Back

docin.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain docin.com has experienced a significant number of data breach and infostealer events over the past year, with 10,839 data breaches and 1,563 infostealer logs recorded. These events primarily involve client data, with a notable increase in employee-related incidents observed in the latter half of the reporting period, particularly in March and April 2026. The most prevalent malware families associated with these events are Rhadamanthys and Redline, both known for their credential-stealing capabilities. The majority of data exposure originates from "Combolist sources," indicating compromised credentials being aggregated and sold.

Total Events

12,402
credential exposure events

Employee Affected Events

150
account email domain = docin.com

Client Affected Events

12,252
service target = docin.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
4,0002,6671,3330
peak month 3,435
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,563
Share13%
Data breaches
Events10,839
Share87%
Infostealer logs (13%)
1,563events
Data breaches (87%)
10,839events

150 compromised employee accounts pose an infrastructure risk, while 12,252 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender9

Malware Families Distribution

Distribution of Active Stealer Strains

Rhadamanthys325
Redline323
LummaC2196
Acreed114
Vidar50
StealC17
Cthulhu17
RisePro15
Millenium10

Top Login URLs

Top exposed services found in the event results

  1. 1docin.com1,263
  2. 2https://docin.com930
  3. 3https://www.docin.com832
  4. 4www.docin.com572
  5. 5docin.com/app/forward398
  6. 6https://www.docin.com/app/forward343
  7. 7https://www.docin.com/340
  8. 8http://www.docin.com/327
  9. 9docin.com/322
  10. 10http://www.docin.com/app/forward250

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

China
Events589
Taiwan
Events103
Malaysia
Events100
United States
Events65
Vietnam
Events25
Canada
Events21
South Korea
Events17

Country Breakdown

  1. 1China589
  2. 2Taiwan103
  3. 3Malaysia100
  4. 4United States65
  5. 5Hong Kong SAR China58
  6. 6Vietnam25
  7. 7Canada21
  8. 8South Korea17

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

-
Total

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11140
Windows 10 Enterprise x64109
Windows 10 22H2 build 19045 (64 Bit)102
Windows 11 (Build 26200) (64 Bit)94
Windows 11 24H2 build 26100 (64 Bit)93

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
10,834
Combolist pools
5
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.