Back

kenh14.vn Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain kenh14.vn has experienced a significant number of historical data breaches (1075 events) and active infostealer logs (189 events) over the past year, indicating a high level of exposure. The majority of these events are attributed to combolist sources, with malware families such as Redline, LummaC2, and Acreed being prevalent. The timeline shows a notable increase in employee and client-related events, particularly in March and April 2026, suggesting a potential surge in credential compromise or data exfiltration activities targeting these user groups. The primary affected geography is Vietnam, with other countries like the United States and Japan also appearing in the breakdown. Given the high volume of data breaches and the presence of active infostealer logs, this exposure poses a critical risk. The prevalence of combolists suggests a high likelihood of credential stuffing attacks, potentially impacting both employee and client accounts. The identified malware families are known for their ability to steal credentials and sensitive information. Remediation efforts should focus on immediate credential reset for all affected users, enhanced monitoring for suspicious login activity, and a thorough review of security configurations for the kenh14.vn domain and its associated services, particularly those identified in the targeted services list.

Total Events

1,264
credential exposure events

Employee Affected Events

324
account email domain = kenh14.vn

Client Affected Events

940
service target = kenh14.vn

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
3002001000
peak month 262
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events189
Share15%
Data breaches
Events1,075
Share85%
Infostealer logs (15%)
189events
Data breaches (85%)
1,075events

324 compromised employee accounts pose an infrastructure risk, while 940 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

No Data Available

Malware Families Distribution

Distribution of Active Stealer Strains

Redline36
LummaC217
Acreed13
StealC11
Vidar8
Raccoon1
RisePro1

Top Login URLs

Top exposed services found in the event results

  1. 1kenh14.vn101
  2. 2https://kenh14.vn99
  3. 3kenh14.vn/48
  4. 4https://kenh14.vn/40
  5. 5http://kenh14.vn/30
  6. 6http://toiyeuloptoi.kenh14.vn/20
  7. 7https://kenh14.vn/login20
  8. 8toiyeuloptoi.kenh14.vn/login.aspx17
  9. 9kenh14.vn/login15
  10. 10http://toiyeuloptoi.kenh14.vn/login.aspx14

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

Vietnam
Events59
United States
Events14
Japan
Events10
Canada
Events9
South Korea
Events6
China
Events5
United Kingdom
Events4
Germany
Events4

Country Breakdown

  1. 1Vietnam59
  2. 2United States14
  3. 3Japan10
  4. 4Canada9
  5. 5South Korea6
  6. 6China5
  7. 7United Kingdom4
  8. 8Germany4

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

WordPress1

Operating System Distribution

Distribution of compromised endpoint builds

Windows 1159
Windows 10 Pro11
Windows 10 Enterprise x648
Windows 10 Home x645
Windows 11 Pro x644

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
1,050
Combolist pools
25
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.