life.tw Domain Breach Exposure Report

The domain life.tw has experienced a significant exposure event with 495 total incidents recorded between July 2025 and June 2026. The majority of these incidents, 381 (77%), are classified as historical data breaches, primarily originating from combolist sources. Additionally, 114 incidents (23%) are attributed to active infostealer logs, with Redline, LummaC2, and Rhadamanthys being the most prevalent malware families. The exposure primarily affects clients (392 instances) and employees (103 instances), with a notable surge in client-related incidents in September 2025 and employee and client incidents peaking in March and April 2026. Targeted services include the main domain, authentication endpoints like oauth.life.tw/auth, and login pages, indicating a broad attack surface. Given the high volume of historical data breaches and active infostealer activity, this exposure presents a critical risk. The prevalence of infostealer malware targeting credentials suggests a high likelihood of account compromise and potential for further downstream impacts, including unauthorized access and sensitive data exfiltration. Prioritization should focus on immediate remediation of exposed authentication mechanisms, credential reset for affected employees and clients, and enhanced monitoring for anomalous activity across all targeted services. The geographical distribution shows a concentration of affected entities in the United States and Taiwan, suggesting these regions may require focused attention.