Back

oxy.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant exposure event affecting oxy.com, with 55,845 historical data breaches and 1,944 active infostealer logs observed between July 2025 and June 2026. The majority of these events are linked to historical data breaches, with a substantial portion also originating from combolist sources and database dumps. The primary malware family associated with infostealer activity is Redline, accounting for 89.2% of identified malware. Employee accounts are the most frequently compromised, followed by client accounts, suggesting a broad impact on user credentials. The timeline shows a peak in employee and client compromises in September 2025 and January 2026, with ongoing activity throughout the period. Given the high volume of historical data breaches and the prevalence of infostealer activity, particularly Redline malware, the risk to oxy.com is critical. The exposure of employee and client credentials poses a direct threat of further account takeovers, financial fraud, and reputational damage. Remediation efforts should focus on credential hygiene, including mandatory password resets for all employees and clients, enhanced multi-factor authentication deployment, and thorough security awareness training to mitigate the risk of credential stuffing and phishing attacks. Additionally, a comprehensive review of data breach incident response procedures and data security controls is warranted.

Total Events

57,789
credential exposure events

Employee Affected Events

54,623
account email domain = oxy.com

Client Affected Events

3,166
service target = oxy.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
20,00013,3336,6670
peak month 16,801
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,944
Share3%
Data breaches
Events55,845
Share97%
Infostealer logs (3%)
1,944events
Data breaches (97%)
55,845events

54,623 compromised employee accounts pose an infrastructure risk, while 3,166 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender3
Avira3
Kaspersky2
Bitdefender1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline1,734
Rhadamanthys28
LummaC227
Acreed15
Vidar13
RisePro10
StealC7
Remus5
Blank Grabber4

Top Login URLs

Top exposed services found in the event results

  1. 1oxy.com946
  2. 2https://oxy.com82
  3. 3m2guest1.oxy.com79
  4. 4https://m2guest1.oxy.com70
  5. 5soguest1.oxy.com64
  6. 6oxy.com/login61
  7. 7https://soguest1.oxy.com55
  8. 8clguest1.oxy.com52
  9. 9https://m2guest1.oxy.com:8446/portal/PortalSetup.action51
  10. 10https://soguest1.oxy.com:8446/portal/PortalSetup.action43

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events445
Netherlands
Events425
Germany
Events330
Denmark
Events161
United Kingdom
Events54
Colombia
Events36

Country Breakdown

  1. 1United States445
  2. 2Netherlands425
  3. 3Germany330
  4. 4Denmark161
  5. 5United Kingdom54
  6. 6Oman37
  7. 7Colombia36
  8. 8Luxembourg33

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft149
Citrix97
Cisco (AnyConnect)20
FortiNet VPN17
Pulse Secure17
Git13
WordPress10

Operating System Distribution

Distribution of compromised endpoint builds

Windows Server 2012 x32131
Windows 7 x32130
Windows Server 2003 R2 x32128
Windows 10 Home x32124
Windows Server 2016 x32123

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
38,703
Combolist pools
17,142
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.