dxy.cn Domain Breach Exposure Report

The domain dxy.cn has experienced a significant number of historical data breaches and active infostealer logs, totaling over 4,100 events between July 2025 and June 2026. The majority of these events (84.1%) are attributed to historical data breaches, with a substantial portion (15.9%) being active infostealer logs. The timeline shows a notable increase in client-related events starting in September 2025, with a sharp rise in employee-related events in the latter half of the observed period, particularly in June 2026. Malware families associated with these events include Redline, LummaC2, and Rhadamanthys, commonly targeting authentication services for dxy.cn. The exposure primarily originates from combolist sources, indicating credential stuffing or reuse attacks. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of authentication services and the prevalence of common infostealer malware, presents a critical risk. The increasing number of employee-related events in recent months suggests a growing threat to internal credentials. Prioritization should focus on securing authentication mechanisms, investigating the source of the combolists, and implementing enhanced monitoring for credential compromise and unauthorized access attempts, particularly for employee accounts.