ball.com Domain Breach Exposure Report

The domain ball.com has experienced a significant number of events, with over 55,000 total occurrences recorded between July 2025 and June 2026. The vast majority of these events, over 53,000, are classified as historical data breaches, indicating a substantial past exposure of sensitive information. Additionally, there are nearly 2,100 active infostealer logs, suggesting ongoing compromise and data exfiltration. The primary malware family associated with these infostealer logs is Redline, which is known for stealing credentials and sensitive data from infected systems. The timeline shows a peak in employee-related events in January 2026, coinciding with a surge in data breaches, and a notable increase in client-related events throughout the latter half of 2025 and early 2026. The data suggests that the primary threat vector is likely credential stuffing or exploitation of previously breached credentials, given the prevalence of "Combolist sources" in the leak repository classification.