google.lk Domain Breach Exposure Report

The domain google.lk has experienced a significant number of data breach events (549) and active infostealer logs (104) over the reporting period, indicating a high level of exposure. The majority of these events are linked to "Combolist sources" (532), suggesting compromised credentials are being aggregated and potentially reused. The timeline shows a notable increase in employee and client-related events from March 2026 onwards, with a peak in April 2026. Malware families such as Redline and LummaC2 are present, commonly associated with credential theft. The primary affected services are related to google.lk, with "FortiNet VPN" also appearing, which could indicate a potential pivot point or a related vulnerability. Given the high volume of data breaches and infostealer activity, coupled with the presence of credential-harvesting malware and the targeting of services like google.lk and VPN infrastructure, this exposure presents a critical risk. The prevalence of combolists indicates a high likelihood of account takeover attempts against both employees and clients. Prioritization should focus on immediate credential hygiene, including widespread password resets, multi-factor authentication enforcement, and enhanced monitoring for suspicious login activity across all affected services and user accounts. The presence of Sri Lanka in the country breakdown warrants specific attention for localized threats.