hao123.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event originating from hao123.com, with a risk score of 100. The primary concern stems from 8,265 historical data breaches and 1,542 active infostealer logs, affecting a total of 9,807 entities, predominantly clients (7,925) and employees (1,882). The timeline shows a surge in employee-related events in September 2025 and client-related events in March 2026, with a consistent presence of both throughout the reporting period. Malware families such as Rhadamanthys and Redline are prominently associated with these events, suggesting credential harvesting and data exfiltration. The high volume of data breaches and active infostealer logs, coupled with the prevalence of credential-stealing malware, elevates this incident to a critical priority. The exposure appears to be linked to combolist sources and database dumps, indicating a potential compromise of user credentials. Remediation efforts should focus on immediate credential rotation for all affected employees and clients, enhanced monitoring for suspicious activity on the hao123.com domain and related services, and a thorough investigation into the source of the data breaches and infostealer activity, particularly concerning the identified malware families.