Back

kuwo.cn Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain kuwo.cn has experienced a significant exposure event, with a total of 5741 recorded incidents over the observed period. A substantial portion of these events, 72.6%, are attributed to historical data breaches, while the remaining 27.4% are active infostealer logs. The timeline indicates a surge in client-related incidents starting in September 2025 and peaking in March and April 2026, with employee-related incidents also appearing during these months. Malware families such as Rhadamanthys, Redline, and LummaC2 are prominently featured, suggesting a coordinated effort to exfiltrate data. The majority of the exposure originates from China, with Malaysia and Hong Kong also showing notable activity. The presence of "Combolist sources" in leak repositories, accounting for 99.5% of related leaks, indicates that credential stuffing or similar attacks leveraging compromised credentials are a primary vector.

Total Events

5,741
credential exposure events

Employee Affected Events

162
account email domain = kuwo.cn

Client Affected Events

5,579
service target = kuwo.cn

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
1,5001,0005000
peak month 1,382
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,573
Share27%
Data breaches
Events4,168
Share73%
Infostealer logs (27%)
1,573events
Data breaches (73%)
4,168events

162 compromised employee accounts pose an infrastructure risk, while 5,579 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender3

Malware Families Distribution

Distribution of Active Stealer Strains

Rhadamanthys404
Redline282
LummaC2248
Acreed197
Vidar37
Millenium23
StealC22
Raccoon6
Remus5

Top Login URLs

Top exposed services found in the event results

  1. 1http://pc.i.kuwo.cn/US/mbox/login2015new/findPwd.jsp600
  2. 2kuwo.cn304
  3. 3kuwo.cn/266
  4. 4http://www.kuwo.cn/235
  5. 5https://kuwo.cn210
  6. 6https://kuwo.cn/156
  7. 7https://www.kuwo.cn144
  8. 8https://www.kuwo.cn/134
  9. 9www.kuwo.cn/132
  10. 10android://zbOPviFwHlq7AAGbk0e0Os_Bn8q46PrxaAS7gdDKLYX9VZpMHZ3oShCQeGQQZdQQTfKIzO9n2UdQR7wnRANSoQ==@cn.kuwo.player/116

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

China
Events554
Malaysia
Events274
Taiwan
Events99
Japan
Events33
United States
Events26
South Korea
Events22
Vietnam
Events17

Country Breakdown

  1. 1China554
  2. 2Malaysia274
  3. 3Hong Kong SAR China123
  4. 4Taiwan99
  5. 5Japan33
  6. 6United States26
  7. 7South Korea22
  8. 8Vietnam17

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Git2

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11261
Windows 11 23H2 build 22631 (64 Bit)142
Windows 11 (Build 26200) (64 Bit)137
Windows 11 24H2 build 26100 (64 Bit)120
Windows 10 22H2 build 19045 (64 Bit)117

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
4,149
Combolist pools
19
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.