Back

adidas.tmall.com Domain Breach Exposure Report

Risk Score

Medium Risk

Moderate exposure in standard leak repositories.

AI Findings Summary

Elevated

The domain adidas.tmall.com has been associated with a significant number of historical data breaches, totaling 303 events, which represent 83.5% of all observed events. Additionally, there were 60 instances of active infostealer logs, accounting for 16.5% of the total events. The timeline indicates a surge in client-related events from September 2025 through March 2026, with a notable increase in employee-related events starting in March 2026. Malware families identified include Redline and LummaC2, with Redline being the most prevalent. The high volume of historical data breaches, primarily sourced from combolist sources, suggests a widespread exposure of credentials. The presence of active infostealer logs, particularly targeting login pages, indicates ongoing compromise attempts and potential for further credential harvesting. The observed malware families are known for their ability to steal sensitive information. Prioritization should focus on immediate credential reset campaigns for both employees and clients, enhanced monitoring for suspicious login activity on adidas.tmall.com and related login endpoints, and a thorough review of data security practices to prevent future breaches.

Total Events

363
credential exposure events

Employee Affected Events

52
account email domain = adidas.tmall.com

Client Affected Events

311
service target = adidas.tmall.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
10067330
peak month 81
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events60
Share17%
Data breaches
Events303
Share84%
Infostealer logs (17%)
60events
Data breaches (84%)
303events

52 compromised employee accounts pose an infrastructure risk, while 311 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

No Data Available

Malware Families Distribution

Distribution of Active Stealer Strains

Redline15
LummaC24

Top Login URLs

Top exposed services found in the event results

  1. 1https://adidas.tmall.com58
  2. 2adidas.tmall.com56
  3. 3https://adidas.tmall.com/home32
  4. 4adidas.tmall.com/home25
  5. 5https://adidas.tmall.com/logon24
  6. 6https://www.adidas.tmall.com21
  7. 7adidas.tmall.com/logon21
  8. 8https://adidas.tmall.com/17
  9. 9adidas.tmall.com/17
  10. 10adidas.tmall.com/login14

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

Netherlands
Events7
United States
Events4
Japan
Events4
China
Events4
Denmark
Events4
Mexico
Events4
Argentina
Events3
Brazil
Events3

Country Breakdown

  1. 1Netherlands7
  2. 2United States4
  3. 3Japan4
  4. 4China4
  5. 5Denmark4
  6. 6Mexico4
  7. 7Argentina3
  8. 8Brazil3

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

-
Total

Operating System Distribution

Distribution of compromised endpoint builds

Windows 1122
Windows Server 2008 x324
Windows 10 Enterprise x323
Windows Server 2008 R2 x322
Windows 7 x321

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
303
Combolist pools
0
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.