Back

delekus.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain delekus.com exhibits a critical risk score of 100, primarily driven by a significant volume of historical data breaches (35,166 events) and active infostealer logs (1,676 events) over the observed period. The majority of these events are linked to employee data, suggesting a widespread compromise affecting internal user credentials. Malware families such as Redline and Vidar are prominent, indicating active credential harvesting and data exfiltration attempts. The timeline shows a surge in employee-related events in September 2025 and March 2026, correlating with increased infostealer activity. Targeted services include the main domain, job portals, and authentication endpoints, highlighting potential pathways for initial access and lateral movement. The prevalence of older 32-bit Windows Server operating systems and the classification of leak repositories as "Combolist sources" and "Database dumps" further suggest a mature, potentially automated attack campaign leveraging compromised credentials.

Total Events

36,842
credential exposure events

Employee Affected Events

36,136
account email domain = delekus.com

Client Affected Events

706
service target = delekus.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
10,0006,6673,3330
peak month 9,055
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,676
Share5%
Data breaches
Events35,166
Share96%
Infostealer logs (5%)
1,676events
Data breaches (96%)
35,166events

36,136 compromised employee accounts pose an infrastructure risk, while 706 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Kaspersky1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline1,640
Vidar8
Acreed7
LummaC22

Top Login URLs

Top exposed services found in the event results

  1. 1delekus.com402
  2. 2jobs.delekus.com27
  3. 3https://jobs.delekus.com26
  4. 4https://auth.delekus.com/adfs/ls/16
  5. 5https://jobs.delekus.com/talentcommunity/subscribe/4147600/10
  6. 6https://jobs.delekus.com/talentcommunity/subscribe/2563000/7
  7. 7https://sts.delekus.com/adfs/ls4
  8. 8connectit.delekus.com/login/login4
  9. 9https://jobs.delekus.com/job/TXBig-Spring-Electrical-and-Instrumentation-Technician-TX-79720/496427300/4
  10. 10sts.delekus.com4

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events423
Netherlands
Events423
Germany
Events321
Denmark
Events149
United Kingdom
Events40
France
Events34
Sweden
Events25

Country Breakdown

  1. 1United States423
  2. 2Netherlands423
  3. 3Germany321
  4. 4Denmark149
  5. 5Luxembourg40
  6. 6United Kingdom40
  7. 7France34
  8. 8Sweden25

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Citrix47
Microsoft32
Pulse Secure26
Cisco (AnyConnect)13
FortiNet VPN11
Auth06
Git4

Operating System Distribution

Distribution of compromised endpoint builds

Windows Server 2016 x32136
Windows Server 2008 R2 x32133
Windows Server 2003 x32124
Windows Server 2008 x32123
Windows Server 2012 x32116

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
33,120
Combolist pools
2,046
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.