google.by Domain Breach Exposure Report

The domain google.by has been associated with a significant number of historical data breaches (246 events) and active infostealer logs (57 events) over the past year, indicating a high risk of credential compromise. The majority of these events are linked to "Combolist sources," suggesting widespread credential stuffing attacks. The "Redline" infostealer family is the most prevalent, followed by "LummaC2." The exposure primarily affects clients (211) and employees (92), with a notable increase in client-related events in March and April 2026. The domain itself and its login pages are frequently targeted services, with exposure originating from various countries, including the United States and China. The prevalence of Windows 11 among affected operating systems suggests a broad user base. Given the high volume of data breaches and active infostealer activity, this exposure presents a critical risk. The focus should be on immediate remediation to prevent further credential compromise and potential downstream impacts. This includes enhancing authentication mechanisms, monitoring for suspicious login activity, and educating users about phishing and credential stuffing threats. The association with "Combolist sources" highlights the need to address compromised credentials being traded on the dark web.