%) are prominently associated with these infostealer logs. Targeted services include account management and forum-related URLs, primarily on the "nga.178.com" subdomain. The data suggests a strong concentration of affected users in China (71.6%), followed by Malaysia and Taiwan. The leak repository classification indicates that 89.9% of the data originated from "Combolist sources," with the remainder from "Database dumps." This high-risk exposure, characterized by a substantial volume of data breaches and active infostealer activity, necessitates immediate attention. The prevalence of infostealer malware targeting account credentials and the significant number of historical breaches suggest a high likelihood of credential stuffing attacks and potential account takeovers. Prioritization should focus on incident response, credential reset campaigns for affected employees and clients, and enhanced monitoring of account access from the identified geographic regions. Given the nature of the targeted services and the domain's association with online communities and account management, the primary sector is likely Retail & E-commerce.