Back

joins.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain joins.com exhibits a critical risk score of 100, primarily driven by 14,698 historical data breaches and 2,166 active infostealer logs. The data indicates a significant exposure of client information, with 14,723 client events compared to 2,141 employee events. The timeline shows a surge in client-related events in March 2026, coinciding with a rise in employee events. Malware analysis reveals a prevalence of infostealers like Redline, LummaC2, and Rhadamanthys, suggesting active credential harvesting and data exfiltration attempts targeting the domain's users. The high volume of data breaches and infostealer activity, predominantly linked to "Combolist sources" and targeting services like "my.joins.com," indicates a severe and ongoing compromise. The primary affected geography is South Korea. Remediation should focus on immediate incident response to contain active infostealer infections, comprehensive credential reset for all affected users, and a thorough investigation into the root cause of the data breaches, likely stemming from compromised credentials or vulnerable web applications. Given the nature of the data and the domain, the closest industry sector is Technology & SaaS.

Total Events

16,864
credential exposure events

Employee Affected Events

2,141
account email domain = joins.com

Client Affected Events

14,723
service target = joins.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
4,0002,6671,3330
peak month 3,902
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events2,166
Share13%
Data breaches
Events14,698
Share87%
Infostealer logs (13%)
2,166events
Data breaches (87%)
14,698events

2,141 compromised employee accounts pose an infrastructure risk, while 14,723 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender76
AhnLab V3 Lite4

Malware Families Distribution

Distribution of Active Stealer Strains

Redline397
LummaC2396
Rhadamanthys276
Acreed113
Vidar79
X-Files41
StealC34
RisePro34
Remus30

Top Login URLs

Top exposed services found in the event results

  1. 1https://my.joins.com1,620
  2. 2my.joins.com1,543
  3. 3https://my.joins.com/register/member_reg_f1.asp1,111
  4. 4https://my.joins.com/login/JTBC/login.asp778
  5. 5my.joins.com/register/member_reg_f1.asp742
  6. 6https://my.joins.com/524
  7. 7my.joins.com/login/JTBC/login.asp509
  8. 8https://my.joins.com/login/447
  9. 9my.joins.com/331
  10. 10my.joins.com/login/307

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

South Korea
Events1,258
United States
Events51
Canada
Events34
Vietnam
Events23
Thailand
Events19
Japan
Events9
Germany
Events9
Indonesia
Events9

Country Breakdown

  1. 1South Korea1,258
  2. 2United States51
  3. 3Canada34
  4. 4Vietnam23
  5. 5Thailand19
  6. 6Japan9
  7. 7Germany9
  8. 8Indonesia9

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Citrix3

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11201
Windows 10 Enterprise x64166
Windows 10 22H2 build 19045 (64 Bit)154
Windows 11 24H2 build 26100 (64 Bit)111
Windows 11 Pro (10.0.26100) x6473

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
14,493
Combolist pools
205
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.