Back

libraryreserve.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain libraryreserve.com exhibits a high-risk score of 86, primarily driven by a significant volume of historical data breaches (15,589 events) and active infostealer logs (2,581 events) over the observed period. The data breach events are overwhelmingly sourced from "Combolist sources," indicating potential credential stuffing or account takeover attempts. Infostealer activity is linked to prevalent malware families such as Rhadamanthys, LummaC2, and Redline, targeting Windows operating systems. The exposure affects a large number of clients (18,100) and a smaller number of employees (70), with the United States being the most frequently observed geography. The timeline shows a notable increase in employee-related events in early 2026, coinciding with a surge in client events in March 2026. Given the high volume of data breaches and active infostealer infections, the priority for remediation should focus on credential hygiene and endpoint security. The prevalence of combolist sources suggests that compromised credentials from other breaches are being used against this domain's users. Therefore, implementing robust multi-factor authentication, monitoring for credential stuffing attempts, and ensuring endpoints are protected against infostealer malware are critical steps. The identified malware families and targeted services, particularly the sign-in pages for various regional libraryreserve.com instances, should be scrutinized for any signs of compromise or phishing activity.

Total Events

18,170
credential exposure events

Employee Affected Events

70
account email domain = libraryreserve.com

Client Affected Events

18,100
service target = libraryreserve.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
5,0003,3331,6670
peak month 4,650
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events2,581
Share14%
Data breaches
Events15,589
Share86%
Infostealer logs (14%)
2,581events
Data breaches (86%)
15,589events

70 compromised employee accounts pose an infrastructure risk, while 18,100 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender69

Malware Families Distribution

Distribution of Active Stealer Strains

Rhadamanthys330
LummaC2325
Redline302
Acreed229
Vidar88
X-Files61
Millenium34
RisePro25
StealC14

Top Login URLs

Top exposed services found in the event results

  1. 1https://toronto.libraryreserve.com/10/50/en/SignIn.htm152
  2. 2toronto.libraryreserve.com/10/50/en/SignIn.htm108
  3. 3libraryreserve.com71
  4. 4https://phoenix.libraryreserve.com/10/50/en/SignIn2.htm57
  5. 5https://stateofohio.libraryreserve.com/10/50/en/SignIn2.htm56
  6. 6https://kingcounty.libraryreserve.com/10/50/en/SignIn.htm44
  7. 7toronto.libraryreserve.com41
  8. 8https://libraryreserve.com40
  9. 9https://toronto.libraryreserve.com39
  10. 10https://wrdsbca.libraryreserve.com/10/45/en/SignIn.htm39

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events944
Canada
Events256
Fiji
Events50
United Kingdom
Events39
South Korea
Events26
Australia
Events17
Netherlands
Events14
Indonesia
Events11

Country Breakdown

  1. 1United States944
  2. 2Canada256
  3. 3Fiji50
  4. 4United Kingdom39
  5. 5South Korea26
  6. 6Australia17
  7. 7Netherlands14
  8. 8Indonesia11

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

-
Total

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11323
Windows 11 24H2 build 26100 (64 Bit)188
Windows 10 Home x64176
Windows 10 Enterprise x6478
Windows 1075

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
15,585
Combolist pools
4
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.