99114.com Domain Breach Exposure Report

The domain 99114.com exhibits a high-risk profile due to a significant volume of historical data breaches (226 events) and active infostealer logs (11 events) observed over the reporting period. The majority of these events are linked to database dumps and combolist sources, indicating potential credential stuffing or large-scale data exfiltration. The timeline shows a notable surge in employee-related events in September 2025 and January 2026, coinciding with periods of increased client-related activity. Malware analysis points to the LummaC2 infostealer as a prevalent threat, associated with 72.7% of identified malware families. Targeted services include login portals for checkin.99114.com and member.99114.com, suggesting these are primary vectors for compromise. The telemetry also indicates a concentration of activity originating from China, and affected operating systems include Windows 10 and Windows 11 variants. Given the high number of data breaches and the presence of active infostealer logs, this exposure warrants immediate attention. The focus should be on investigating the root cause of the database dumps and combolist leaks, strengthening authentication mechanisms for employee and client portals, and enhancing endpoint security to detect and mitigate LummaC2 infections. Prioritizing remediation efforts on the identified targeted services and understanding the full scope of data compromised in the breaches is crucial for mitigating further impact.