Back

murphyusa.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain murphyusa.com is associated with a significant number of historical data breaches, totaling 36,754 events, and 1,951 active infostealer logs. The timeline indicates a surge in employee and client-related events throughout 2025 and early 2026, with peaks in September 2025 and March 2026. The primary malware families identified are Redline and Rhadamanthys, both known for credential theft. The exposure primarily affects employees, with a smaller but notable impact on clients. The data suggests a high risk of credential compromise and potential further data exfiltration.

Total Events

38,705
credential exposure events

Employee Affected Events

36,981
account email domain = murphyusa.com

Client Affected Events

1,724
service target = murphyusa.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
10,0006,6673,3330
peak month 9,349
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,951
Share5%
Data breaches
Events36,754
Share95%
Infostealer logs (5%)
1,951events
Data breaches (95%)
36,754events

36,981 compromised employee accounts pose an infrastructure risk, while 1,724 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender2
Kaspersky2

Malware Families Distribution

Distribution of Active Stealer Strains

Redline1,840
Rhadamanthys31
LummaC221
Acreed12
Vidar10
Aurora2
Remus1
RisePro1

Top Login URLs

Top exposed services found in the event results

  1. 1murphyusa.com424
  2. 2https://eoffers.murphyusa.com129
  3. 3eoffers.murphyusa.com114
  4. 4eoffers.murphyusa.com/users/sign_in98
  5. 5https://eoffers.murphyusa.com/users/sign_in65
  6. 6http://eoffers.murphyusa.com/users/sign_in62
  7. 7https://www.murphyusa.com/driverewards/login55
  8. 8eoffers.murphyusa.com/54
  9. 9http://eoffers.murphyusa.com/47
  10. 10https://eoffers.murphyusa.com/43

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events513
Netherlands
Events404
Germany
Events385
Denmark
Events168
United Kingdom
Events49
France
Events46
Switzerland
Events37
Romania
Events34

Country Breakdown

  1. 1United States513
  2. 2Netherlands404
  3. 3Germany385
  4. 4Denmark168
  5. 5United Kingdom49
  6. 6France46
  7. 7Switzerland37
  8. 8Romania34

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Citrix48
FortiNet VPN36
Cisco (AnyConnect)19
Git12
Microsoft12
Pulse Secure9

Operating System Distribution

Distribution of compromised endpoint builds

Windows Server 2012 R2 x32140
Windows 8.1 x32140
Windows Server 2003 R2 x32137
Windows Server 2008 x32137
Windows 10 Home x32132

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
34,590
Combolist pools
2,164
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.