cafebazaar.ir Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting cafebazaar.ir, with a high risk score of 92. The primary concern stems from 12,719 historical data breaches and 1,287 active infostealer logs, affecting 581 employees and 13,425 clients. The data breaches are predominantly sourced from "Combolist sources," suggesting credential stuffing or account takeover attempts. Infostealer activity is linked to prevalent malware families such as Redline, LummaC2, and Rhadamanthys, which are known for exfiltrating credentials and sensitive information. The timeline shows a surge in client-related events in March 2026, with a notable increase in employee events in the same month, potentially indicating a coordinated attack or widespread compromise. Given the high volume of data breaches and infostealer activity, the priority for remediation should focus on credential hygiene, multi-factor authentication enforcement, and comprehensive endpoint security monitoring. The prevalence of Redline and LummaC2 suggests a need to investigate and mitigate their specific attack vectors. The targeted services, particularly pishkhan.cafebazaar.ir, should be scrutinized for vulnerabilities and unauthorized access. The geographical breakdown indicates a concentration of activity originating from Iran, aligning with the domain's origin, but also shows presence in the United States and Germany, suggesting potential international reach of the threat actors or compromised entities.