Back

epochtimes.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain epochtimes.com exhibits a high-risk score of 92, primarily driven by a significant volume of historical data breaches (1394 events) and active infostealer logs (146 events) over the observed period. The data indicates a substantial compromise affecting both employees (869) and clients (671), with a notable concentration of these events occurring in January 2026 and March 2026. Malware families such as LummaC2, Redline, and Rhadamanthys are frequently associated with these incidents, suggesting ongoing credential harvesting and data exfiltration activities. The targeted services include login and logon endpoints on epochtimes.com, indicating potential credential stuffing or phishing attacks aimed at these specific pages. The geographical distribution shows a notable presence in the United States, Taiwan, and China.

Total Events

1,540
credential exposure events

Employee Affected Events

869
account email domain = epochtimes.com

Client Affected Events

671
service target = epochtimes.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
3002001000
peak month 251
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events146
Share10%
Data breaches
Events1,394
Share91%
Infostealer logs (10%)
146events
Data breaches (91%)
1,394events

869 compromised employee accounts pose an infrastructure risk, while 671 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

No Data Available

Malware Families Distribution

Distribution of Active Stealer Strains

LummaC228
Redline21
Rhadamanthys13
Vidar5
StealC1
Aurora1
Acreed1

Top Login URLs

Top exposed services found in the event results

  1. 1epochtimes.com91
  2. 2https://epochtimes.com55
  3. 3https://epochtimes.com/26
  4. 4https://epochtimes.com/logon24
  5. 5https://epochtimes.com/login19
  6. 6epochtimes.com/17
  7. 7https://www.epochtimes.com16
  8. 8https://epochtimes.com/home16
  9. 9www.epochtimes.com16
  10. 10epochtimes.com/login15

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events30
Taiwan
Events18
China
Events11
Canada
Events6
Denmark
Events5
Netherlands
Events4
United Kingdom
Events3
Brazil
Events3

Country Breakdown

  1. 1United States30
  2. 2Taiwan18
  3. 3China11
  4. 4Canada6
  5. 5Denmark5
  6. 6Netherlands4
  7. 7United Kingdom3
  8. 8Brazil3

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

GitLab5
WordPress4
Zendesk4

Operating System Distribution

Distribution of compromised endpoint builds

Windows 1125
Windows 11 Home (10.0.22631) x6415
Windows 11 24H2 build 26100 (64 Bit)8
Windows 11 22H2 build 22621 (64 Bit)8
Windows 11 Pro5

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
915
Combolist pools
479
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.