digikala.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with nearly 200,000 historical data breaches and over 18,000 infostealer events observed over the reporting period. The majority of these events are linked to "Combolist sources," suggesting compromised credentials. Malware families such as Redline, LummaC2, and Rhadamanthys are prevalent, indicating active credential harvesting and exfiltration attempts. The targeted services primarily include the digikala.com domain and its login endpoints, affecting a large number of clients. The timeline shows a peak in client-related events in March 2026, with a substantial number of employee events also noted throughout the period, particularly in September 2025 and March 2026. Given the high volume of client data breaches and infostealer activity targeting login credentials for digikala.com, this situation poses a critical risk. The prevalence of infostealer malware suggests that attackers are actively trying to gain unauthorized access to user accounts, which could lead to further compromise of sensitive information and services. Prioritization should focus on immediate credential hygiene, including mandatory password resets for all users, enhanced monitoring for suspicious login activity, and a review of access controls for critical systems. Investigating the root cause of the historical data breaches and the source of the combolists is also crucial for long-term mitigation.